From 46327da2ac78a8b9f9c2912b1144d52417f7223d Mon Sep 17 00:00:00 2001 From: Christoph Date: Fri, 31 Jul 2026 02:24:42 +0200 Subject: [PATCH] Refactor Ansible tasks and templates for improved consistency and clarity --- group_vars/akb.yml | 59 ++- group_vars/flr.yml | 61 ++- group_vars/kb.yml | 20 +- group_vars/mbr.yml | 380 ++++++++---------- group_vars/sprachenatelier.yml | 91 ++--- host_vars/file-akb.akb.netz.yml | 41 +- host_vars/file-flr.flr.netz.yml | 42 +- host_vars/file-kb.anw-kb.netz.yml | 41 +- host_vars/file-mbr.mbr-bln.netz.yml | 43 +- host_vars/file-spr.sprachenatelier.netz.yml | 38 +- roles/common/tasks/apt.yml | 123 +++--- roles/common/tasks/basic.yml | 81 ++-- roles/common/tasks/cron.yml | 6 +- roles/common/tasks/cups-install.yml | 81 ++-- roles/common/tasks/default-users.yml | 68 ++-- roles/common/tasks/git.yml | 86 +++- roles/common/tasks/luks.yml | 3 +- roles/common/tasks/main.yml | 93 +++-- roles/common/tasks/mount_samba_shares.yml | 6 +- roles/common/tasks/nfs.yml | 46 ++- roles/common/tasks/nis-install-client.yml | 96 +++-- roles/common/tasks/nis-install-server.yml | 132 +++--- roles/common/tasks/nis-user-systemfiles.yml | 79 ++-- roles/common/tasks/nis-user.yml | 57 ++- roles/common/tasks/ntp.yml | 31 +- roles/common/tasks/pure-ftpd-install.yml | 22 +- .../common/tasks/pure-ftpd/authentication.yml | 32 +- roles/common/tasks/pure-ftpd/configure.yml | 16 +- .../pure-ftpd/create-virtual-ftp-user.yml | 70 +++- .../tasks/pure-ftpd/remove-virtual-user.yml | 24 +- roles/common/tasks/pure-ftpd/setup.yml | 6 +- .../tasks/pure-ftpd/tls-certificate.yml | 47 ++- .../common/tasks/pure-ftpd/virtual-users.yml | 22 +- roles/common/tasks/root-files-scripts.yml | 36 +- roles/common/tasks/samba-install.yml | 98 +++-- roles/common/tasks/samba-remove-user.yml | 46 ++- roles/common/tasks/samba-user.yml | 29 +- roles/common/tasks/sshd.yml | 55 +-- roles/common/tasks/sudoers-pc.yml | 11 +- roles/common/tasks/sudoers-server.yml | 20 +- roles/common/tasks/system-remove-user.yml | 8 +- .../common/tasks/system-user-systemfiles.yml | 146 ++++--- roles/common/tasks/system-user.yml | 21 +- roles/common/tasks/systemd-resolved.yml | 46 +-- .../common/tasks/ubuntu-x11vnc-1604-amd64.yml | 92 +++-- .../common/tasks/ubuntu-x11vnc-1804-amd64.yml | 111 ++--- .../common/tasks/ubuntu-x11vnc-2004-amd64.yml | 114 +++--- .../common/tasks/ubuntu-x11vnc-2204-amd64.yml | 114 +++--- .../common/tasks/ubuntu-x11vnc-2404-amd64.yml | 114 +++--- roles/common/templates/etc/ssh/sshd_config.j2 | 20 +- .../templates/etc/ssh/sshd_config.ubuntu.j2 | 4 +- .../resolved.conf.d/50-resolved-local.conf | 12 +- 52 files changed, 1679 insertions(+), 1461 deletions(-) diff --git a/group_vars/akb.yml b/group_vars/akb.yml index d8cbd62..577a15a 100644 --- a/group_vars/akb.yml +++ b/group_vars/akb.yml @@ -99,27 +99,27 @@ nfs_start_servers: 32 # Take car to increase 'fsid' in case of more than one export # nfs_exports: - - src: 192.168.82.10:/data/home - path: /data/home - mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.82.0/24 - - 10.0.82.0/24 - - 10.1.82.0/24 - - 192.168.63.0/24 - use_fsid_option: true + - src: 192.168.82.10:/data/home + path: /data/home + mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.82.0/24 + - 10.0.82.0/24 + - 10.1.82.0/24 + - 192.168.63.0/24 + use_fsid_option: true - - src: 192.168.82.10:/data/samba - path: /data/samba - mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.82.0/24 - - 10.0.82.0/24 - - 10.1.82.0/24 - - 192.168.63.0/24 - use_fsid_option: true + - src: 192.168.82.10:/data/samba + path: /data/samba + mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.82.0/24 + - 10.0.82.0/24 + - 10.1.82.0/24 + - 192.168.63.0/24 + use_fsid_option: true # ========== @@ -158,7 +158,7 @@ pureftpd_virtual_users: uid: jibran gid: users -#pureftpd_virtual_deleted_users: +# pureftpd_virtual_deleted_users: # # Available properties # - name: vuser2 @@ -176,10 +176,10 @@ pureftpd_virtual_users_import: false pureftpd_tls_certificate_method: 'generate' # for method 'generate' -# +# # Available properties # -#pureftpd_tls_certificate_openssl: +# pureftpd_tls_certificate_openssl: # size: 4096 # days: 365 # fqdn: ftp.example.com @@ -207,19 +207,19 @@ pureftpd_tls_certificate_openssl: # # On NIS supported Server put your users and groups in the # appropriate section for playbook 'nis-user.yml' -# +# # ! Notice ! remove_system_users: [] -#remove_system_users: +# remove_system_users: # - name: test system_users: [] -#system_users: +# system_users: # - name: test # password: 'test100' -#system_users: +# system_users: # # - name: sysadm # password: '9xFXkdPR_2' @@ -259,7 +259,7 @@ nis_groups: group_id: 1130 remove_nis_users: [] -#remove_nis_users: +# remove_nis_users: # - name: anna # - name: birgit # - name: jonas @@ -470,7 +470,7 @@ samba_shares: recycle_path: '@Recycle.Bin' user: - buero - - chris + - chris - jibran - praktikum - maica @@ -689,4 +689,3 @@ sudo_pc_users: # ========== # vars used by roles/common/tasks/luks.yml # ========== - diff --git a/group_vars/flr.yml b/group_vars/flr.yml index 1ca685b..267a73a 100644 --- a/group_vars/flr.yml +++ b/group_vars/flr.yml @@ -121,7 +121,7 @@ resolved_nameserver: # If there are more than one search domains, then specify them here in the order in which # the resolver should also search them # -#resolved_domains: [] +# resolved_domains: [] resolved_domains: - ~. - flr.netz @@ -131,16 +131,12 @@ resolved_dnssec: false # dns.as250.net: 194.150.168.168 # resolved_fallback_nameserver: - - 172.16.102.254 - - + - 172.16.102.254 # ========== # vars used by roles/common/tasks/git.yml # ========== - - # ========== # vars used by roles/common/tasks/ntp.yml # ========== @@ -162,29 +158,29 @@ nfs_start_servers: 16 # partition. # nfs_exports: - - src: 192.168.102.10:/data/home - path: /data/home - mount_opts: users,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.102.0/24 - - 10.0.102.0/24 - - 10.1.102.0/24 - - 192.168.63.0/24 - fs_encrypted: false - use_fsid_option: true + - src: 192.168.102.10:/data/home + path: /data/home + mount_opts: users,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.102.0/24 + - 10.0.102.0/24 + - 10.1.102.0/24 + - 192.168.63.0/24 + fs_encrypted: false + use_fsid_option: true - - src: 192.168.102.10:/data/samba - path: /data/samba - mount_opts: users,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.102.0/24 - - 10.0.102.0/24 - - 10.1.102.0/24 - - 192.168.63.0/24 - fs_encrypted: false - use_fsid_option: true + - src: 192.168.102.10:/data/samba + path: /data/samba + mount_opts: users,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.102.0/24 + - 10.0.102.0/24 + - 10.1.102.0/24 + - 192.168.63.0/24 + fs_encrypted: false + use_fsid_option: true # ========== @@ -206,7 +202,7 @@ nfs_exports: remove_system_users: [] system_users: [] -#system_users: +# system_users: # - name: sysadm # password: '9xFXkdPR_2' @@ -253,7 +249,7 @@ nis_groups: group_id: 1038 remove_nis_users: [] -#remove_nis_users: +# remove_nis_users: # - name: test # - name: ivana @@ -484,7 +480,7 @@ samba_server_cidr_prefix: 24 samba_workgroup: FLR samba_netbios_name: FILE-FLR -#samba_allow_insecure_wide_links: !!str yes +# samba_allow_insecure_wide_links: !!str yes samba_shares: - name: Team @@ -583,7 +579,7 @@ samba_shares: group_write_list: team file_create_mask: '0660' dir_create_mask: '2770' - #wide_links: !!str yes + # wide_links: !!str yes vfs_object_virusfilter: true vfs_object_recycle: true recycle_path: '@Recycle.Bin' @@ -634,4 +630,3 @@ sudo_pc_users: # ========== # vars used by roles/common/tasks/luks.yml # ========== - diff --git a/group_vars/kb.yml b/group_vars/kb.yml index a0f7f0d..7642ef7 100644 --- a/group_vars/kb.yml +++ b/group_vars/kb.yml @@ -33,7 +33,7 @@ sshd_permit_root_login: !!str "prohibit-password" # name or ip-adress from the (local) ntp server, mostly the gateway # -#ntp_server: gw-kb.anw-kb.netz +# ntp_server: gw-kb.anw-kb.netz # ========== @@ -147,8 +147,6 @@ nfs_exports: - 10.0.32.109 - 192.168.2.190 use_fsid_option: true - - # ========== @@ -163,12 +161,12 @@ nfs_exports: # ! Notice ! remove_system_users: [] -#remove_system_users: +# remove_system_users: # - name: test # - name: jennifer.prost system_users: [] -#system_users: +# system_users: # - name: sysadm # password: '9xFXkdPR_2' @@ -204,15 +202,14 @@ nis_groups: group_id: 1200 - -#nis_groups: +# nis_groups: # - name: mbr-finanzen (wird zu vdk) # group_id: 1210 # - name: mbr-personal (wird zu mbr-finanzen-personal) # group_id: 1220 remove_nis_users: [] -#remove_nis_users: +# remove_nis_users: # - name: test # - name: jennifer.prost @@ -309,7 +306,6 @@ nis_user: password: '' - # ========== # vars used by roles/common/tasks/samba-install.yml # ========== @@ -348,7 +344,6 @@ samba_netbios_name: FILE-KB samba_server_min_protocol: !!str "NT1" - samba_shares: # --- @@ -428,8 +423,6 @@ samba_shares: recycle_path: '@Recycle.Bin' - - # ========== # vars used by roles/common/tasks/system-user-systemfiles.yml # ========== @@ -438,7 +431,7 @@ samba_shares: # # variables used from other previos sections: # -# - system_users: roles/common/tasks/system-user.yml +# - system_users: roles/common/tasks/system-user.yml # ========== @@ -477,4 +470,3 @@ sudo_pc_users: # ========== # vars used by roles/common/tasks/luks.yml # ========== - diff --git a/group_vars/mbr.yml b/group_vars/mbr.yml index db8f5be..a04aacf 100644 --- a/group_vars/mbr.yml +++ b/group_vars/mbr.yml @@ -3,30 +3,24 @@ # ========== # vars used by roles/common/tasks/basic.yml # ========== - - # ========== # vars used by roles/common/tasks/sshd.yml # ========== sshd_permit_root_login: !!str "prohibit-password" - # ========== # vars used by roles/common/tasks/apt.yml # ========== - # ========== # vars used by roles/common/tasks/git.yml # ========== - # ========== # vars used by roles/common/tasks/cups-install.yml # ========== - # ========== # vars used by roles/common/tasks/ntp.yml # ========== @@ -35,7 +29,6 @@ sshd_permit_root_login: !!str "prohibit-password" # ntp_server: gw-mbr.mbr-bln.netz - # ========== # vars used by roles/common/tasks/nfs.yml # ========== @@ -51,28 +44,27 @@ nfs_start_servers: 64 # Take car to increase 'fsid' in case of more than one export # nfs_exports: - - src: 192.168.112.10:/data/home - path: /data/home - mount_opts: users,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.112.0/24 - - 10.0.112.0/24 - - 10.1.112.0/24 - - 192.168.63.0/24 - use_fsid_option: true - - - src: 192.168.112.10:/data/shares - path: /data/shares - mount_opts: users,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.112.0/24 - - 10.0.112.0/24 - - 10.1.112.0/24 - - 192.168.63.0/24 - use_fsid_option: true + - src: 192.168.112.10:/data/home + path: /data/home + mount_opts: users,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.112.0/24 + - 10.0.112.0/24 + - 10.1.112.0/24 + - 192.168.63.0/24 + use_fsid_option: true + - src: 192.168.112.10:/data/shares + path: /data/shares + mount_opts: users,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.112.0/24 + - 10.0.112.0/24 + - 10.1.112.0/24 + - 192.168.63.0/24 + use_fsid_option: true # ========== # vars used by roles/common/tasks/system-user.yml @@ -86,27 +78,24 @@ nfs_exports: # ! Notice ! remove_system_users: [] -#remove_system_users: +# remove_system_users: # - name: test # - name: jennifer.prost system_users: [] -#system_users: +# system_users: # - name: sysadm # password: '9xFXkdPR_2' system_groups: [] - base_home: /data/home - # ========== # vars used by roles/common/tasks/nis-install-server.yml # vars used by roles/common/tasks/nis-user.yml # vars used by roles/common/tasks/nis-install-client.yml # ========== - # used by templates # - yp.conf.j2 # - defaultdomain.j2 @@ -166,8 +155,6 @@ nis_groups: - name: projektleitung group_id: 2200 - - # !! Don't forgrt to delete also user konfiguration in this file !! # ================================================================= # @@ -217,7 +204,6 @@ nis_groups: # - name: vanessa.gelardo nis_user: - - name: chris groups: - technik @@ -243,12 +229,12 @@ nis_user: - direx-personal-finanzen is_samba_user: true password: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 35653838343532663632326462656437363665316337316336316335383263633630616638313736 - 3937666561356232666136646435613361336437303637360a353561316633373265323931623565 - 32643966373962313334343565643130373535353238316161623837333130353231343332663930 - 3638386337333636390a393738373935646638383237373663376434366361363938346335663438 - 6637 + $ANSIBLE_VAULT;1.1;AES256 + 35653838343532663632326462656437363665316337316336316335383263633630616638313736 + 3937666561356232666136646435613361336437303637360a353561316633373265323931623565 + 32643966373962313334343565643130373535353238316161623837333130353231343332663930 + 3638386337333636390a393738373935646638383237373663376434366361363938346335663438 + 6637 # - name: lokaladmin # groups: @@ -300,19 +286,19 @@ nis_user: - direx - direx-personal-finanzen is_samba_user: true - password: 'KPk_Wf2F' + password: "KPk_Wf2F" - name: axis groups: - mbr-kamera is_samba_user: true - password: '20_axis_16' + password: "20_axis_16" - name: scan groups: - buero-scan is_samba_user: true - password: '20scan13' + password: "20scan13" # --- # Technik @@ -324,7 +310,7 @@ nis_user: - buero-scan - technik is_samba_user: true - password: 'GYiI3-s/_7wG' + password: "GYiI3-s/_7wG" # --- # Verwaltung @@ -346,7 +332,7 @@ nis_user: - regishut - regishut-personal-finanzen is_samba_user: true - password: 'YA!LiLiC0MP5' + password: "YA!LiLiC0MP5" - name: bianca groups: @@ -369,9 +355,9 @@ nis_user: - direx - direx-personal-finanzen is_samba_user: true - password: '73_BiBole_29' + password: "73_BiBole_29" - - name: birgit.erhardt + - name: birgit.erhardt groups: - all-users - buero-scan @@ -384,7 +370,7 @@ nis_user: - rias-berlin - rias-berlin-finanzen-personal is_samba_user: true - password: '20_purpel!rain_17' + password: "20_purpel!rain_17" - name: christina.wendt groups: @@ -405,7 +391,7 @@ nis_user: - direx-personal-finanzen - projektleitung is_samba_user: true - password: '8!Varianten' + password: "8!Varianten" - name: hendrik.roth groups: @@ -417,7 +403,7 @@ nis_user: - regishut-personal-finanzen - direx-personal-finanzen is_samba_user: true - password: 'H-S.tG3/wV46' + password: "H-S.tG3/wV46" - name: janine.budich groups: @@ -441,7 +427,7 @@ nis_user: - direx-personal-finanzen - projektleitung is_samba_user: true - password: 'LoS_r3f_20_AS!' + password: "LoS_r3f_20_AS!" - name: luise.schirmer groups: @@ -452,7 +438,7 @@ nis_user: - direx - direx-personal-finanzen is_samba_user: true - password: 'AfZg3-9S/4IX' + password: "AfZg3-9S/4IX" - name: olga.masson groups: @@ -464,7 +450,7 @@ nis_user: - regishut-personal-finanzen - direx-personal-finanzen is_samba_user: true - password: '6.7.mQ-sPE.o' + password: "6.7.mQ-sPE.o" - name: swetlana.nikitenko groups: @@ -479,7 +465,7 @@ nis_user: - regishut-personal-finanzen - direx-personal-finanzen is_samba_user: true - password: 'Ji53-dA.nwGz' + password: "Ji53-dA.nwGz" # --- # BgN @@ -492,7 +478,7 @@ nis_user: - bgn - mbr-buero is_samba_user: true - password: 'LSr-tjo.U73V' + password: "LSr-tjo.U73V" - name: daniel.weber groups: @@ -502,7 +488,7 @@ nis_user: - bgn-finanzen-personal - mbr-buero is_samba_user: true - password: 'KQ+y-+9s/aL4' + password: "KQ+y-+9s/aL4" - name: karim.khan groups: @@ -513,7 +499,7 @@ nis_user: - bgn-finanzen-personal - technik is_samba_user: true - password: 'g6Gb/J.fZU9F' + password: "g6Gb/J.fZU9F" - name: katja.teich groups: @@ -524,7 +510,7 @@ nis_user: - mbr-buero - projektleitung is_samba_user: true - password: 'C+j3.w5.NJCI' + password: "C+j3.w5.NJCI" - name: katrin.breston groups: @@ -537,16 +523,16 @@ nis_user: - vdk - projektleitung is_samba_user: true - password: 'nA-y.I6ReJ-M' + password: "nA-y.I6ReJ-M" - name: praktikum.bgn1 groups: - all-users - buero-scan is_samba_user: true - password: 'MPL_baerin_20!' + password: "MPL_baerin_20!" - - name: stephanie.kammler + - name: stephanie.kammler groups: - all-users - buero-scan @@ -558,7 +544,7 @@ nis_user: - rias-berlin-finanzen-personal - direx-personal-finanzen is_samba_user: true - password: 'u-hw7.IMoQut' + password: "u-hw7.IMoQut" # - mbr-buero # - bgn @@ -577,9 +563,7 @@ nis_user: - bgn-finanzen-personal - mbr-buero is_samba_user: true - password: 'ALL3_e6ene#' - - + password: "ALL3_e6ene#" # --- # BMB @@ -607,7 +591,7 @@ nis_user: - direx-personal-finanzen - projektleitung is_samba_user: true - password: '5xp5ll9ar13us!' + password: "5xp5ll9ar13us!" - name: doku.mbr2 groups: @@ -615,7 +599,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: '*M0ss4d*' + password: "*M0ss4d*" - name: doku.mbr4 groups: @@ -623,16 +607,16 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'PwmNvPh9KM4T' + password: "PwmNvPh9KM4T" - name: doku.mbr5 groups: - all-users - buero-scan - - betriebsrat + - betriebsrat - mbr-buero is_samba_user: true - password: 'G6Hz.ev/e24E' + password: "G6Hz.ev/e24E" - name: doku.mbr6 groups: @@ -640,7 +624,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'RIm/-f6.7.wa' + password: "RIm/-f6.7.wa" - name: doku.mbr7 groups: @@ -648,7 +632,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'T-uSXk.79.vN' + password: "T-uSXk.79.vN" - name: florian.heuermann groups: @@ -657,7 +641,7 @@ nis_user: - mbr-buero - technik is_samba_user: true - password: 'i4/x3S-TJk.P' + password: "i4/x3S-TJk.P" - name: franziska.schilling groups: @@ -665,7 +649,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'L.35c-CgvZn3' + password: "L.35c-CgvZn3" - name: honorar.mbr1 groups: @@ -674,7 +658,7 @@ nis_user: - mbr-buero - direx is_samba_user: true - password: '_F313r4b3nd*' + password: "_F313r4b3nd*" - name: honorar.mbr2 groups: @@ -682,7 +666,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'kQviLU-4rA_2' + password: "kQviLU-4rA_2" - name: ljiljana.heise groups: @@ -690,7 +674,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'Ib_k/c75W-u6' + password: "Ib_k/c75W-u6" - name: judith.heinmueller groups: @@ -698,7 +682,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 't32_aHxV.' + password: "t32_aHxV." - name: katharina.mueller groups: @@ -706,7 +690,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: '6.3b-5Vy/7-3' + password: "6.3b-5Vy/7-3" - name: kathrin.hain groups: @@ -715,7 +699,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'H/T3X_3M_c9R' + password: "H/T3X_3M_c9R" - name: kerstin.kuballa groups: @@ -725,7 +709,7 @@ nis_user: - mbr-buero - direx-personal-finanzen is_samba_user: true - password: 'sVY2_2t+a+db' + password: "sVY2_2t+a+db" - name: laura.poerzgen groups: @@ -735,16 +719,16 @@ nis_user: - mbr-buero - regishut is_samba_user: true - password: 's9U.3xo-5Vq6' + password: "s9U.3xo-5Vq6" - name: manja.kasten groups: - all-users - - betriebsrat + - betriebsrat - buero-scan - mbr-buero is_samba_user: true - password: 'Rasili_&n' + password: "Rasili_&n" - name: mathias groups: @@ -753,7 +737,7 @@ nis_user: - ag-antisem - mbr-buero is_samba_user: true - password: 'p3r*45p3r4*4d*45tr4m' + password: "p3r*45p3r4*4d*45tr4m" - name: matthias.mueller groups: @@ -763,7 +747,7 @@ nis_user: - mbr-buero - projektleitung is_samba_user: true - password: 'V1v@H@f3rdr1nk' + password: "V1v@H@f3rdr1nk" - name: nazanin.bakhschy groups: @@ -772,30 +756,30 @@ nis_user: - mbr-buero - technik is_samba_user: true - password: 'I.E7X.cUd-cc' + password: "I.E7X.cUd-cc" - name: nina.rink groups: - all-users - - betriebsrat + - betriebsrat - buero-scan - mbr-buero is_samba_user: true - password: 'BMW_mobit_2020!' + password: "BMW_mobit_2020!" - name: praktikum.mbr1 groups: - all-users - buero-scan is_samba_user: true - password: '2001_RAT_urban!' + password: "2001_RAT_urban!" - name: praktikum.mbr2 groups: - all-users - buero-scan is_samba_user: true - password: '20praktikum213' + password: "20praktikum213" # - name: samuel.signer # groups: @@ -813,7 +797,7 @@ nis_user: - betriebsrat - mbr-buero is_samba_user: true - password: 'S4u3rkr4ut!' + password: "S4u3rkr4ut!" - name: stefan.jung groups: @@ -821,7 +805,7 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: 'q9.mL5-a-aYA' + password: "q9.mL5-a-aYA" - name: tirza.seene groups: @@ -829,13 +813,13 @@ nis_user: - buero-scan - mbr-buero is_samba_user: true - password: '7a9-7Rz-Rc2p' + password: "7a9-7Rz-Rc2p" # --- # RIAS Berlin und Bund # --- - - name: benjamin + - name: benjamin groups: - all-users - buero-scan @@ -846,7 +830,7 @@ nis_user: - rias-berlin - rias-berlin-finanzen-personal is_samba_user: true - password: 'C2-0U#ch' + password: "C2-0U#ch" - name: christiane.ketteler groups: @@ -854,7 +838,7 @@ nis_user: - buero-scan - rias-berlin is_samba_user: true - password: 'y_P.ev.azy47' + password: "y_P.ev.azy47" - name: christian.obermueller groups: @@ -863,7 +847,7 @@ nis_user: - ag-antisem - rias-berlin is_samba_user: true - password: 'i6...rs2ILRn' + password: "i6...rs2ILRn" - name: jonas.empen groups: @@ -871,7 +855,7 @@ nis_user: - buero-scan - rias-berlin is_samba_user: true - password: 'GN-E.fd6w6n%' + password: "GN-E.fd6w6n%" - name: julia.kopp groups: @@ -883,7 +867,7 @@ nis_user: - rias-berlin-finanzen-personal - projektleitung is_samba_user: true - password: '-a2%3bTzkW.A' + password: "-a2%3bTzkW.A" - name: memphis.krickeberg groups: @@ -891,7 +875,7 @@ nis_user: - buero-scan - rias-berlin is_samba_user: true - password: '6-K/F9uf/75u' + password: "6-K/F9uf/75u" - name: ruth.hatlapa groups: @@ -903,7 +887,7 @@ nis_user: - rias-berlin - rias-berlin-finanzen-personal is_samba_user: true - password: 'q2Sc.C7-6hZR' + password: "q2Sc.C7-6hZR" - name: sophie.tadeus groups: @@ -911,7 +895,7 @@ nis_user: - buero-scan - rias-berlin is_samba_user: true - password: '3.5.JQby/ubw' + password: "3.5.JQby/ubw" - name: steffen.klaevers groups: @@ -919,8 +903,7 @@ nis_user: - buero-scan - rias-berlin is_samba_user: true - password: 'pRU.g5W5h-rY' - + password: "pRU.g5W5h-rY" # --- # Regishut @@ -934,7 +917,7 @@ nis_user: - regishut - regishut-personal-finanzen is_samba_user: true - password: 'R3GI_20_poliz_!' + password: "R3GI_20_poliz_!" - name: christin.sommerfeld groups: @@ -946,7 +929,7 @@ nis_user: - direx-personal-finanzen - projektleitung is_samba_user: true - password: 'bbMIQ.3/gZ3s' + password: "bbMIQ.3/gZ3s" - name: lilith.daxner groups: @@ -955,7 +938,7 @@ nis_user: - buero-scan - regishut is_samba_user: true - password: 'n2Ud7kwA-M-c' + password: "n2Ud7kwA-M-c" - name: mischa.luy groups: @@ -967,7 +950,7 @@ nis_user: - technik - direx-personal-finanzen is_samba_user: true - password: 'V-V3/2usuzjq' + password: "V-V3/2usuzjq" - name: sebastian.beer groups: @@ -976,8 +959,7 @@ nis_user: - regishut - technik is_samba_user: true - password: '7A2i-Iz.mUHz' - + password: "7A2i-Iz.mUHz" # --- # DiRex @@ -990,7 +972,7 @@ nis_user: - direx - mbr-buero is_samba_user: true - password: 'VVLvkmH.r5-q' + password: "VVLvkmH.r5-q" - name: lisa.wildenhain groups: @@ -999,12 +981,10 @@ nis_user: - direx - mbr-buero is_samba_user: true - password: 'RmMq-3Z--2.2' - + password: "RmMq-3Z--2.2" samba_homes_virusfilter: true - # ========== # vars used by roles/common/tasks/samba-install.yml # ========== @@ -1013,7 +993,6 @@ samba_server: file-mbr.mbr-bln.netz samba_server_ip: 192.168.112.10 samba_server_cidr_prefix: 24 - # ========== # vars used by roles/common/tasks/samba-user.yml # ========== @@ -1026,7 +1005,6 @@ samba_server_cidr_prefix: 24 # - remove_nis_users: roles/common/tasks/nis-install-server.yml # - nis_user: roles/common/tasks/nis-install-server.yml - # ========== # vars used by roles/common/tasks/mount_samba_shares.yml # ========== @@ -1040,10 +1018,7 @@ samba_server_cidr_prefix: 24 samba_workgroup: MBR samba_netbios_name: FILE-MBR - - samba_shares: - # --- # Bürogemeinschaft # --- @@ -1052,33 +1027,33 @@ samba_shares: path: /data/shares/Buero-Organisation group_valid_users: all-users group_write_list: all-users - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Install path: /data/shares/Install group_valid_users: mbr-admins group_write_list: mbr-admins - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true - name: Kamera path: /data/shares/Kamera group_valid_users: mbr-kamera group_write_list: mbr-kamera - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" - name: SCAN path: /data/shares/SCAN group_valid_users: buero-scan group_write_list: buero-scan - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true #recycle_path: '@Recycle.Bin' @@ -1087,31 +1062,31 @@ samba_shares: path: /data/shares/Technik-und-Sicherheit group_valid_users: technik group_write_list: technik - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: AG-Antisemitismus path: /data/shares/AG-Antisemitismus group_valid_users: ag-antisem group_write_list: ag-antisem - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Projektleitung path: /data/shares/Projektleitung group_valid_users: projektleitung group_write_list: projektleitung - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # VDK @@ -1121,40 +1096,40 @@ samba_shares: path: /data/shares/Arbeitsrechtliches group_valid_users: vdk group_write_list: vdk - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Finanzen path: /data/shares/Finanzen group_valid_users: vdk group_write_list: vdk - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: VDK path: /data/shares/VDK group_valid_users: vdk group_write_list: vdk - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Betriebsrat path: /data/shares/Betriebsrat group_valid_users: betriebsrat group_write_list: betriebsrat - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # BgN @@ -1164,21 +1139,21 @@ samba_shares: path: /data/shares/BGN-Finanzen-Personal group_valid_users: bgn-finanzen-personal group_write_list: bgn-finanzen-personal - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Mobilisierungsplattform path: /data/shares/Mobilisierungsplattform group_valid_users: bgn group_write_list: bgn - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # BMB @@ -1188,11 +1163,11 @@ samba_shares: path: /data/shares/BMB group_valid_users: bmb group_write_list: bmb - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # MBR @@ -1202,41 +1177,41 @@ samba_shares: path: /data/shares/MBR-Finanzen-Personal group_valid_users: mbr-finanzen-personal group_write_list: mbr-finanzen-personal - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: BVV-Projekt path: /data/shares/BVV-Projekt group_valid_users: mbr-buero group_write_list: mbr-buero - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: MBR path: /data/shares/MBR group_valid_users: mbr-buero group_write_list: mbr-buero - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Video path: /data/shares/Video group_valid_users: mbr-buero group_write_list: mbr-buero - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # RIAS @@ -1246,65 +1221,65 @@ samba_shares: path: /data/shares/RIAS-Berlin group_valid_users: rias-berlin group_write_list: rias-berlin - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: RIAS-Berlin-Finanzen-Personal path: /data/shares/RIAS-Berlin-Finanzen-Personal group_valid_users: rias-berlin-finanzen-personal group_write_list: rias-berlin-finanzen-personal - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: RIAS-Bund path: /data/shares/RIAS-Bund group_valid_users: rias-bund group_write_list: rias-bund - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: RIAS-Bund-Finanzen-Personal path: /data/shares/RIAS-Bund-Finanzen-Personal group_valid_users: rias-bund-finanzen-personal group_write_list: rias-bund-finanzen-personal - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # Regishut # --- - - name: Regishut + - name: Regishut path: /data/shares/Regishut group_valid_users: regishut group_write_list: regishut - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: Regishut-Personal-Finanzen path: /data/shares/Regishut-Personal-Finanzen group_valid_users: regishut-personal-finanzen group_write_list: regishut-personal-finanzen - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" # --- # DiRex - Direkte Intervention bei Rechtsextremismus, Rassismus und Antisemitismus in der Schule" @@ -1314,24 +1289,21 @@ samba_shares: path: /data/shares/DiRex group_valid_users: direx group_write_list: direx - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' + recycle_path: "@Recycle.Bin" - name: DiRex-Personal-Finanzen path: /data/shares/DiRex-Personal-Finanzen group_valid_users: direx-personal-finanzen group_write_list: direx-personal-finanzen - file_create_mask: '0660' - dir_create_mask: '2770' + file_create_mask: "0660" + dir_create_mask: "2770" vfs_object_virusfilter: true vfs_object_recycle: true - recycle_path: '@Recycle.Bin' - - - + recycle_path: "@Recycle.Bin" # ========== # vars used by roles/common/tasks/system-user-systemfiles.yml @@ -1343,7 +1315,6 @@ samba_shares: # # - system_users: roles/common/tasks/system-user.yml - # ========== # vars used by roles/common/tasks/nis-user-systemfiles.yml # ========== @@ -1354,7 +1325,6 @@ samba_shares: # # - nis_user: roles/common/tasks/nis-install-server.yml - # ========== # vars used by roles/common/tasks/sudoers-pc.yml # ========== @@ -1364,19 +1334,15 @@ sudo_pc_users: - sysadm - lokaladmin - # ========== # vars used by roles/common/tasks/sudoers-server.yml # ========== - # ========== # vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml # vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml # ========== - # ========== # vars used by roles/common/tasks/luks.yml # ========== - diff --git a/group_vars/sprachenatelier.yml b/group_vars/sprachenatelier.yml index 8e8fe07..df866fd 100644 --- a/group_vars/sprachenatelier.yml +++ b/group_vars/sprachenatelier.yml @@ -46,27 +46,27 @@ nfs_start_servers: 16 # Take car to increase 'fsid' in case of more than one export # nfs_exports: - - src: 192.168.92.10:/data/home - path: /data/home - mount_opts: users,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.92.0/24 - - 10.0.92.0/24 - - 10.1.92.0/24 - - 192.168.63.0/24 - fs_encrypted: false + - src: 192.168.92.10:/data/home + path: /data/home + mount_opts: users,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.92.0/24 + - 10.0.92.0/24 + - 10.1.92.0/24 + - 192.168.63.0/24 + fs_encrypted: false - - src: 192.168.92.10:/data/samba - path: /data/samba - mount_opts: users,rsize=8192,wsize=8192,hard,intr - export_opt: rw,root_squash,sync,subtree_check - export_networks: - - 192.168.92.0/24 - - 10.0.92.0/24 - - 10.1.92.0/24 - - 192.168.63.0/24 - fs_encrypted: false + - src: 192.168.92.10:/data/samba + path: /data/samba + mount_opts: users,rsize=8192,wsize=8192,hard,intr + export_opt: rw,root_squash,sync,subtree_check + export_networks: + - 192.168.92.0/24 + - 10.0.92.0/24 + - 10.1.92.0/24 + - 192.168.63.0/24 + fs_encrypted: false # ========== @@ -81,14 +81,14 @@ nfs_exports: # ! Notice ! remove_system_users: [] -#remove_system_users: -# - name: test -# - name: jennifer.prost +# remove_system_users: +# - name: test +# - name: jennifer.prost system_users: [] -#system_users: -# - name: sysadm -# password: '9xFXkdPR_2' +# system_users: +# - name: sysadm +# password: '9xFXkdPR_2' system_groups: [] @@ -122,19 +122,18 @@ nis_groups: - name: no-backup group_id: 1120 -#remove_nis_users: -# - name: lea -# - name: alina -#remove_nis_users: -# - name: daniel -# - name: andrea -# - name: tali -# - name: eva -# - name: mariam -# - name: simone +# remove_nis_users: +# - name: lea +# - name: alina +# remove_nis_users: +# - name: daniel +# - name: andrea +# - name: tali +# - name: eva +# - name: mariam +# - name: simone nis_user: - - name: chris groups: - intern @@ -142,12 +141,12 @@ nis_user: - no-backup is_samba_user: true password: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 35653838343532663632326462656437363665316337316336316335383263633630616638313736 - 3937666561356232666136646435613361336437303637360a353561316633373265323931623565 - 32643966373962313334343565643130373535353238316161623837333130353231343332663930 - 3638386337333636390a393738373935646638383237373663376434366361363938346335663438 - 6637 + $ANSIBLE_VAULT;1.1;AES256 + 35653838343532663632326462656437363665316337316336316335383263633630616638313736 + 3937666561356232666136646435613361336437303637360a353561316633373265323931623565 + 32643966373962313334343565643130373535353238316161623837333130353231343332663930 + 3638386337333636390a393738373935646638383237373663376434366361363938346335663438 + 6637 - name: anahit groups: @@ -451,19 +450,13 @@ sudo_pc_users: - sysadm - localadmin - # ========== # vars used by roles/common/tasks/sudoers-server.yml # ========== - - # ========== # vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml # vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml # ========== - - # ========== # vars used by roles/common/tasks/luks.yml # ========== - diff --git a/host_vars/file-akb.akb.netz.yml b/host_vars/file-akb.akb.netz.yml index 10962f6..8343c77 100644 --- a/host_vars/file-akb.akb.netz.yml +++ b/host_vars/file-akb.akb.netz.yml @@ -4,12 +4,11 @@ # vars used by roles/network_interfaces # --- - # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: True +network_manage_devices: true # Should the interfaces be reloaded after config change? -network_interface_reload: False +network_interface_reload: false network_interface_path: /etc/network/interfaces.d network_interface_required_packages: @@ -19,7 +18,6 @@ network_interface_required_packages: - ifupdown - ifenslave - network_interfaces: - device: eno1 @@ -48,19 +46,17 @@ network_interfaces: - 192.168.82.1 search: akb.netz - # --- # vars used by roles/common/tasks/basic.yml # --- set_default_limit_nofile: true - # --- # roles/common/tasks/default-users.yml # --- -#extra_user: +# extra_user: # # - name: borg # user_id: 1065 @@ -75,14 +71,12 @@ set_default_limit_nofile: true # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhbQo8gm3zNCkNTSHrLE1np0IDiSUHgfyy8469guHFz root@file-akb' # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlm5VPClcXv5O8GaL9H5EVgXaP3/FY7aafB0Jes3BvH root@gw-akb' - # --- # vars used by roles/common/tasks/systemd-resolved.yml # --- systemd_resolved: true - # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # Primäre DNS-Adresse: 38.132.106.139 # Sekundäre DNS-Adresse: 194.187.251.67 @@ -93,8 +87,8 @@ systemd_resolved: true # IPv6: 2606:4700:4700::1111 # sekundäre DNS-Adresse # IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# +# IPv6: 2606:4700:4700::1001 +# # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit # primäre DNS-Adresse # IPv4: 8.8.8.8 @@ -105,20 +99,20 @@ systemd_resolved: true # # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug # primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe # sekundäre DNS-Adresse # IPv4: 149.112.112.112 # IPv6: 2620:fe::9 # # OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de # IPv4: 194.36.144.87 - ns29.de # IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) # IPv4: 5.1.66.255 # IPv6: 2001:678:e68:f000:: # Servername für DNS-over-TLS: dot.ffmuc.net @@ -128,10 +122,10 @@ resolved_nameserver: # search domains # -# If there are more than one search domains, then specify them here in the order in which +# If there are more than one search domains, then specify them here in the order in which # the resolver should also search them # -#resolved_domains: [] +# resolved_domains: [] resolved_domains: - ~. - akb.netz @@ -141,8 +135,7 @@ resolved_dnssec: false # dns.as250.net: 194.150.168.168 # resolved_fallback_nameserver: - - 172.16.82.254 - + - 172.16.82.254 # --- # vars used by roles/common/tasks/sshd.yml @@ -154,8 +147,7 @@ sshd_permit_root_login: !!str "yes" sshd_password_authentication: !!str "yes" -#sshd_use_pam: !!str "no" - +# sshd_use_pam: !!str "no" # --- # vars used by roles/common/tasks/cron.yml @@ -191,7 +183,6 @@ cron_user_entries: hour: "23" job: /root/bin/admin-stuff/cleanup_from_old_files.sh - cron_user_special_time_entries: - name: "Restart DNS Cache service 'systemd-resolved'" diff --git a/host_vars/file-flr.flr.netz.yml b/host_vars/file-flr.flr.netz.yml index bb47528..29c7370 100644 --- a/host_vars/file-flr.flr.netz.yml +++ b/host_vars/file-flr.flr.netz.yml @@ -4,12 +4,11 @@ # vars used by roles/network_interfaces # --- - # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: True +network_manage_devices: true # Should the interfaces be reloaded after config change? -network_interface_reload: False +network_interface_reload: false network_interface_path: /etc/network/interfaces.d network_interface_required_packages: @@ -19,7 +18,6 @@ network_interface_required_packages: - ifupdown - ifenslave - network_interfaces: - device: eno1 @@ -48,19 +46,17 @@ network_interfaces: - 192.168.102.1 search: flr.netz - # --- # vars used by roles/common/tasks/basic.yml # --- set_default_limit_nofile: true - # --- # vars used by roles/common/tasks/default-users.yml # --- -#extra_user: +# extra_user: # # - name: borg # user_id: 1065 @@ -75,14 +71,12 @@ set_default_limit_nofile: true # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTvxBfneJxBjMdpO9JCSkDyXQZUFXjYa/rqA6gQ0TL2 root@file-flr' # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSvVJ6MbYdXhIeS6FWFx2M/p7Gb6aG3oy25ZJRctXYd root@gw-flr' - # --- # vars used by roles/common/tasks/systemd-resolved.yml # --- systemd_resolved: true - # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # Primäre DNS-Adresse: 38.132.106.139 # Sekundäre DNS-Adresse: 194.187.251.67 @@ -93,8 +87,8 @@ systemd_resolved: true # IPv6: 2606:4700:4700::1111 # sekundäre DNS-Adresse # IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# +# IPv6: 2606:4700:4700::1001 +# # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit # primäre DNS-Adresse # IPv4: 8.8.8.8 @@ -105,20 +99,20 @@ systemd_resolved: true # # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug # primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe # sekundäre DNS-Adresse # IPv4: 149.112.112.112 # IPv6: 2620:fe::9 # # OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de # IPv4: 194.36.144.87 - ns29.de # IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) # IPv4: 5.1.66.255 # IPv6: 2001:678:e68:f000:: # Servername für DNS-over-TLS: dot.ffmuc.net @@ -128,10 +122,10 @@ resolved_nameserver: # search domains # -# If there are more than one search domains, then specify them here in the order in which +# If there are more than one search domains, then specify them here in the order in which # the resolver should also search them # -#resolved_domains: [] +# resolved_domains: [] resolved_domains: - flr.netz @@ -140,8 +134,7 @@ resolved_dnssec: false # dns.as250.net: 194.150.168.168 # resolved_fallback_nameserver: - - 172.16.102.254 - + - 172.16.102.254 # --- # vars used by roles/common/tasks/sshd.yml @@ -153,8 +146,7 @@ sshd_permit_root_login: !!str "yes" sshd_password_authentication: !!str "yes" -#sshd_use_pam: !!str "no" - +# sshd_use_pam: !!str "no" # --- # vars used by roles/common/tasks/cron.yml @@ -181,11 +173,9 @@ cron_user_entries: hour: "7-22" job: /root/bin/monitoring/check_cups-browsed.sh - cron_user_special_time_entries: - name: "Restart DNS Cache service 'systemd-resolved'" special_time: reboot job: "sleep 10 ; /bin/systemctl restart systemd-resolved" insertafter: PATH - diff --git a/host_vars/file-kb.anw-kb.netz.yml b/host_vars/file-kb.anw-kb.netz.yml index a22e127..6f46431 100644 --- a/host_vars/file-kb.anw-kb.netz.yml +++ b/host_vars/file-kb.anw-kb.netz.yml @@ -4,14 +4,11 @@ # vars used by roles/network_interfaces # --- - # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: False +network_manage_devices: false # Should the interfaces be reloaded after config change? -network_interface_reload: False - - +network_interface_reload: false # --- # vars used by roles/common/tasks/basic.yml @@ -19,15 +16,12 @@ network_interface_reload: False set_default_limit_nofile: true - - # --- # vars used by roles/common/tasks/systemd-resolved.yml # --- systemd_resolved: true - # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # Primäre DNS-Adresse: 38.132.106.139 # Sekundäre DNS-Adresse: 194.187.251.67 @@ -38,8 +32,8 @@ systemd_resolved: true # IPv6: 2606:4700:4700::1111 # sekundäre DNS-Adresse # IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# +# IPv6: 2606:4700:4700::1001 +# # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit # primäre DNS-Adresse # IPv4: 8.8.8.8 @@ -50,20 +44,20 @@ systemd_resolved: true # # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug # primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe # sekundäre DNS-Adresse # IPv4: 149.112.112.112 # IPv6: 2620:fe::9 # # OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de # IPv4: 194.36.144.87 - ns29.de # IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) # IPv4: 5.1.66.255 # IPv6: 2001:678:e68:f000:: # Servername für DNS-over-TLS: dot.ffmuc.net @@ -73,10 +67,10 @@ resolved_nameserver: # search domains # -# If there are more than one search domains, then specify them here in the order in which +# If there are more than one search domains, then specify them here in the order in which # the resolver should also search them # -#resolved_domains: [] +# resolved_domains: [] resolved_domains: - anw-kb.netz @@ -85,8 +79,7 @@ resolved_dnssec: false # dns.as250.net: 194.150.168.168 # resolved_fallback_nameserver: - - 172.16.32.254 - + - 172.16.32.254 # --- # vars used by roles/common/tasks/sshd.yml @@ -98,8 +91,7 @@ sshd_permit_root_login: !!str "yes" sshd_password_authentication: !!str "yes" -#sshd_use_pam: !!str "no" - +# sshd_use_pam: !!str "no" # --- # vars used by roles/common/tasks/cron.yml @@ -111,12 +103,9 @@ cron_user_entries: minute: "*/15" job: /root/bin/monitoring/check_postfix.sh - cron_user_special_time_entries: - name: "Restart DNS Cache service 'systemd-resolved'" special_time: reboot job: "sleep 10 ; /bin/systemctl restart systemd-resolved" insertafter: PATH - - diff --git a/host_vars/file-mbr.mbr-bln.netz.yml b/host_vars/file-mbr.mbr-bln.netz.yml index 4a0c788..75ab6ec 100644 --- a/host_vars/file-mbr.mbr-bln.netz.yml +++ b/host_vars/file-mbr.mbr-bln.netz.yml @@ -4,12 +4,11 @@ # vars used by roles/network_interfaces # --- - # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: True +network_manage_devices: true # Should the interfaces be reloaded after config change? -network_interface_reload: False +network_interface_reload: false network_interface_path: /etc/network/interfaces.d network_interface_required_packages: @@ -19,7 +18,6 @@ network_interface_required_packages: - ifupdown - ifenslave - network_interfaces: - device: br0 @@ -66,7 +64,7 @@ network_interfaces: # inline hook scripts pre-up: - !!str "ip link set dev eno1 up" # pre-up script lines - up: [] #up script lines + up: [] # up script lines post-up: [] # post-up script lines (alias for up) pre-down: [] # pre-down script lines (alias for down) down: [] # down script lines @@ -80,22 +78,18 @@ network_interfaces: address: 192.168.112.211 netmask: 32 - # --- # vars used by roles/common/tasks/basic.yml # --- set_default_limit_nofile: true - - # --- # vars used by roles/common/tasks/systemd-resolved.yml # --- systemd_resolved: true - # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # Primäre DNS-Adresse: 38.132.106.139 # Sekundäre DNS-Adresse: 194.187.251.67 @@ -106,8 +100,8 @@ systemd_resolved: true # IPv6: 2606:4700:4700::1111 # sekundäre DNS-Adresse # IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# +# IPv6: 2606:4700:4700::1001 +# # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit # primäre DNS-Adresse # IPv4: 8.8.8.8 @@ -118,20 +112,20 @@ systemd_resolved: true # # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug # primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe # sekundäre DNS-Adresse # IPv4: 149.112.112.112 # IPv6: 2620:fe::9 # # OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de # IPv4: 194.36.144.87 - ns29.de # IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) # IPv4: 5.1.66.255 # IPv6: 2001:678:e68:f000:: # Servername für DNS-over-TLS: dot.ffmuc.net @@ -141,10 +135,10 @@ resolved_nameserver: # search domains # -# If there are more than one search domains, then specify them here in the order in which +# If there are more than one search domains, then specify them here in the order in which # the resolver should also search them # -#resolved_domains: [] +# resolved_domains: [] resolved_domains: - oopen.de @@ -153,8 +147,7 @@ resolved_dnssec: false # dns.as250.net: 194.150.168.168 # resolved_fallback_nameserver: - - 172.16.112.254 - + - 172.16.112.254 # --- # vars used by roles/common/tasks/sshd.yml @@ -166,8 +159,7 @@ sshd_permit_root_login: !!str "yes" sshd_password_authentication: !!str "yes" -#sshd_use_pam: !!str "no" - +# sshd_use_pam: !!str "no" # --- # vars used by roles/common/tasks/cron.yml @@ -199,12 +191,9 @@ cron_user_entries: hour: "23" job: /root/bin/admin-stuff/cleanup_from_old_files.sh - cron_user_special_time_entries: - name: "Restart DNS Cache service 'systemd-resolved'" special_time: reboot job: "sleep 10 ; /bin/systemctl restart systemd-resolved" insertafter: PATH - - diff --git a/host_vars/file-spr.sprachenatelier.netz.yml b/host_vars/file-spr.sprachenatelier.netz.yml index 1de6052..dbd346b 100644 --- a/host_vars/file-spr.sprachenatelier.netz.yml +++ b/host_vars/file-spr.sprachenatelier.netz.yml @@ -4,12 +4,11 @@ # vars used by roles/network_interfaces # --- - # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: True +network_manage_devices: true # Should the interfaces be reloaded after config change? -network_interface_reload: False +network_interface_reload: false network_interface_path: /etc/network/interfaces.d network_interface_required_packages: @@ -19,7 +18,6 @@ network_interface_required_packages: - ifupdown - ifenslave - network_interfaces: - device: eno1 @@ -48,21 +46,18 @@ network_interfaces: - 192.168.92.1 search: sprachenatelier.netz - # --- # vars used by roles/common/tasks/basic.yml # --- set_default_limit_nofile: true - # --- # vars used by roles/common/tasks/systemd-resolved.yml # --- systemd_resolved: true - # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # Primäre DNS-Adresse: 38.132.106.139 # Sekundäre DNS-Adresse: 194.187.251.67 @@ -73,8 +68,8 @@ systemd_resolved: true # IPv6: 2606:4700:4700::1111 # sekundäre DNS-Adresse # IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# +# IPv6: 2606:4700:4700::1001 +# # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit # primäre DNS-Adresse # IPv4: 8.8.8.8 @@ -85,20 +80,20 @@ systemd_resolved: true # # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug # primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe # sekundäre DNS-Adresse # IPv4: 149.112.112.112 # IPv6: 2620:fe::9 # # OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de # IPv4: 194.36.144.87 - ns29.de # IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) # IPv4: 5.1.66.255 # IPv6: 2001:678:e68:f000:: # Servername für DNS-over-TLS: dot.ffmuc.net @@ -108,10 +103,10 @@ resolved_nameserver: # search domains # -# If there are more than one search domains, then specify them here in the order in which +# If there are more than one search domains, then specify them here in the order in which # the resolver should also search them # -#resolved_domains: [] +# resolved_domains: [] resolved_domains: - oopen.de @@ -120,8 +115,7 @@ resolved_dnssec: false # dns.as250.net: 194.150.168.168 # resolved_fallback_nameserver: - - 172.16.92.254 - + - 172.16.92.254 # --- # vars used by roles/common/tasks/sshd.yml @@ -133,8 +127,7 @@ sshd_permit_root_login: !!str "yes" sshd_password_authentication: !!str "yes" -#sshd_use_pam: !!str "no" - +# sshd_use_pam: !!str "no" # --- # vars used by roles/common/tasks/cron.yml @@ -161,7 +154,6 @@ cron_user_entries: hour: "7-22" job: /root/bin/monitoring/check_cups-browsed.sh - cron_user_special_time_entries: - name: "Restart DNS Cache service 'systemd-resolved'" diff --git a/roles/common/tasks/apt.yml b/roles/common/tasks/apt.yml index 2c821d0..70851e8 100644 --- a/roles/common/tasks/apt.yml +++ b/roles/common/tasks/apt.yml @@ -1,6 +1,6 @@ --- - name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list' - file: + ansible.builtin.file: path: "{{ item }}" state: absent with_items: @@ -15,8 +15,8 @@ dest: /etc/apt/sources.list owner: root group: root - mode: 0644 - register: apt_config_updated + mode: "0644" + register: common_apt_config_updated when: - apt_manage_sources_list|bool - ansible_facts['distribution'] == 'Debian' @@ -25,7 +25,7 @@ - apt-configuration - name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13) - apt: + ansible.builtin.apt: name: debian-archive-keyring state: present when: @@ -37,7 +37,7 @@ - apt-configuration - name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13) - copy: + ansible.builtin.copy: src: /etc/apt/sources.list dest: /etc/apt/sources.list.before-deb822 remote_src: true @@ -50,14 +50,14 @@ - ansible_facts['distribution'] == 'Debian' - (ansible_facts['distribution_major_version'] | int) >= 13 failed_when: - - apt_sources_list_backup.failed - - "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))" - register: apt_sources_list_backup + - common_apt_sources_list_backup.failed + - "'No such file or directory' not in (common_apt_sources_list_backup.msg | default(''))" + register: common_apt_sources_list_backup tags: - apt-configuration - name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13) - copy: + ansible.builtin.copy: dest: /etc/apt/sources.list content: | # {{ ansible_managed }} @@ -67,7 +67,7 @@ owner: root group: root mode: "0644" - register: apt_config_updated_sources_list + register: common_apt_config_updated_sources_list when: - apt_manage_sources_list|bool - ansible_facts['distribution'] == 'Debian' @@ -82,7 +82,7 @@ owner: root group: root mode: "0644" - register: apt_config_updated_debian_sources + register: common_apt_config_updated_debian_sources when: - apt_manage_sources_list|bool - ansible_facts['distribution'] == 'Debian' @@ -97,7 +97,7 @@ owner: root group: root mode: "0644" - register: apt_config_updated_security_sources + register: common_apt_config_updated_security_sources when: - apt_manage_sources_list|bool - ansible_facts['distribution'] == 'Debian' @@ -112,7 +112,7 @@ owner: root group: root mode: "0644" - register: apt_config_updated_backports_sources + register: common_apt_config_updated_backports_sources when: - apt_manage_sources_list|bool - ansible_facts['distribution'] == 'Debian' @@ -124,10 +124,10 @@ # If 'backports' was enabled in a previous run but is now disabled. # - name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13) - file: + ansible.builtin.file: path: /etc/apt/sources.list.d/backports.sources state: absent - register: apt_config_removed_backports_sources + register: common_apt_config_removed_backports_sources when: - apt_manage_sources_list|bool - ansible_facts['distribution'] == 'Debian' @@ -139,15 +139,15 @@ # Collect change states from all Debian >=13 deb822 source tasks so apt update # can force a fresh cache refresh when repository files changed. - name: (apt.yml) aggregate deb822 source changes (Debian >= 13) - set_fact: - apt_config_updated: + ansible.builtin.set_fact: + common_apt_config_updated: changed: >- {{ - (apt_config_updated_sources_list.changed | default(false)) - or (apt_config_updated_debian_sources.changed | default(false)) - or (apt_config_updated_security_sources.changed | default(false)) - or (apt_config_updated_backports_sources.changed | default(false)) - or (apt_config_removed_backports_sources.changed | default(false)) + (common_apt_config_updated_sources_list.changed | default(false)) + or (common_apt_config_updated_debian_sources.changed | default(false)) + or (common_apt_config_updated_security_sources.changed | default(false)) + or (common_apt_config_updated_backports_sources.changed | default(false)) + or (common_apt_config_removed_backports_sources.changed | default(false)) }} when: - apt_manage_sources_list|bool @@ -157,9 +157,9 @@ - apt-configuration - name: (apt.yml) apt update - apt: + ansible.builtin.apt: update_cache: true - cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" + cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}" when: apt_update|bool tags: - apt-update @@ -172,9 +172,9 @@ - name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a' ansible.builtin.command: dpkg --configure -a - register: _dpkg_configure - changed_when: (_dpkg_configure.stdout | default('')) | length > 0 - failed_when: _dpkg_configure.rc != 0 + register: common_dpkg_configure + changed_when: (common_dpkg_configure.stdout | default('')) | length > 0 + failed_when: common_dpkg_configure.rc != 0 when: apt_dpkg_configure|bool tags: - apt-dpkg-configure @@ -184,7 +184,7 @@ - apt-webserver-pkgs - name: (apt.yml) apt upgrade - apt: + ansible.builtin.apt: upgrade: "{{ apt_upgrade_type }}" update_cache: true dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" @@ -197,7 +197,7 @@ - apt-webserver-pkgs - name: (apt.yml) Initial install debian packages (stretch) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_stretch }}" state: "{{ apt_install_state }}" when: @@ -208,7 +208,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (buster) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_buster }}" state: "{{ apt_install_state }}" when: @@ -219,7 +219,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (bullseye) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_bullseye }}" state: "{{ apt_install_state }}" when: @@ -230,7 +230,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (bookworm) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_bookworm }}" state: "{{ apt_install_state }}" when: @@ -241,7 +241,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (trixie) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_trixie }}" state: "{{ apt_install_state }}" when: @@ -252,7 +252,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (bionic) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_bionic }}" state: "{{ apt_install_state }}" when: @@ -262,7 +262,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (xenial) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_xenial }}" state: "{{ apt_install_state }}" when: @@ -272,7 +272,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (jammy) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_jammy }}" state: "{{ apt_install_state }}" when: @@ -282,7 +282,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (noble) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_noble }}" state: "{{ apt_install_state }}" when: @@ -296,7 +296,7 @@ # --- - name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch) - apt: + ansible.builtin.apt: name: "{{ microcode_intel_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}-backports" @@ -310,21 +310,22 @@ - apt-microcode - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie) - apt: + ansible.builtin.apt: name: "{{ microcode_intel_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" when: - apt_debian_contrib_nonfree_enable - ansible_facts['distribution'] == "Debian" - - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11"or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13" + - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or + ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13" - ansible_facts['processor']|string is search("Intel") tags: - apt-initial-install - apt-microcode - name: (apt.yml) Install CPU microcode for AMD CPU (debian buster) - apt: + ansible.builtin.apt: name: "{{ microcode_amd_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -338,7 +339,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic) - apt: + ansible.builtin.apt: name: "{{ microcode_intel_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -351,7 +352,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic) - apt: + ansible.builtin.apt: name: "{{ microcode_amd_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -365,7 +366,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial) - apt: + ansible.builtin.apt: name: "{{ microcode_intel_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -378,7 +379,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial) - apt: + ansible.builtin.apt: name: "{{ microcode_amd_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -392,7 +393,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble) - apt: + ansible.builtin.apt: name: "{{ microcode_intel_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -405,7 +406,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble) - apt: + ansible.builtin.apt: name: "{{ microcode_amd_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -423,7 +424,7 @@ # --- - name: (apt.yml) Install Firmware packages (Ubuntu) - apt: + ansible.builtin.apt: name: "{{ firmware_packages_ubuntu }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -434,7 +435,7 @@ - apt-firmware - name: (apt.yml) Install Firmware packages (Debian) - apt: + ansible.builtin.apt: name: "{{ firmware_packages_debian }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -445,7 +446,7 @@ - apt-firmware - name: (apt.yml) Install non-free Firmware packages (Debian) - apt: + ansible.builtin.apt: name: "{{ firmware_non_free_packages_debian }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -461,7 +462,7 @@ # --- - name: (apt.yml) Remove unwanted packages - apt: + ansible.builtin.apt: name: "{{ apt_remove }}" state: absent purge: "{{ apt_remove_purge }}" @@ -469,7 +470,7 @@ - apt-remove - name: (apt.yml) Remove unwanted packages Ubuntu bionic - apt: + ansible.builtin.apt: name: "{{ apt_remove_bionic }}" state: absent purge: "{{ apt_remove_purge }}" @@ -480,7 +481,7 @@ - apt-remove - name: (apt.yml) Remove unwanted packages Ubuntu xenial - apt: + ansible.builtin.apt: name: "{{ apt_remove_xenial }}" state: absent purge: "{{ apt_remove_purge }}" @@ -491,7 +492,7 @@ - apt-remove - name: (apt.yml) Remove unwanted packages Ubuntu jammy - apt: + ansible.builtin.apt: name: "{{ apt_remove_jammy }}" state: absent purge: "{{ apt_remove_purge }}" @@ -502,7 +503,7 @@ - apt-remove - name: (apt.yml) Remove unwanted packages Ubuntu noble - apt: + ansible.builtin.apt: name: "{{ apt_remove_noble }}" state: absent purge: "{{ apt_remove_purge }}" @@ -513,7 +514,7 @@ - apt-remove - name: (apt.yml) autoremove - apt: + ansible.builtin.apt: autoremove: true dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" when: apt_autoremove|bool @@ -522,12 +523,10 @@ - apt-initial-install - apt-microcode -- name: (apt.yml) clean - command: apt-get -y clean - #args: - # warn: false - changed_when: false - when: apt_clean|bool +- name: (apt.yml) autoclean cache + ansible.builtin.apt: + autoclean: true + when: apt_clean | bool tags: - apt-clean - apt-initial-install diff --git a/roles/common/tasks/basic.yml b/roles/common/tasks/basic.yml index ce0ae03..d201536 100644 --- a/roles/common/tasks/basic.yml +++ b/roles/common/tasks/basic.yml @@ -1,22 +1,21 @@ --- - name: (basic.yml) Ensure timezone is is correct - timezone: name={{ time_zone }} + community.general.timezone: + name: "{{ time_zone }}" tags: - timezone - - name: (basic.yml) Ensure locales are present - locale_gen: + community.general.locale_gen: name: "{{ item }}" state: present with_items: "{{ locales }}" tags: - locales - - name: (basic.yml) Create a symbolic link /bin/sh -> bash - file: + ansible.builtin.file: src: bash dest: /bin/sh owner: root @@ -27,16 +26,15 @@ tags: - symlink-sh - # ---------- # security limit (maybe DEPRECATED see systemd settings) # ---------- - name: (basic.yml) Ensure directory '/etc/security/limits.d' exists - file: + ansible.builtin.file: path: /etc/security/limits.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -47,7 +45,7 @@ - systemd-config - name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists - copy: + ansible.builtin.copy: src: '{{ item.src_path }}' dest: '{{ item.dest_path }}' owner: root @@ -63,16 +61,15 @@ tags: - systemd-config - # ---------- # systemd stuff # ---------- - name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists - file: + ansible.builtin.file: path: /etc/systemd/system.conf.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -83,7 +80,7 @@ - systemd-config - name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists - copy: + ansible.builtin.copy: src: '{{ item.src_path }}' dest: '{{ item.dest_path }}' owner: root @@ -100,10 +97,10 @@ - systemd-config - name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists - file: + ansible.builtin.file: path: /etc/systemd/journald.conf.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -113,7 +110,7 @@ - systemd-config - name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists - copy: + ansible.builtin.copy: src: '{{ item.src_path }}' dest: '{{ item.dest_path }}' owner: root @@ -129,45 +126,56 @@ tags: - systemd-config - # ---------- # unattended upgrades # ---------- - name: (basic.yml) install unattended-upgrades - apt: pkg=unattended-upgrades state=present + ansible.builtin.apt: + pkg: unattended-upgrades + state: present when: - ansible_facts['distribution'] == "Debian" tags: - unattended-upgrades - name: (basic.yml) install apt-listchanges - apt: pkg=apt-listchanges state=present + ansible.builtin.apt: + pkg: apt-listchanges + state: present when: - ansible_facts['distribution'] == "Debian" tags: - unattended-upgrades - name: (basic.yml) remove apticron - apt: pkg=apticron state=absent + ansible.builtin.apt: + pkg: apticron + state: absent when: - ansible_facts['distribution'] == "Debian" tags: - unattended-upgrades - name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists - stat: path=/etc/apt/apt.conf.d/20auto-upgrades - register: ua_enabled + ansible.builtin.stat: + path: /etc/apt/apt.conf.d/20auto-upgrades + register: common_ua_enabled when: - ansible_facts['distribution'] == "Debian" tags: - unattended-upgrades - name: (basic.yml) activate unattended upgrades - shell: DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true dpkg-reconfigure -plow unattended-upgrades + ansible.builtin.command: + cmd: dpkg-reconfigure -plow unattended-upgrades + creates: /etc/apt/apt.conf.d/20auto-upgrades + environment: + DEBIAN_FRONTEND: noninteractive + DEBCONF_NONINTERACTIVE_SEEN: "true" when: - ansible_facts['distribution'] == "Debian" - - ua_enabled.stat.exists == False + - not common_ua_enabled.stat.exists tags: - unattended-upgrades @@ -177,7 +185,7 @@ dest: /etc/apt/listchanges.conf owner: root group: root - mode: 0644 + mode: "0644" when: - ansible_facts['distribution'] == "Debian" tags: @@ -187,39 +195,45 @@ ansible.builtin.template: src: etc/apt/apt.conf.d/50unattended-upgrades.j2 dest: /etc/apt/apt.conf.d/50unattended-upgrades - backup: yes + backup: true owner: root group: root - mode: 0644 + mode: "0644" when: - ansible_facts['distribution'] == "Debian" tags: - unattended-upgrades - # ---------- # - /etc/hosts # ---------- - name: (basic.yml) Check file '/etc/hosts.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/hosts.ORIG - register: etc_hosts_ORIG + register: common_etc_hosts_orig when: - "groups['file_server']|string is search(inventory_hostname)" tags: - etc_hosts - name: (basic.yml) Backup installation version of file '/etc/hosts' - command: cp -a /etc/hosts /etc/hosts.ORIG + ansible.builtin.copy: + src: /etc/hosts + dest: /etc/hosts.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - "groups['file_server']|string is search(inventory_hostname)" - - etc_hosts_ORIG.stat.exists == False + - not common_etc_hosts_orig.stat.exists tags: - etc_hosts - name: (basic.yml) addjust '/etc/hosts' add nis-server .. - lineinfile: + ansible.builtin.lineinfile: path: /etc/hosts regexp: '^192\.168\.' line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}' @@ -227,4 +241,3 @@ - "groups['nis_server']|string is search(inventory_hostname)" tags: - etc_hosts - diff --git a/roles/common/tasks/cron.yml b/roles/common/tasks/cron.yml index 71f43b0..15cc09f 100644 --- a/roles/common/tasks/cron.yml +++ b/roles/common/tasks/cron.yml @@ -1,6 +1,6 @@ --- - name: (cron.yml) Set env entries in user crontabs - cron: + ansible.builtin.cron: name: "{{ item.name }}" env: "yes" user: '{{ item.user | default("root") }}' @@ -14,7 +14,7 @@ - user_crontab - name: (cron.yml) Set special time entries in user crontabs - cron: + ansible.builtin.cron: name: "{{ item.name }}" special_time: "{{ item.special_time }}" user: '{{ item.user | default("root") }}' @@ -28,7 +28,7 @@ - user_crontab - name: (cron.yml) Set normal entries in user crontabs - cron: + ansible.builtin.cron: name: "{{ item.name }}" minute: "{{ item.minute | default(omit) }}" hour: "{{ item.hour | default(omit) }}" diff --git a/roles/common/tasks/cups-install.yml b/roles/common/tasks/cups-install.yml index 9481ca4..4c67356 100644 --- a/roles/common/tasks/cups-install.yml +++ b/roles/common/tasks/cups-install.yml @@ -1,49 +1,52 @@ --- - # --- # Cups Server # --- - name: (cups-install.yml) Ensure CUPS packages server (buster) are installed. - package: - pkg: '{{ apt_install_server_cups }}' + ansible.builtin.package: + pkg: "{{ apt_install_server_cups }}" state: present when: - ansible_facts['distribution'] == "Debian" tags: - cups-server - # --- # Cups clients # --- - name: (cups.yml) Ensure CUPS packages clients are installed. - package: + ansible.builtin.package: pkg: "{{ apt_install_client_cups }}" state: present - when: + when: - ansible_facts['distribution'] == "Ubuntu" - - ansible_distribution_version == "18.04" + - ansible_distribution_version == "18.04" - ansible_architecture == "x86_64" tags: - cups-client - - # -- file /etc/cups/cups-browsed.conf - name: (cups.yml) Check if file '/etc/cups/cups-browsed.conf.ORIGi' exists - stat: + ansible.builtin.stat: path: /etc/cups/cups-browsed.conf.ORIG - register: cups_browsed_conf_orig_exists + register: common_cups_browsed_conf_orig_exists tags: - cups-server - cups-client - name: (cups.yml) Backup /etc/cups/cups-browsed.conf file - command: cp /etc/cups/cups-browsed.conf /etc/cups/cups-browsed.conf.ORIG - when: cups_browsed_conf_orig_exists.stat.exists == False + ansible.builtin.copy: + src: /etc/cups/cups-browsed.conf + dest: /etc/cups/cups-browsed.conf.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" + when: not common_cups_browsed_conf_orig_exists.stat.exists tags: - cups-server - cups-client @@ -54,9 +57,9 @@ dest: /etc/cups/cups-browsed.conf owner: root group: root - mode: 0644 + mode: "0644" notify: - Restart cups-browsed + - Restart cups-browsed when: - groups['file_server']|string is search(inventory_hostname) tags: @@ -68,27 +71,33 @@ dest: /etc/cups/cups-browsed.conf owner: root group: root - mode: 0644 + mode: "0644" notify: - Restart cups-browsed + - Restart cups-browsed when: - groups['client_pc']|string is search(inventory_hostname) tags: - cups-client - # -- file /etc/cups/cupsd.conf - name: (cups.yml) Check if file '/etc/cups/cupsd.conf.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/cups/cupsd.conf.ORIG - register: cupsd_conf_orig_exists + register: common_cupsd_conf_orig_exists tags: - cups-server - cups-client - name: (cups.yml) Backup /etc/cups/cupsd.conf file - command: cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.ORIG - when: cupsd_conf_orig_exists.stat.exists == False + ansible.builtin.copy: + src: /etc/cups/cupsd.conf + dest: /etc/cups/cupsd.conf.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" + when: not common_cupsd_conf_orig_exists.stat.exists tags: - cups-server - cups-client @@ -99,9 +108,9 @@ dest: /etc/cups/cupsd.conf owner: root group: root - mode: 0644 + mode: "0644" notify: - Restart cups + - Restart cups when: - groups['file_server']|string is search(inventory_hostname) tags: @@ -113,9 +122,9 @@ dest: /etc/cups/cupsd.conf owner: root group: root - mode: 0644 + mode: "0644" notify: - Restart cups + - Restart cups when: - groups['client_pc']|string is search(inventory_hostname) tags: @@ -123,16 +132,23 @@ # -- file /etc/cups/cups-files.conf - name: (cups.yml) Check if file '/etc/cups/cups-files.conf.ORIGi' exists - stat: + ansible.builtin.stat: path: /etc/cups/cups-files.conf.ORIG - register: cups_files_conf_orig_exists + register: common_cups_files_conf_orig_exists tags: - cups-server - cups-client - name: (cups.yml) Backup /etc/cups/cups-files.conf file - command: cp /etc/cups/cups-files.conf /etc/cups/cups-files.conf.ORIG - when: cups_files_conf_orig_exists.stat.exists == False + ansible.builtin.copy: + src: /etc/cups/cups-files.conf + dest: /etc/cups/cups-files.conf.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" + when: not common_cups_files_conf_orig_exists.stat.exists tags: - cups-server - cups-client @@ -143,10 +159,9 @@ dest: /etc/cups/cups-files.conf owner: root group: root - mode: 0644 + mode: "0644" notify: - Restart cups + - Restart cups tags: - cups-server - cups-client - diff --git a/roles/common/tasks/default-users.yml b/roles/common/tasks/default-users.yml index 2ede2da..56ab548 100644 --- a/roles/common/tasks/default-users.yml +++ b/roles/common/tasks/default-users.yml @@ -5,7 +5,7 @@ # --- - name: (default-users.yml) Ensure default groups exists - group: + ansible.builtin.group: name: '{{ item.name }}' state: present gid: '{{ item.group_id | default(omit) }}' @@ -17,14 +17,14 @@ - groups-exists - name: (default-users.yml) Ensure default users exists - user: + ansible.builtin.user: name: '{{ item.name }}' state: present uid: '{{ item.user_id | default(omit) }}' group: '{{ item.group | default(omit) }}' - #group: '{{ item.name | default(omit) }}' + # group: '{{ item.name | default(omit) }}' home: '{{ item.home | default(omit) }}' - shell: '{{ item.shell|d("/bin/bash") }}' + shell: '{{ item.shell | d("/bin/bash") }}' password: "{{ item.password }}" update_password: on_create loop: "{{ default_user }}" @@ -34,7 +34,7 @@ - users-exists - name: (default-users.yml) Ensure authorized_key files for default users are present - authorized_key: + ansible.posix.authorized_key: user: "{{ item.0.name }}" key: "{{ item.1 }}" state: present @@ -51,26 +51,26 @@ # --- - name: (default-users.yml) Ensure extra groups exists - group: + ansible.builtin.group: name: '{{ item.name }}' state: present gid: '{{ item.group_id | default(omit) }}' loop: "{{ extra_user }}" loop_control: label: '{{ item.name }}' - when: + when: - extra_user is defined and extra_user|length > 0 tags: - groups-exists - name: (default-users.yml) Ensure extra users exists - user: + ansible.builtin.user: name: '{{ item.name }}' state: present uid: '{{ item.user_id | default(omit) }}' group: '{{ item.name | default(omit) }}' home: '{{ item.home | default(omit) }}' - shell: '{{ item.shell|d("/bin/bash") }}' + shell: '{{ item.shell | d("/bin/bash") }}' password: "{{ item.password }}" update_password: on_create loop: "{{ extra_user }}" @@ -81,7 +81,7 @@ - users-exists - name: (default-users.yml) Ensure authorized_key files for extra users are present - authorized_key: + ansible.posix.authorized_key: user: "{{ item.0.name }}" key: "{{ item.1 }}" state: present @@ -95,7 +95,7 @@ - authorized_key - name: (default-users.yml) other entries authorized_key files - authorized_key: + ansible.posix.authorized_key: user: "{{ item.user }}" key: "{{ item.key }}" state: present @@ -103,20 +103,20 @@ loop_control: label: "{{ item.user }}" when: - - entries_authorized_key is defined - - entries_authorized_key|length > 0 + - entries_authorized_key is defined + - entries_authorized_key|length > 0 # --- # - extra system user # --- - name: (default-users.yml) extra system user exists? - user: + ansible.builtin.user: name: '{{ item.name }}' state: present - system: yes + system: true home: '{{ item.home }}' - shell: '{{ item.shell|d("/usr/sbin/nologin") }}' + shell: '{{ item.shell | d("/usr/sbin/nologin") }}' groups: '{{ item.groups | default(omit) }}' loop: "{{ extra_system_user }}" loop_control: @@ -125,43 +125,42 @@ tags: - user-exists - # --- # - extra system groups 'sftp_users' # --- - name: (default-users.yml) Extra system group sftp_users - group: + ansible.builtin.group: name: 'sftp_users' state: present - system: yes - when: + system: true + when: - create_sftp_group is defined and create_sftp_group > 0 tags: - groups-exists - - # ======================================================= - # --- # - Allow connection via ssh to backup host # --- - name: Ensure root's .ssh directory exists - file: + ansible.builtin.file: path: /root/.ssh state: directory + owner: root + group: root + mode: '0700' - name: (default-users.yml) Copy (backup) ed25519 ssh private key to user root - copy: + ansible.builtin.copy: src: '{{ item.priv_key_src }}' dest: '{{ item.priv_key_dest }}' owner: root group: root mode: '0600' - when: + when: - insert_keypair_backup_client|bool - ssh_keypair_backup_client is defined - ssh_keypair_backup_client|length > 0 @@ -172,13 +171,13 @@ - insert_ssh_keypair_backup_server - name: (default-users.yml) Copy (backup) ed25519 ssh public key to user root - copy: + ansible.builtin.copy: src: '{{ item.pub_key_src }}' dest: '{{ item.pub_key_dest }}' owner: root group: root mode: '0644' - when: + when: - insert_keypair_backup_client|bool - ssh_keypair_backup_client is defined - ssh_keypair_backup_client|length > 0 @@ -189,7 +188,7 @@ - insert_ssh_keypair_backup_server - name: (default-users.yml) Ensure authorized_key (root) on backup hosts contains public key - authorized_key: + ansible.posix.authorized_key: user: root key: "{{ lookup('file', item.pub_key_src) }}" state: present @@ -204,9 +203,8 @@ - authorized_key - ssh-keypair-backup-server - - name: (default-users.yml) Copy further ssh private key(s) to user root - copy: + ansible.builtin.copy: src: '{{ item.priv_key_src }}' dest: '{{ item.priv_key_dest }}' owner: root @@ -215,16 +213,15 @@ loop: "{{ root_ssh_keypair }}" loop_control: label: 'dest: {{ item.priv_key_dest }}' - when: + when: - insert_root_ssh_keypair|bool - root_ssh_keypair is defined - root_ssh_keypair|length > 0 tags: - insert_root_ssh_keypair - root-defaut-ssh-keypair - - name: (default-users.yml) Copy further ssh public key(s) to user root - copy: + ansible.builtin.copy: src: '{{ item.pub_key_src }}' dest: '{{ item.pub_key_dest }}' owner: root @@ -233,11 +230,10 @@ loop: "{{ root_ssh_keypair }}" loop_control: label: 'dest: {{ item.pub_key_dest }}' - when: + when: - insert_root_ssh_keypair|bool - root_ssh_keypair is defined - root_ssh_keypair|length > 0 tags: - insert_root_ssh_keypair - root-defaut-ssh-keypair - diff --git a/roles/common/tasks/git.yml b/roles/common/tasks/git.yml index eef3a8c..ee1724a 100644 --- a/roles/common/tasks/git.yml +++ b/roles/common/tasks/git.yml @@ -5,10 +5,20 @@ # --- - name: (git.yml) Install/Update default repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_default_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + version: >- + {{ + item.version + | default(item.branch) + | default( + 'master' + if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0) + else 'main' + ) + }} + with_items: "{{ git_default_repositories }}" loop_control: label: "{{ item.name }}" tags: @@ -20,10 +30,20 @@ # --- - name: (git.yml) Install/Update file_server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_oopen_server_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + version: >- + {{ + item.version + | default(item.branch) + | default( + 'master' + if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0) + else 'main' + ) + }} + with_items: "{{ git_oopen_server_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['file_server']|string is search(inventory_hostname)" @@ -36,14 +56,34 @@ # --- - name: (git.yml) Install/Update samba server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_samba_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + version: >- + {{ + item.version + | default(item.branch) + | default( + 'master' + if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0) + else 'main' + ) + }} + with_items: "{{ git_samba_repositories }}" + register: common_git_samba_result loop_control: label: "{{ item.name }}" when: "groups['samba_server']|string is search(inventory_hostname)" - ignore_errors: True + failed_when: >- + (common_git_samba_result.failed | default(false)) and ( + common_git_samba_result.msg is not defined or ( + ('Could not resolve host' not in common_git_samba_result.msg) + and ('Connection timed out' not in common_git_samba_result.msg) + and ('Failed to connect to' not in common_git_samba_result.msg) + and ('Connection reset by peer' not in common_git_samba_result.msg) + and ('Operation timed out' not in common_git_samba_result.msg) + ) + ) tags: - git-samba-server-repositories @@ -53,14 +93,22 @@ # --- - name: (git.yml) Install/Update gateway repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_gateway_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + version: >- + {{ + item.version + | default(item.branch) + | default( + 'master' + if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0) + else 'main' + ) + }} + with_items: "{{ git_gateway_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['gateway_server']|string is search(inventory_hostname)" tags: - git-gateway-server-repositories - - diff --git a/roles/common/tasks/luks.yml b/roles/common/tasks/luks.yml index 2905035..d727baf 100644 --- a/roles/common/tasks/luks.yml +++ b/roles/common/tasks/luks.yml @@ -1,6 +1,5 @@ - name: (luks.ym) add new key to the LUKS container (container has to exist) - luks_device: + community.crypto.luks_device: device: "{{ luks_device }}" keyfile: "{{ role_path + '/files/vault/luks_default_passwd' }}" new_keyfile: "{{ role_path + '/files/vault/luks_chris_passwd' }}" - diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 1c38094..8c1d90d 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -5,7 +5,8 @@ # timezone # locales # systemd-nofiles -- import_tasks: basic.yml +- name: (main.yml) Import basic.yml tasks + ansible.builtin.import_tasks: basic.yml tags: - basic @@ -13,7 +14,8 @@ # tags supported inside sshd.yml # # sshd-config -- import_tasks: sshd.yml +- name: (main.yml) Import sshd.yml tasks + ansible.builtin.import_tasks: sshd.yml tags: sshd @@ -27,18 +29,21 @@ # apt-remove # apt-autoremove # apt-clean -- import_tasks: apt.yml +- name: (main.yml) Import apt.yml tasks + ansible.builtin.import_tasks: apt.yml tags: apt -- import_tasks: default-users.yml +- name: (main.yml) Import default-users.yml tasks + ansible.builtin.import_tasks: default-users.yml tags: default-user # tags supported inside systemd-resolved.yml # # systemd-resolved -- import_tasks: systemd-resolved.yml +- name: (main.yml) Import systemd-resolved.yml tasks + ansible.builtin.import_tasks: systemd-resolved.yml tags: - systemd-resolved when: @@ -52,7 +57,8 @@ # git-default-repositories # git-file-server-repositories # git-gateway-server-repositories -- import_tasks: git.yml +- name: (main.yml) Import git.yml tasks + ansible.builtin.import_tasks: git.yml tags: git @@ -60,7 +66,8 @@ # # cups-server # cups-client -- import_tasks: cups-install.yml +- name: (main.yml) Import cups-install.yml tasks + ansible.builtin.import_tasks: cups-install.yml tags: - cups @@ -68,7 +75,8 @@ # tags supported inside nis-user.yml: # # nis-user -- import_tasks: nis-user.yml +- name: (main.yml) Import nis-user.yml tasks + ansible.builtin.import_tasks: nis-user.yml when: "groups['nis_server']|string is search(inventory_hostname)" tags: - nis-user @@ -77,14 +85,16 @@ # tags supported inside ntp.yml: # # ntp-server -- import_tasks: ntp.yml +- name: (main.yml) Import ntp.yml tasks + ansible.builtin.import_tasks: ntp.yml tags: - ntp # tags supported inside pure-ftpd-install.yml: # -- import_tasks: pure-ftpd-install.yml +- name: (main.yml) Import pure-ftpd-install.yml tasks + ansible.builtin.import_tasks: pure-ftpd-install.yml when: - groups['ftp_server']|string is search(inventory_hostname) tags: @@ -95,7 +105,8 @@ # # nfs-server # nfs-client -- import_tasks: nfs.yml +- name: (main.yml) Import nfs.yml tasks + ansible.builtin.import_tasks: nfs.yml tags: - nfs @@ -104,7 +115,8 @@ # # samba-server # samba-client -- import_tasks: samba-install.yml +- name: (main.yml) Import samba-install.yml tasks + ansible.builtin.import_tasks: samba-install.yml tags: - samba-install - samba @@ -112,14 +124,16 @@ # tags supported inside samba-remove-user.yml: # -- import_tasks: samba-remove-user.yml +- name: (main.yml) Import samba-remove-user.yml tasks + ansible.builtin.import_tasks: samba-remove-user.yml tags: - samba-remove-user # tags supported inside system-remove-user.yml: # -- import_tasks: system-remove-user.yml +- name: (main.yml) Import system-remove-user.yml tasks + ansible.builtin.import_tasks: system-remove-user.yml tags: - system-remove-user @@ -127,7 +141,8 @@ # tags supported inside system-user.yml: # # system-user -- import_tasks: system-user.yml +- name: (main.yml) Import system-user.yml tasks + ansible.builtin.import_tasks: system-user.yml when: "groups['file_server']|string is search(inventory_hostname)" tags: - system-user @@ -136,7 +151,8 @@ # tags supported inside nis-install-server.yml: # # nis-install-server -- import_tasks: nis-install-server.yml +- name: (main.yml) Import nis-install-server.yml tasks + ansible.builtin.import_tasks: nis-install-server.yml when: "groups['nis_server']|string is search(inventory_hostname)" tags: - nis-install @@ -146,7 +162,8 @@ # tags supported inside nis-install-client.yml: # # nis-install-client -- import_tasks: nis-install-client.yml +- name: (main.yml) Import nis-install-client.yml tasks + ansible.builtin.import_tasks: nis-install-client.yml when: "groups['nis_client']|string is search(inventory_hostname)" tags: - nis-install @@ -156,7 +173,8 @@ # tags supported inside samba-user.yml: # # samba-user -- import_tasks: samba-user.yml +- name: (main.yml) Import samba-user.yml tasks + ansible.builtin.import_tasks: samba-user.yml when: "groups['samba_server']|string is search(inventory_hostname)" tags: - nis-samba-user @@ -167,7 +185,8 @@ # profile # bashrc # vimrc -- import_tasks: system-user-systemfiles.yml +- name: (main.yml) Import system-user-systemfiles.yml tasks + ansible.builtin.import_tasks: system-user-systemfiles.yml when: "groups['file_server']|string is search(inventory_hostname)" tags: - user-systemfiles @@ -178,7 +197,8 @@ # profile # bashrc # vimrc -- import_tasks: nis-user-systemfiles.yml +- name: (main.yml) Import nis-user-systemfiles.yml tasks + ansible.builtin.import_tasks: nis-user-systemfiles.yml when: "groups['nis_server']|string is search(inventory_hostname)" tags: - user-systemfiles @@ -188,7 +208,8 @@ # tags supported root-files-scripts.yml: # wakeup_lan -- import_tasks: root-files-scripts.yml +- name: (main.yml) Import root-files-scripts.yml tasks + ansible.builtin.import_tasks: root-files-scripts.yml tags: - root-files-scripts @@ -198,7 +219,8 @@ # sudoers-remove # sudoers-file-configuration # sudoers-global-configuration -- import_tasks: sudoers-pc.yml +- name: (main.yml) Import sudoers-pc.yml tasks + ansible.builtin.import_tasks: sudoers-pc.yml when: "groups['client_pc']|string is search(inventory_hostname)" tags: - sudoers @@ -209,21 +231,21 @@ # sudoers-remove # sudoers-file-configuration # sudoers-global-configuration -- import_tasks: sudoers-server.yml +- name: (main.yml) Import sudoers-server.yml tasks + ansible.builtin.import_tasks: sudoers-server.yml when: "groups['file_server']|string is search(inventory_hostname)" tags: - sudoers -- import_tasks: cron.yml +- name: (main.yml) Import cron.yml tasks + ansible.builtin.import_tasks: cron.yml tags: - cron - - # tags supported inside mount_samba_shares.yml: # -#- import_tasks: mount_samba_shares.yml +# - import_tasks: mount_samba_shares.yml # when: "groups['client_pc']|string is search(inventory_hostname)" # tags: # - samba-shares @@ -236,7 +258,7 @@ # - Ubuntu 18.04LTSi - name: "For OS: Ubuntu 16.04LTS, Arch: amd64" - import_tasks: ubuntu-x11vnc-1604-amd64.yml + ansible.builtin.import_tasks: ubuntu-x11vnc-1604-amd64.yml when: - ansible_facts["distribution_version"] == "16.04" - ansible_architecture == "x86_64" @@ -247,7 +269,7 @@ - name: "For OS: Ubuntu 18.04LTS, Arch: amd64" - import_tasks: ubuntu-x11vnc-1804-amd64.yml + ansible.builtin.import_tasks: ubuntu-x11vnc-1804-amd64.yml when: - ansible_facts["distribution_version"] == "18.04" - ansible_architecture == "x86_64" @@ -258,7 +280,7 @@ - name: "For OS: Ubuntu 20.04LTS, Arch: amd64" - import_tasks: ubuntu-x11vnc-2004-amd64.yml + ansible.builtin.import_tasks: ubuntu-x11vnc-2004-amd64.yml when: - ansible_facts["distribution_version"] == "20.04" - ansible_architecture == "x86_64" @@ -269,7 +291,7 @@ - name: "For OS: Ubuntu 22.04LTS, Arch: amd64" - import_tasks: ubuntu-x11vnc-2204-amd64.yml + ansible.builtin.import_tasks: ubuntu-x11vnc-2204-amd64.yml when: - ansible_facts["distribution_version"] == "22.04" - ansible_architecture == "x86_64" @@ -279,9 +301,8 @@ - finish-client-install - -#- name: "Configure LUKS" -# import_tasks: luks.yml -# when: "groups['client_pc']|string is search(inventory_hostname)" -# tags: +# - name: "Configure LUKS" +# import_tasks: luks.yml +# when: "groups['client_pc']|string is search(inventory_hostname)" +# tags: # - luks diff --git a/roles/common/tasks/mount_samba_shares.yml b/roles/common/tasks/mount_samba_shares.yml index c432534..b17e786 100644 --- a/roles/common/tasks/mount_samba_shares.yml +++ b/roles/common/tasks/mount_samba_shares.yml @@ -2,7 +2,7 @@ - name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists - file: + ansible.builtin.file: path: "/mnt/{{ item.name }}" owner: "{{ item.name }}" group: "{{ item.name }}" @@ -14,14 +14,14 @@ when: - item.is_samba_user is defined and item.is_samba_user|bool -#- name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists +# - name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists # file: # path: "/mnt/{{ item.1 }}/{{ item.0.name }}" # owner: "{{ item.1 }}" # group: "{{ item.1 }}" # mode: '0770' # state: directory -# with_subelements: +# with_subelements: # - "{{ samba_shares }}" # - user # loop_control: diff --git a/roles/common/tasks/nfs.yml b/roles/common/tasks/nfs.yml index 551405d..129a3c6 100644 --- a/roles/common/tasks/nfs.yml +++ b/roles/common/tasks/nfs.yml @@ -5,7 +5,7 @@ # --- - name: (nfs.yml) Ensure NFS utilities (server) are installed. - apt: + ansible.builtin.apt: name: - nfs-common - nfs-kernel-server @@ -17,7 +17,7 @@ - nfs-server - name: (nfs.yml) Ensure directories to export exist - file: + ansible.builtin.file: path: '{{ item.src.split(":")[1] }}' owner: root group: root @@ -37,7 +37,7 @@ dest: /etc/exports owner: root group: root - mode: 0644 + mode: "0644" when: - inventory_hostname in groups['nfs_server'] notify: Reload nfs @@ -45,15 +45,15 @@ - nfs-server - name: Enable service rpc-statd and ensure it is not masked - systemd: + ansible.builtin.systemd: name: rpc-statd - enabled: yes - masked: no + enabled: true + masked: false when: - inventory_hostname in groups['nfs_server'] - name: Make sure service rpc-statd is running - systemd: + ansible.builtin.systemd: state: started name: rpc-statd when: @@ -66,24 +66,31 @@ # --- - name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/default/nfs-kernel-server - register: default_nfs_kernel_server_exists + register: common_default_nfs_kernel_server_exists when: - inventory_hostname in groups['nfs_server'] tags: - nfs-server - name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server - command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG + ansible.builtin.copy: + src: /etc/default/nfs-kernel-server + dest: /etc/default/nfs-kernel-server.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - inventory_hostname in groups['nfs_server'] - - default_nfs_kernel_server_exists.stat.exists == False + - common_default_nfs_kernel_server_exists.stat.exists tags: - nfs-server - name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server) - replace: + ansible.builtin.replace: path: /etc/default/nfs-kernel-server regexp: '^RPCNFSDCOUNT=.*' replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}" @@ -97,10 +104,10 @@ # --- - name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists - file: + ansible.builtin.file: path: /etc/nfs.conf.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -115,7 +122,7 @@ dest: /etc/nfs.conf.d/20-start_servers.conf owner: root group: root - mode: 0644 + mode: "0644" notify: "Restart nfs-kernel-server" when: - inventory_hostname in groups['nfs_server'] @@ -128,17 +135,17 @@ # --- - name: (nfs.yml) Ensure NFS utilities (clients) are installed. - apt: + ansible.builtin.apt: pkg: nfs-common state: present - when: + when: - ansible_facts['os_family'] == "Debian" - inventory_hostname in groups['nfs_client'] tags: - nfs-client - name: (nfs.yml) NFS Mount exports from nfs server - mount: + ansible.posix.mount: path: "{{ item.path }}" src: "{{ item.src }}" fstype: nfs @@ -153,6 +160,3 @@ - inventory_hostname in groups['nfs_client'] tags: - nfs-client - - - diff --git a/roles/common/tasks/nis-install-client.yml b/roles/common/tasks/nis-install-client.yml index 4e7fefe..f515686 100644 --- a/roles/common/tasks/nis-install-client.yml +++ b/roles/common/tasks/nis-install-client.yml @@ -6,11 +6,11 @@ - name: (nis-install-client.yml) Set (nis) default domain (/etc/defaultdomain) ansible.builtin.template: - dest: /etc/defaultdomain + dest: /etc/defaultdomain src: etc/defaultdomain.j2 owner: root group: root - mode: 0644 + mode: "0644" tags: - nis-install - nis-install-client @@ -21,13 +21,13 @@ src: etc/yp.conf.j2 owner: root group: root - mode: 0644 + mode: "0644" tags: - nis-install - nis-install-client - name: (nis-install-client.yml) Install nis common packages - package: + ansible.builtin.package: name: "{{ item }}" state: present with_items: "{{ nis_common_packages }}" @@ -41,23 +41,30 @@ # --- - name: (nis-install-client.yml) Check if file '/etc/default/nis.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/default/nis.ORIG - register: default_nis_exists + register: common_default_nis_exists tags: - nis-install - nis-install-client - name: (nis-install-client.yml) Backup existing file /etc/default/nis - command: cp -a /etc/default/nis /etc/default/nis.ORIG + ansible.builtin.copy: + src: /etc/default/nis + dest: /etc/default/nis.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - - default_nis_exists.stat.exists == False + - not common_default_nis_exists.stat.exists tags: - nis-install - nis-install-client - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISSERVER' (client) - replace: + ansible.builtin.replace: path: /etc/default/nis regexp: '^NISSERVER=.*' replace: 'NISSERVER=false' @@ -66,7 +73,7 @@ - nis-install-client - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (client) - replace: + ansible.builtin.replace: path: /etc/default/nis regexp: '^NISCLIENT=.*' replace: 'NISCLIENT=true' @@ -75,7 +82,7 @@ - nis-install-client - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'YPBINDARGS' (client) - replace: + ansible.builtin.replace: path: /etc/default/nis regexp: '^YPBINDARGS=.*' replace: 'YPBINDARGS=' @@ -89,7 +96,7 @@ # --- - name: (nis-install-client.yml) Add '+::::::' to file /etc/passwd - lineinfile: + ansible.builtin.lineinfile: path: /etc/passwd line: '+::::::' insertafter: EOF @@ -103,7 +110,7 @@ - nis-install-client - name: (nis-install-client.yml) Add '+:::' to file /etc/group - lineinfile: + ansible.builtin.lineinfile: path: /etc/group line: '+:::' insertafter: EOF @@ -117,7 +124,7 @@ - nis-install-client - name: (nis-install-client.yml) Add '+::::::::' to file /etc/shadow - lineinfile: + ansible.builtin.lineinfile: path: /etc/shadow line: '+::::::::' insertafter: EOF @@ -136,23 +143,30 @@ # --- - name: (nis-install-client.yml) Check if file '/etc/hosts.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/hosts.ORIG - register: etc_hosts_orig_exists + register: common_etc_hosts_orig_exists tags: - nis-install - nis-install-client - name: (nis-install-client.yml) Backup existing file /etc/hosts - command: cp -a /etc/hosts /etc/hosts.ORIG + ansible.builtin.copy: + src: /etc/hosts + dest: /etc/hosts.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - - etc_hosts_orig_exists.stat.exists == False + - not common_etc_hosts_orig_exists.stat.exists tags: - nis-install - nis-install-client - name: (nis-install-client.yml) Add nis-server to file /etc/hosts - lineinfile: + ansible.builtin.lineinfile: path: /etc/hosts line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}' insertafter: EOF @@ -170,23 +184,30 @@ # --- - name: (nis-install-client.yml) Check if file '/etc/nsswitch.conf.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/nsswitch.conf.ORIG - register: nsswitch_conf_orig_exists + register: common_nsswitch_conf_orig_exists tags: - - nis-install + - nis-install - nis-install-client - name: (nis-install-client.yml) Backup existing file /etc/nsswitch.conf - command: cp -a /etc/nsswitch.conf /etc/nsswitch.conf.ORIG + ansible.builtin.copy: + src: /etc/nsswitch.conf + dest: /etc/nsswitch.conf.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - - nsswitch_conf_orig_exists.stat.exists == False + - not common_nsswitch_conf_orig_exists.stat.exists tags: - nis-install - nis-install-client - name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set hosts) - replace: + ansible.builtin.replace: path: /etc/nsswitch.conf regexp: '(hosts:\s+files)\s+((?!nis).*)$' replace: '\1 nis \2' @@ -195,14 +216,14 @@ - nis-install-client - name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set passwd/group/shadow) - replace: + ansible.builtin.replace: path: /etc/nsswitch.conf regexp: '^({{ item }}:\s+((?!nis).)*)$' replace: '\1 nis' with_items: - - passwd - - group - - shadow + - passwd + - group + - shadow tags: - nis-install - nis-install-client @@ -239,7 +260,7 @@ # - systemctl restart systemd-logind.service - name: (nis-install-client.yml) Ensure directory /etc/systemd/system/systemd-logind.service.d exists - file: + ansible.builtin.file: path: /etc/systemd/system/systemd-logind.service.d owner: root group: root @@ -251,7 +272,7 @@ - nis-install-client - name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf exists - copy: + ansible.builtin.copy: src: "{{ role_path + '/files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf' }}" dest: /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf owner: root @@ -281,7 +302,7 @@ # - cat /etc/systemd/system/rpcbind.socket.d/override.conf - name: (nis-install-client.yml) Ensure directory /etc/systemd/system/rpcbind.socket.d exists - file: + ansible.builtin.file: path: /etc/systemd/system/rpcbind.socket.d owner: root group: root @@ -293,7 +314,7 @@ - nis-install-client - name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/rpcbind.socket.d/override.conf exists - copy: + ansible.builtin.copy: src: "{{ role_path + '/files/etc/systemd/system/rpcbind.socket.d/override.conf' }}" dest: /etc/systemd/system/rpcbind.socket.d/override.conf owner: root @@ -307,12 +328,11 @@ - nis-install-client - name: Make sure service rpcbind, nscd and ypbind are started and enabled - systemd: + ansible.builtin.systemd: name: "{{ item }}" state: restarted enabled: true with_items: - - rpcbind - - nscd - - ypbind - + - rpcbind + - nscd + - ypbind diff --git a/roles/common/tasks/nis-install-server.yml b/roles/common/tasks/nis-install-server.yml index 6cb2f08..738a818 100644 --- a/roles/common/tasks/nis-install-server.yml +++ b/roles/common/tasks/nis-install-server.yml @@ -5,11 +5,11 @@ # --- - name: (nis-install-server.yml) Install nis common packages - package: + ansible.builtin.package: name: "{{ item }}" state: present with_items: "{{ nis_common_packages }}" - register: nis_installed + register: common_nis_installed tags: - nis-install - nis-install-server @@ -20,7 +20,7 @@ src: etc/defaultdomain.j2 owner: root group: root - mode: 644 + mode: "0644" tags: - nis-install - nis-install-server @@ -31,13 +31,14 @@ src: etc/yp.conf.j2 owner: root group: root - mode: 644 + mode: "0644" tags: - nis-install - nis-install-client - name: (nis-install-server.yml) Set local host's domain name - command: domainname "{{ nis_domain }}" + ansible.builtin.command: domainname "{{ nis_domain }}" + changed_when: false tags: - nis-install - nis-install-server @@ -51,9 +52,9 @@ # --- - name: (nis-install-server.yml) Check if file '/etc/pam.d/common-password' exists - stat: + ansible.builtin.stat: path: /etc/pam.d/common-password - register: file_etc_pam_d_common_password + register: common_file_etc_pam_d_common_password tags: - nis-install - nis-install-server @@ -62,53 +63,60 @@ - ansible_facts['distribution_major_version']|int >= 11 - name: (nis-install-server.yml) Check if default hash for password is 'yescrypt' - shell: "grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password" - register: presence_of_passwprd_hashing_yescrypt - changed_when: - - presence_of_passwprd_hashing_yescrypt.rc < 1 + ansible.builtin.command: grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password + register: common_presence_of_passwprd_hashing_yescrypt + changed_when: false failed_when: - - presence_of_passwprd_hashing_yescrypt.rc >= 2 + - common_presence_of_passwprd_hashing_yescrypt.rc >= 2 when: - ansible_facts['distribution'] == "Debian" - ansible_facts['distribution_major_version']|int >= 11 - - file_etc_pam_d_common_password.stat.exists == True - #- ansible_distribution_major_version|int <= 12 + - common_file_etc_pam_d_common_password.stat.exists + # - ansible_distribution_major_version|int <= 12 -- name: (nis-install-server.yml) Change default password hash for local system - accounts from SHA-512 to yescrypt - shell: perl -i -n -p -e "s/^(password.+)yescrypt/\1sha512/" - /etc/pam.d/common-password +- name: (nis-install-server.yml) Change default password hash for local system accounts from yescrypt to SHA-512 + ansible.builtin.replace: + path: /etc/pam.d/common-password + regexp: '^(password.+)yescrypt' + replace: '\1sha512' when: - ansible_facts['distribution'] == "Debian" - ansible_facts['distribution_major_version']|int >= 11 - - file_etc_pam_d_common_password.stat.exists == True - - presence_of_passwprd_hashing_yescrypt is changed - #- ansible_facts['distribution_major_version']|int <= 12 + - common_file_etc_pam_d_common_password.stat.exists + - common_presence_of_passwprd_hashing_yescrypt.rc == 0 + # - ansible_facts['distribution_major_version']|int <= 12 - # --- - # /etc/default/nis - # --- + # --- + # /etc/default/nis + # --- - name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/default/nis.ORIG - register: default_nis_exists + register: common_default_nis_exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /etc/default/nis - command: cp -a /etc/default/nis /etc/default/nis.ORIG + ansible.builtin.copy: + src: /etc/default/nis + dest: /etc/default/nis.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - - default_nis_exists.stat.exists == False + - not common_default_nis_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER' (server) - replace: + ansible.builtin.replace: path: /etc/default/nis regexp: "^NISSERVER=.*" replace: "NISSERVER=master" @@ -118,7 +126,7 @@ - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (server) - replace: + ansible.builtin.replace: path: /etc/default/nis regexp: "^NISCLIENT=.*" replace: "NISCLIENT=false" @@ -131,24 +139,31 @@ # --- - name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/ypserv.securenets.ORIG - register: ypserv_securenets_orig_exists + register: common_ypserv_securenets_orig_exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets - command: cp -a /etc/ypserv.securenets /etc/ypserv.securenets.ORIG + ansible.builtin.copy: + src: /etc/ypserv.securenets + dest: /etc/ypserv.securenets.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - - ypserv_securenets_orig_exists.stat.exists == False + - not common_ypserv_securenets_orig_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file /etc/ypserv.securenets - replace: + ansible.builtin.replace: path: /etc/ypserv.securenets regexp: "^(0.0.0.0\\s+.*)" replace: "#\\1" @@ -158,7 +173,7 @@ - name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file /etc/ypserv.securenets - lineinfile: + ansible.builtin.lineinfile: path: /etc/ypserv.securenets line: "255.255.0.0 192.168.0.0" insertafter: EOF @@ -172,7 +187,7 @@ - name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file /etc/ypserv.securenets - lineinfile: + ansible.builtin.lineinfile: path: /etc/ypserv.securenets line: "255.0.0.0 10.0.0.0" insertafter: EOF @@ -185,8 +200,13 @@ - nis-install-server - name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m' - shell: printf '\n' | /usr/lib/yp/ypinit -m - when: nis_installed.changed + ansible.builtin.command: /usr/lib/yp/ypinit -m + args: + stdin: "\n" + changed_when: false + when: + - ansible_facts['distribution'] == "Debian" + - ansible_facts['distribution_major_version'] | int >= 11 tags: - nis-install - nis-install-server @@ -197,7 +217,7 @@ - name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually /data/home) exists - file: + ansible.builtin.file: path: "{{ nis_base_home }}" owner: root group: root @@ -230,9 +250,9 @@ # --- - name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists' - stat: + ansible.builtin.stat: path: /etc/adduser.conf.ORIG - register: adduser_conf_exists + register: common_adduser_conf_exists when: - nis_base_home is defined - nis_base_home != '/home' @@ -241,11 +261,18 @@ - nis-install-server - name: (nis-install-server.yml) Backup existing file /etc/adduser.conf - command: cp -a /etc/adduser.conf /etc/adduser.conf.ORIG + ansible.builtin.copy: + src: /etc/adduser.conf + dest: /etc/adduser.conf.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - nis_base_home is defined - nis_base_home != '/home' - - adduser_conf_exists.stat.exists == False + - not common_adduser_conf_exists.stat.exists tags: - nis-install - nis-install-server @@ -267,23 +294,30 @@ # --- - name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists' - stat: + ansible.builtin.stat: path: /var/yp/Makefile.ORIG - register: adduser_conf_exists + register: common_yp_makefile_orig_exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /var/yp/Makefile - command: cp -a /var/yp/Makefile /var/yp/Makefile.ORIG + ansible.builtin.copy: + src: /var/yp/Makefile + dest: /var/yp/Makefile.ORIG + remote_src: true + force: false + owner: root + group: root + mode: "0644" when: - - adduser_conf_exists.stat.exists == False + - not common_yp_makefile_orig_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Adjust file '/var/yp/Makefile' - replace: + ansible.builtin.replace: path: /var/yp/Makefile regexp: "^#?{{ item }}=.*" replace: "{{ item }}=true" diff --git a/roles/common/tasks/nis-user-systemfiles.yml b/roles/common/tasks/nis-user-systemfiles.yml index bb899ae..82d3d00 100644 --- a/roles/common/tasks/nis-user-systemfiles.yml +++ b/roles/common/tasks/nis-user-systemfiles.yml @@ -5,36 +5,36 @@ # --- # nis_users -#- name: (nis-user-systemfiles.yml) Check if local template directory exists for default users -# local_action: stat path={{ inventory_dir }}/files/{{ nis_domain}}/homedirs/{{ item.name }} +# - name: (nis-user-systemfiles.yml) Check if local template directory exists for default users +# local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }} # with_items: "{{ nis_user }}" # loop_control: # label: '{{ item.name }}' -# register: local_template_dir_nis_user +# register: common_local_template_dir_nis_user - name: (nis-user-systemfiles.yml) Check if local template directory exists for default users delegate_to: localhost - stat: - path: "{{ inventory_dir }}/files/{{ nis_domain}}/homedirs/{{ item.name }}" + ansible.builtin.stat: + path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}" with_items: "{{ nis_user }}" loop_control: label: '{{ item.name }}' - register: local_template_dir_nis_user + register: common_local_template_dir_nis_user -#- name: Print variable local_template_dir_nis_user -# debug: var=local_template_dir_nis_user.results +# - name: Print variable common_local_template_dir_nis_user +# debug: var=common_local_template_dir_nis_user.results -#- meta: end_play +# - meta: end_play -# -- -# Copy .profile -# --- +# -- +# Copy .profile +# --- - name: (nis-user-systemfiles.yml) Check if users file '.profile.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.profile.ORIG" - register: profile_user_orig_exists + register: common_profile_user_orig_exists loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' @@ -42,12 +42,19 @@ - profile - name: (nis-user-systemfiles.yml) Backup existing users .profile file - command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG - loop: "{{ profile_user_orig_exists.results }}" + ansible.builtin.copy: + src: "~{{ item.item.name }}/.profile" + dest: "~{{ item.item.name }}/.profile.ORIG" + remote_src: true + force: false + owner: "{{ item.item.name }}" + group: "{{ item.item.name }}" + mode: "0644" + loop: "{{ common_profile_user_orig_exists.results }}" loop_control: label: '{{ item.item.name }}' when: - - item.stat.exists == False + - not item.stat.exists tags: - profile @@ -59,7 +66,7 @@ delegate_to: localhost become: false loop: "{{ nis_user }}" - register: profile_template_stats + register: common_profile_template_stats loop_control: label: "{{ item.name }}" @@ -72,7 +79,7 @@ group: "{{ user.name }}" mode: "0644" become: true - loop: "{{ nis_user | zip(profile_template_stats.results) | list }}" + loop: "{{ nis_user | zip(common_profile_template_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -83,16 +90,14 @@ tags: [bash] - - # -- # Copy .bashrc # --- - name: (nis-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.bashrc.ORIG" - register: bashrc_user_orig_exists + register: common_bashrc_user_orig_exists loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' @@ -100,11 +105,18 @@ - bashrc - name: (nis-user-systemfiles.yml) Backup existing users .bashrc file - command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG - loop: "{{ bashrc_user_orig_exists.results }}" + ansible.builtin.copy: + src: "~{{ item.item.name }}/.bashrc" + dest: "~{{ item.item.name }}/.bashrc.ORIG" + remote_src: true + force: false + owner: "{{ item.item.name }}" + group: "{{ item.item.name }}" + mode: "0644" + loop: "{{ common_bashrc_user_orig_exists.results }}" loop_control: label: '{{ item.item.name }}' - when: item.stat.exists == False + when: not item.stat.exists tags: - bashrc @@ -115,7 +127,7 @@ delegate_to: localhost become: false loop: "{{ nis_user }}" - register: bashrc_stats + register: common_bashrc_stats loop_control: label: "{{ item.name }}" @@ -128,7 +140,7 @@ group: "{{ user.name }}" mode: "0644" become: true - loop: "{{ nis_user | zip(bashrc_stats.results) | list }}" + loop: "{{ nis_user | zip(common_bashrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -150,7 +162,7 @@ delegate_to: localhost become: false loop: "{{ nis_user }}" - register: vimrc_stats + register: common_vimrc_stats loop_control: label: '{{ item.name }}' @@ -162,7 +174,7 @@ owner: "{{ user.name }}" group: "{{ user.name }}" mode: '0644' - loop: "{{ nis_user | zip(vimrc_stats.results) | list }}" + loop: "{{ nis_user | zip(common_vimrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -181,7 +193,7 @@ delegate_to: localhost become: false loop: "{{ nis_user }}" - register: dotvim_stats + register: common_dotvim_stats loop_control: label: "{{ item.name }}" @@ -193,7 +205,7 @@ dest: "~{{ user.name }}/" mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch become: true - loop: "{{ nis_user | zip(dotvim_stats.results) | list }}" + loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -213,7 +225,7 @@ recurse: true state: directory become: true - loop: "{{ nis_user | zip(dotvim_stats.results) | list }}" + loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -222,4 +234,3 @@ user: "{{ item.0 }}" stat_result: "{{ item.1 }}" tags: [vim] - diff --git a/roles/common/tasks/nis-user.yml b/roles/common/tasks/nis-user.yml index e9b8316..c9cc390 100644 --- a/roles/common/tasks/nis-user.yml +++ b/roles/common/tasks/nis-user.yml @@ -33,7 +33,7 @@ # --- - name: (nis_user.yml) Ensure nis groups exists - group: + ansible.builtin.group: name: '{{ item.name }}' state: present gid: '{{ item.group_id | default(omit) }}' @@ -45,18 +45,19 @@ tags: - nis-user - system-user - -#- meta: end_host + +# - meta: end_host - name: (nis_user.yml) Get database of nis (system) users - getent: + ansible.builtin.getent: database: passwd tags: - nis-user - system-user - name: (nis_user.yml) Add nis (system) users if not yet exists.. - shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" + ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" + changed_when: true loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' @@ -69,17 +70,17 @@ - system-user - name: (nis_user.yml) Ensure nis users exists - user: + ansible.builtin.user: name: '{{ item.name }}' state: present uid: '{{ item.user_id | default(omit) }}' - #group: '{{ item.0.name | default(omit) }}' - groups: "{{ item.groups|join(', ') }}" + # group: '{{ item.0.name | default(omit) }}' + groups: "{{ item.groups | join(', ') }}" home: '{{ nis_base_home }}/{{ item.name }}' - shell: '{{ item.shell|d("/bin/bash") }}' + shell: '{{ item.shell | d("/bin/bash") }}' password: "{{ item.password | password_hash('sha512') }}" update_password: on_create - append: yes + append: true loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' @@ -90,42 +91,42 @@ - name: (nis_user.yml) Check if directory ~/.config/autostart exists - stat: + ansible.builtin.stat: path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart' loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' - register: home_config_autostart + register: common_home_config_autostart tags: - nis-user - x11vnc - name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists - file: + ansible.builtin.file: path: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart' state: directory owner: "{{ item.item.name }}" group: "{{ item.item.name }}" - mode: 0700 - recurse: yes - loop: "{{ home_config_autostart.results }}" + mode: "0700" + recurse: true + loop: "{{ common_home_config_autostart.results }}" loop_control: label: '{{ item.item.name }}' - when : not item.stat.exists|bool + when: not item.stat.exists|bool tags: - nis-user - x11vnc -#- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists +# - name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists # file: # path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart' # state: directory # owner: "{{ item.name }}" # group: "{{ item.name }}" -# mode: 0700 -# recurse: yes +# mode: "0700" +# recurse: true # loop: "{{ nis_user }}" # loop_control: # label: '{{ item.name }}' @@ -135,42 +136,40 @@ - name: (nis_user.yml) Check if file ~/.config/autostart/x11vnc.desktop exists - stat: + ansible.builtin.stat: path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop' loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' - register: home_config_autostart_x11vnc + register: common_home_config_autostart_x11vnc tags: - nis-user - x11vnc - name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists - copy: + ansible.builtin.copy: src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}" dest: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart/x11vnc.desktop' owner: '{{ item.item.name }}' group: '{{ item.item.name }}' - mode: 0600 - loop: "{{ home_config_autostart_x11vnc.results }}" + mode: "0600" + loop: "{{ common_home_config_autostart_x11vnc.results }}" loop_control: label: '{{ item.item.name }}' tags: - nis-user - x11vnc -#- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists +# - name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists # copy: # src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}" # dest: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop' # owner: '{{ item.name }}' # group: '{{ item.name }}' -# mode: 0600 +# mode: "0600" # loop: "{{ nis_user }}" # loop_control: # label: '{{ item.name }}' # tags: # - nis-user # - x11vnc - - diff --git a/roles/common/tasks/ntp.yml b/roles/common/tasks/ntp.yml index d7d6aad..13987e1 100644 --- a/roles/common/tasks/ntp.yml +++ b/roles/common/tasks/ntp.yml @@ -5,28 +5,27 @@ # --- - name: (ntp.yml) Ensure ntpsec package is installed. - apt: + ansible.builtin.apt: name: - ntpsec state: present when: - ansible_facts.os_family == "Debian" - - groups['file_server']|string is search(inventory_hostname) + - groups['file_server'] | string is search(inventory_hostname) tags: - ntp-server - name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/ntpsec/ntp.conf.ORIG - register: etc_ntpsec_conf_ORIG + register: common_etc_ntpsec_conf_orig when: - - groups['file_server']|string is search(inventory_hostname) + - groups['file_server'] | string is search(inventory_hostname) tags: - ntp-server - - name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present - file: + ansible.builtin.file: path: /var/log/ntpsec state: directory owner: ntpsec @@ -37,10 +36,17 @@ - name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf' - command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG + ansible.builtin.copy: + src: /etc/ntpsec/ntp.conf + dest: /etc/ntpsec/ntp.conf.ORIG + remote_src: true + owner: root + group: root + mode: "0644" + force: false when: - - groups['file_server']|string is search(inventory_hostname) - - etc_ntpsec_conf_ORIG.stat.exists == False + - groups['file_server'] | string is search(inventory_hostname) + - not common_etc_ntpsec_conf_orig.stat.exists tags: - ntp-server @@ -50,10 +56,9 @@ dest: /etc/ntpsec/ntp.conf owner: root group: root - mode: 0644 + mode: "0644" notify: Restart ntp when: - - groups['file_server']|string is search(inventory_hostname) + - groups['file_server'] | string is search(inventory_hostname) tags: - ntp-server - diff --git a/roles/common/tasks/pure-ftpd-install.yml b/roles/common/tasks/pure-ftpd-install.yml index 867d8bd..e99d0d2 100644 --- a/roles/common/tasks/pure-ftpd-install.yml +++ b/roles/common/tasks/pure-ftpd-install.yml @@ -13,40 +13,42 @@ # Install PureFTP Daemon # --- -- include_tasks: pure-ftpd/setup.yml +- name: (pure-ftpd-install.yml) Include pure-ftpd setup tasks. + ansible.builtin.include_tasks: pure-ftpd/setup.yml # --- # Configure PureFTP Daemon # --- -- include_tasks: pure-ftpd/configure.yml +- name: (pure-ftpd-install.yml) Include pure-ftpd configure tasks. + ansible.builtin.include_tasks: pure-ftpd/configure.yml # --- # Authentication Configuration # --- -- include_tasks: pure-ftpd/authentication.yml +- name: (pure-ftpd-install.yml) Include pure-ftpd authentication tasks. + ansible.builtin.include_tasks: pure-ftpd/authentication.yml # --- # Virtual user # --- -- include_tasks: pure-ftpd/virtual-users.yml +- name: (pure-ftpd-install.yml) Include pure-ftpd virtual user tasks. + ansible.builtin.include_tasks: pure-ftpd/virtual-users.yml - # --- # TLS Certificate # --- -- include_tasks: pure-ftpd/tls-certificate.yml - +- name: (pure-ftpd-install.yml) Include pure-ftpd TLS certificate tasks. + ansible.builtin.include_tasks: pure-ftpd/tls-certificate.yml - name: (pure-ftpd-install.yml) Ensure Pure-FTPd service is started enabled on startup. - service: + ansible.builtin.service: name: pure-ftpd state: started - enabled: yes - + enabled: true diff --git a/roles/common/tasks/pure-ftpd/authentication.yml b/roles/common/tasks/pure-ftpd/authentication.yml index f5686e3..a1ef9ba 100644 --- a/roles/common/tasks/pure-ftpd/authentication.yml +++ b/roles/common/tasks/pure-ftpd/authentication.yml @@ -5,16 +5,16 @@ # --- - name: (pure-ftpd-install.yml) Get current authentications. - command: ls -1 {{ pureftpd_config_auth_dir }} - register: pureftpd_current_auth + ansible.builtin.command: ls -1 {{ pureftpd_config_auth_dir }} + register: common_pureftpd_current_auth changed_when: false - name: (pure-ftpd-install.yml) Define empty pureftpd_authentications variable. - set_fact: - pureftpd_authentications: [] + ansible.builtin.set_fact: + common_pureftpd_authentications: [] - name: (pure-ftpd-install.yml) Enable PureDB authentication. - file: + ansible.builtin.file: src: "{{ pureftpd_config_conf_dir }}/PureDB" dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_puredb }}pure" state: link @@ -22,18 +22,18 @@ notify: restart Pure-FTPd - name: (pure-ftpd-install.yml) Add PureDB to Pure-FTPd authentications. - set_fact: - pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']" + ansible.builtin.set_fact: + common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']" when: pureftpd_auth_puredb > 0 and pureftpd_config['PureDB'] is defined - name: (pure-ftpd-install.yml) Add PAM to Pure-FTPd authentications. - set_fact: - pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']" + ansible.builtin.set_fact: + common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']" when: pureftpd_auth_pam > 0 and pureftpd_config['PAMAuthentication'] is defined - name: (pure-ftpd-install.yml) Enable UNIX authentication. - file: + ansible.builtin.file: src: "{{ pureftpd_config_conf_dir }}/UnixAuthentication" dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_unix }}unix" state: link @@ -41,13 +41,13 @@ notify: restart Pure-FTPd - name: (pure-ftpd-install.yml) Add UnixAuthentication to Pure-FTPd authentications. - set_fact: - pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']" + ansible.builtin.set_fact: + common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']" when: pureftpd_auth_unix > 0 and pureftpd_config['UnixAuthentication'] is defined - name: (pure-ftpd-install.yml) Enable PAM authentication. - file: + ansible.builtin.file: src: "{{ pureftpd_config_conf_dir }}/PAMAuthentication" dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_pam }}pam" state: link @@ -58,9 +58,9 @@ # Delete unused authentification if exists - name: (pure-ftpd-install.yml) Delete old authentications. - file: + ansible.builtin.file: path: "{{ pureftpd_config_auth_dir }}/{{ item }}" state: absent - when: item not in pureftpd_authentications - with_items: "{{ pureftpd_current_auth.stdout_lines }}" + when: item not in common_pureftpd_authentications + with_items: "{{ common_pureftpd_current_auth.stdout_lines }}" notify: restart Pure-FTPd diff --git a/roles/common/tasks/pure-ftpd/configure.yml b/roles/common/tasks/pure-ftpd/configure.yml index 8f95f88..6ccbfae 100644 --- a/roles/common/tasks/pure-ftpd/configure.yml +++ b/roles/common/tasks/pure-ftpd/configure.yml @@ -16,20 +16,20 @@ notify: restart Pure-FTPd - name: (pure-ftpd-install.yml) Compile Pure-FTPd configurations (set fact..). - set_fact: - pureftpd_config_compiled: "{{ pureftpd_config }}" + ansible.builtin.set_fact: + common_pureftpd_config_compiled: "{{ pureftpd_config }}" - name: (pure-ftpd-install.yml) Get current configuration. - command: ls -1 {{ pureftpd_config_conf_dir }} - register: pureftpd_current_config + ansible.builtin.command: ls -1 {{ pureftpd_config_conf_dir }} + register: common_pureftpd_current_config changed_when: false - name: (pure-ftpd-install.yml) Delete old configuration. - file: + ansible.builtin.file: path: "{{ pureftpd_config_conf_dir }}/{{ item }}" state: absent - when: pureftpd_config_compiled[item] is not defined - with_items: "{{ pureftpd_current_config.stdout_lines }}" + when: common_pureftpd_config_compiled[item] is not defined + with_items: "{{ common_pureftpd_current_config.stdout_lines }}" notify: restart Pure-FTPd # write new configuration @@ -41,5 +41,5 @@ owner: root group: root mode: '0644' - with_dict: '{{ pureftpd_config_compiled }}' + with_dict: '{{ common_pureftpd_config_compiled }}' notify: restart Pure-FTPd diff --git a/roles/common/tasks/pure-ftpd/create-virtual-ftp-user.yml b/roles/common/tasks/pure-ftpd/create-virtual-ftp-user.yml index 989a3d2..2a525aa 100644 --- a/roles/common/tasks/pure-ftpd/create-virtual-ftp-user.yml +++ b/roles/common/tasks/pure-ftpd/create-virtual-ftp-user.yml @@ -1,34 +1,62 @@ --- # --- -# Add virtual ftp users +# Add virtual ftp users # --- -- name: "(create-virtual-ftp-user.yml) Verify if virtual ftp user {{ user.name }} exists" - command: pure-pw show {{ user.name }} - register: pureftpd_virtual_user_exists - changed_when: "pureftpd_virtual_user_exists.rc != 0" - failed_when: - - "pureftpd_virtual_user_exists.rc != 0" - - "pureftpd_virtual_user_exists.rc != 16" - ignore_errors: true +- name: (create-virtual-ftp-user.yml) Verify if virtual ftp user exists for {{ user.name }} + ansible.builtin.command: pure-pw show {{ user.name }} + register: common_pureftpd_virtual_user_exists + changed_when: false + failed_when: + - common_pureftpd_virtual_user_exists.rc != 0 + - common_pureftpd_virtual_user_exists.rc != 16 loop_control: label: '{{ user.name }}' -- name: "(create-virtual-ftp-user.yml) Create virtual ftp user {{ user.name }} ." - shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw useradd {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}" - #when: pureftpd_virtual_user_exists.failed is defined and pureftpd_virtual_user_exists.failed - when: pureftpd_virtual_user_exists.changed +- name: (create-virtual-ftp-user.yml) Create virtual ftp user for {{ user.name }} + ansible.builtin.shell: + cmd: >- + set -o pipefail && + (echo {{ user.password }}; echo {{ user.password }}) | + pure-pw useradd {{ user.name }} + -u {{ user.uid | default(pureftpd_virtual_users_user) }} + -g {{ user.gid | default(pureftpd_virtual_users_group) }} + -d {{ user.homedir }} + -n {{ user.quota_files | default('""') }} + -N {{ user.quota_size | default('""') }} + -t {{ user.bandwidth_dl | default('""') }} + -T {{ user.bandwidth_ul | default('""') }} + -q {{ user.ratio_ul | default('""') }} + -Q {{ user.ratio_dl | default('""') }} + executable: /bin/bash + when: common_pureftpd_virtual_user_exists.rc == 16 + changed_when: true notify: reload Pure-FTPd users -- name: "User {{ user.name }}: Update virtual user" - command: "pure-pw usermod {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}" - #when: pureftpd_virtual_user_exists.failed is defined and not pureftpd_virtual_user_exists.failed - when: not pureftpd_virtual_user_exists.changed +- name: (create-virtual-ftp-user.yml) Update virtual ftp user for {{ user.name }} + ansible.builtin.command: >- + pure-pw usermod {{ user.name }} + -u {{ user.uid | default(pureftpd_virtual_users_user) }} + -g {{ user.gid | default(pureftpd_virtual_users_group) }} + -d {{ user.homedir }} + -n {{ user.quota_files | default('""') }} + -N {{ user.quota_size | default('""') }} + -t {{ user.bandwidth_dl | default('""') }} + -T {{ user.bandwidth_ul | default('""') }} + -q {{ user.ratio_ul | default('""') }} + -Q {{ user.ratio_dl | default('""') }} + when: common_pureftpd_virtual_user_exists.rc == 0 + changed_when: true notify: reload Pure-FTPd users -- name: "User {{ user.name }}: Update virtual user password" - shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw passwd {{ user.name }}" - when: not pureftpd_virtual_user_exists.changed +- name: (create-virtual-ftp-user.yml) Update virtual ftp user password for {{ user.name }} + ansible.builtin.shell: + cmd: >- + set -o pipefail && + (echo {{ user.password }}; echo {{ user.password }}) | + pure-pw passwd {{ user.name }} + executable: /bin/bash + when: common_pureftpd_virtual_user_exists.rc == 0 + changed_when: true notify: reload Pure-FTPd users - diff --git a/roles/common/tasks/pure-ftpd/remove-virtual-user.yml b/roles/common/tasks/pure-ftpd/remove-virtual-user.yml index 9d24c13..15771c2 100644 --- a/roles/common/tasks/pure-ftpd/remove-virtual-user.yml +++ b/roles/common/tasks/pure-ftpd/remove-virtual-user.yml @@ -1,19 +1,19 @@ --- # --- -# Remove virtual ftp users +# Remove virtual ftp users # --- -- name: "User {{ user.name }}: Verify if it exists" - command: pure-pw show {{ user.name }} - register: pureftpd_virtual_user_exists - changed_when: "pureftpd_virtual_user_exists.rc == 0" - failed_when: - - "pureftpd_virtual_user_exists.rc != 0" - - "pureftpd_virtual_user_exists.rc != 16" - ignore_errors: true +- name: (remove-virtual-user.yml) Verify virtual ftp user exists for {{ user.name }} + ansible.builtin.command: pure-pw show {{ user.name }} + register: common_pureftpd_virtual_user_exists + changed_when: false + failed_when: + - common_pureftpd_virtual_user_exists.rc != 0 + - common_pureftpd_virtual_user_exists.rc != 16 -- name: "User {{ user.name }}: Remove virtual user" - shell: "pure-pw userdel {{ user.name }}" - when: pureftpd_virtual_user_exists.changed +- name: (remove-virtual-user.yml) Remove virtual ftp user for {{ user.name }} + ansible.builtin.command: pure-pw userdel {{ user.name }} + when: common_pureftpd_virtual_user_exists.rc == 0 + changed_when: true notify: reload Pure-FTPd users diff --git a/roles/common/tasks/pure-ftpd/setup.yml b/roles/common/tasks/pure-ftpd/setup.yml index 4c55492..23963f8 100644 --- a/roles/common/tasks/pure-ftpd/setup.yml +++ b/roles/common/tasks/pure-ftpd/setup.yml @@ -1,15 +1,15 @@ --- - + # --- # Install PureFTP Daemon # --- - name: (pure-ftpd-install.yml) Ensure Pure-FTPd is installed. - apt: + ansible.builtin.apt: name: "{{ pureftpd_packages }}" state: present cache_valid_time: 3600 - update_cache: yes + update_cache: true - name: (pure-ftpd-install.yml) Upload Pure-FTPd global configuration file. ansible.builtin.template: diff --git a/roles/common/tasks/pure-ftpd/tls-certificate.yml b/roles/common/tasks/pure-ftpd/tls-certificate.yml index ea14750..44a8ba4 100644 --- a/roles/common/tasks/pure-ftpd/tls-certificate.yml +++ b/roles/common/tasks/pure-ftpd/tls-certificate.yml @@ -1,40 +1,69 @@ --- - + # --- # TLS Certificate # --- # - method 'generate' +- name: Build Pure-FTPd TLS subject. + ansible.builtin.set_fact: + common_pureftpd_tls_subject: >- + /C={{ pureftpd_tls_certificate_openssl.country | default('') }} + /ST={{ pureftpd_tls_certificate_openssl.state | default('') }} + /L={{ pureftpd_tls_certificate_openssl.locality | default('') }} + /O={{ pureftpd_tls_certificate_openssl.organization | default('') }} + /OU={{ pureftpd_tls_certificate_openssl.unit | default('') }} + /CN={{ pureftpd_tls_certificate_openssl.fqdn }} + when: + - pureftpd_tls_certificate_method == 'generate' + - pureftpd_tls_certificate_openssl | length > 0 + - name: Generate Pure-FTPd TLS certificate. - command: openssl req -x509 -nodes -newkey rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }} -sha256 -days {{ pureftpd_tls_certificate_openssl.days | default(365) }} -keyout {{ pureftpd_tls_certificate_pem }} -out {{ pureftpd_tls_certificate_pem }} -subj "/C={{ pureftpd_tls_certificate_openssl.country | default('') }}/ST={{ pureftpd_tls_certificate_openssl.state | default('') }}/L={{ pureftpd_tls_certificate_openssl.locality | default('') }}/O={{ pureftpd_tls_certificate_openssl.organization | default('') }}/OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}/CN={{ pureftpd_tls_certificate_openssl.fqdn }}" + ansible.builtin.command: + argv: + - openssl + - req + - -x509 + - -nodes + - -newkey + - rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }} + - -sha256 + - -days + - '{{ pureftpd_tls_certificate_openssl.days | default(365) }}' + - -keyout + - '{{ pureftpd_tls_certificate_pem }}' + - -out + - '{{ pureftpd_tls_certificate_pem }}' + - -subj + - '{{ common_pureftpd_tls_subject }}' args: creates: "{{ pureftpd_tls_certificate_pem }}" - when: + when: - pureftpd_tls_certificate_method == 'generate' - pureftpd_tls_certificate_openssl | length > 0 notify: restart Pure-FTPd - name: Ensure Pure-FTPd TLS certificate permissions. - file: + ansible.builtin.file: path: "{{ pureftpd_tls_certificate_pem }}" owner: root group: root mode: '0600' state: file - when: + when: - pureftpd_tls_certificate_method == 'generate' - pureftpd_tls_certificate_openssl | length > 0 # - final checks - name: (pure-ftpd-install.yml) Verify TLS certificate exists. - stat: + ansible.builtin.stat: path: "{{ pureftpd_tls_certificate_pem }}" - register: pureftpd_tls_certificate + register: common_pureftpd_tls_certificate - name: (pure-ftpd-install.yml) Fail when no certificate is found. - fail: + ansible.builtin.fail: msg: | The certificate file was not found at {{ pureftpd_tls_certificate_pem }} - when: not pureftpd_tls_certificate.stat.exists | default(False) + when: not common_pureftpd_tls_certificate.stat.exists | default(false) diff --git a/roles/common/tasks/pure-ftpd/virtual-users.yml b/roles/common/tasks/pure-ftpd/virtual-users.yml index 9514f94..16bc754 100644 --- a/roles/common/tasks/pure-ftpd/virtual-users.yml +++ b/roles/common/tasks/pure-ftpd/virtual-users.yml @@ -3,44 +3,45 @@ # Default virtual users/group - name: (pure-ftpd-install.yml) Ensure Pure-FTPd group exists. - group: + ansible.builtin.group: name: "{{ pureftpd_virtual_users_group }}" gid: "{{ pureftpd_virtual_users_gid | default(omit) }}" - system: no + system: false state: present when: pureftpd_virtual_users | length > 0 - name: (pure-ftpd-install.yml) Ensure Pure-FTPd user exists. - user: + ansible.builtin.user: name: "{{ pureftpd_virtual_users_user }}" uid: "{{ pureftpd_virtual_users_uid | default(omit) }}" group: "{{ pureftpd_virtual_users_group }}" home: /dev/null shell: /usr/sbin/nologin - system: no + system: false state: present when: pureftpd_virtual_users | length > 0 # user databas - name: (pure-ftpd-install.yml) Verify virtual users database existence. - stat: + ansible.builtin.stat: path: "{{ pureftpd_config_dir }}/pureftpd.passwd" - register: pureftpd_virtual_users_database + register: common_pureftpd_virtual_users_database - name: (pure-ftpd-install.yml) Ensure virtual users database exists. - file: + ansible.builtin.file: path: "{{ pureftpd_config_dir }}/pureftpd.passwd" owner: root group: root mode: '0600' state: touch - when: (pureftpd_virtual_users | length > 0) and not pureftpd_virtual_users_database.stat.exists | default(False) + when: (pureftpd_virtual_users | length > 0) and not common_pureftpd_virtual_users_database.stat.exists | default(false) # - Cretate virtual user -- include_tasks: create-virtual-ftp-user.yml +- name: (pure-ftpd-install.yml) Include create virtual ftp user task. + ansible.builtin.include_tasks: create-virtual-ftp-user.yml vars: user: "{{ item }}" with_items: "{{ pureftpd_virtual_users }}" @@ -50,7 +51,8 @@ # Remove virtual user # - -- include_tasks: remove-virtual-user.yml +- name: (pure-ftpd-install.yml) Include remove virtual ftp user task. + ansible.builtin.include_tasks: remove-virtual-user.yml vars: user: "{{ item }}" with_items: "{{ pureftpd_virtual_deleted_users }}" diff --git a/roles/common/tasks/root-files-scripts.yml b/roles/common/tasks/root-files-scripts.yml index df43185..5a662a1 100644 --- a/roles/common/tasks/root-files-scripts.yml +++ b/roles/common/tasks/root-files-scripts.yml @@ -1,14 +1,14 @@ --- - name: (root_files_scripts.yml) Ensure directory /root/bin exists - file: + ansible.builtin.file: path: /root/bin owner: root group: root mode: '0700' state: directory when: - - groups['file_server']|string is search(inventory_hostname) + - groups['file_server'] | string is search(inventory_hostname) - name: (root_files_scripts.yml) Ensure script 'wakeup_lan.sh' is present ansible.builtin.template: @@ -16,36 +16,42 @@ dest: /root/bin/wakeup_lan.sh owner: root group: root - mode: 0755 + mode: "0755" when: - - groups['file_server']|string is search(inventory_hostname) + - groups['file_server'] | string is search(inventory_hostname) tags: - wakeup_lan - name: (root_files_scripts.yml) Check file '/etc/motd.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/motd.ORIG - register: etc_motd_ORIG + register: common_etc_motd_orig when: - - "groups['file_server']|string is search(inventory_hostname)" + - groups['file_server'] | string is search(inventory_hostname) tags: - etc_motd - name: (basic.yml) Backup installation version of file '/etc/motd' - command: cp -a /etc/motd /etc/motd.ORIG + ansible.builtin.copy: + src: /etc/motd + dest: /etc/motd.ORIG + remote_src: true + owner: root + group: root + mode: "0644" + force: false when: - - "groups['file_server']|string is search(inventory_hostname)" - - etc_motd_ORIG.stat.exists == False + - groups['file_server'] | string is search(inventory_hostname) + - not common_etc_motd_orig.stat.exists tags: - etc_motd - - name: (root_files_scripts.yml) Write new '/etc/motd' file.. - shell: > + ansible.builtin.shell: > figlet '{{ nis_server_name.split(".")[0] }}' > /etc/motd + changed_when: true when: - - "groups['file_server']|string is search(inventory_hostname)" - - etc_motd_ORIG.stat.exists == False + - groups['file_server'] | string is search(inventory_hostname) + - not common_etc_motd_orig.stat.exists tags: - etc_motd - diff --git a/roles/common/tasks/samba-install.yml b/roles/common/tasks/samba-install.yml index 9f08119..5c5effe 100644 --- a/roles/common/tasks/samba-install.yml +++ b/roles/common/tasks/samba-install.yml @@ -4,7 +4,7 @@ # --- - name: (samba-install.yml) Ensure samba packages server (buster) are installed. - package: + ansible.builtin.package: pkg: "{{ apt_install_server_samba }}" state: present when: @@ -13,7 +13,7 @@ - samba-server - name: (samba-install.yml) Ensure quarantine directory exists - file: + ansible.builtin.file: path: /data/samba/QUARANTINE owner: root group: root @@ -28,13 +28,13 @@ - samba-virusfilter - name: (samba-install.yml) Ensure samba share directories exists - file: + ansible.builtin.file: path: "{{ item.path }}" owner: "root" group: "{{ item.group_write_list }}" mode: "{{ item.dir_create_mask | default('2770', true) }}" state: directory - recurse: no + recurse: false with_items: "{{ samba_shares }}" loop_control: label: "{{ item.name }}" @@ -48,7 +48,7 @@ # --- - name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed - package: + ansible.builtin.package: pkg: "{{ apt_install_server_samba_virusfilter }}" state: present when: @@ -60,12 +60,12 @@ - samba-virusfilter - name: (samba-config-server.yml) Check if ClamAV virus databases are present - find: + ansible.builtin.find: paths: /var/lib/clamav patterns: - "*.cvd" - "*.cld" - register: clamav_db_files + register: common_clamav_db_files when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 @@ -74,23 +74,23 @@ - samba-virusfilter - name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download - service: + ansible.builtin.service: name: clamav-freshclam state: stopped failed_when: false when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - - clamav_db_files.files | length == 0 + - common_clamav_db_files.files | length == 0 tags: - samba-server - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update - service: + ansible.builtin.service: name: clamav-daemon state: started - enabled: yes + enabled: true failed_when: false when: - inventory_hostname in groups['samba_server'] @@ -100,20 +100,21 @@ - samba-virusfilter - name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam - command: freshclam + ansible.builtin.command: freshclam + changed_when: true when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - - clamav_db_files.files | length == 0 + - common_clamav_db_files.files | length == 0 tags: - samba-server - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started - service: + ansible.builtin.service: name: clamav-daemon state: started - enabled: yes + enabled: true when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 @@ -122,10 +123,10 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started - service: + ansible.builtin.service: name: clamav-freshclam state: started - enabled: yes + enabled: true when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 @@ -134,10 +135,10 @@ - samba-virusfilter - name: (samba-install.yml) Ensure clamav user is member of all NIS groups - user: + ansible.builtin.user: name: clamav groups: "{{ item.name }}" - append: yes + append: true loop: "{{ nis_groups }}" loop_control: label: "{{ item.name }}" @@ -151,10 +152,10 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav user is member of all NIS user groups (homes virusfilter) - user: + ansible.builtin.user: name: clamav groups: "{{ item.name }}" - append: yes + append: true loop: "{{ nis_user }}" loop_control: label: "{{ item.name }}" @@ -173,7 +174,7 @@ loop: "{{ nis_user }}" loop_control: label: "{{ item.name }}" - register: samba_user_getent + register: common_samba_user_getent when: - inventory_hostname in groups['samba_server'] - samba_homes_virusfilter | default(false) | bool @@ -183,11 +184,11 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter) - file: + ansible.builtin.file: path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}" mode: "0750" state: directory - loop: "{{ samba_user_getent.results | default([]) }}" + loop: "{{ common_samba_user_getent.results | default([]) }}" loop_control: label: "{{ item.item.name }}" when: @@ -217,7 +218,7 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf - lineinfile: + ansible.builtin.lineinfile: path: /etc/clamav/clamd.conf regexp: "^#?\\s*AllowAllMatchScan\\s" line: "AllowAllMatchScan true" @@ -236,19 +237,26 @@ # --- - name: (samba-install.yml) Check if file '/etc/samba/smb.conf.ORIG exists' - stat: + ansible.builtin.stat: path: /etc/samba/smb.conf.ORIG - register: smb_conf_exists + register: common_smb_conf_exists when: - inventory_hostname in groups['samba_server'] tags: - samba-server - name: (samba-install.yml) Backup existing file /etc/samba/smb.conf - command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG + ansible.builtin.copy: + src: /etc/samba/smb.conf + dest: /etc/samba/smb.conf.ORIG + remote_src: true + owner: root + group: root + mode: "0644" + force: false when: - inventory_hostname in groups['samba_server'] - - smb_conf_exists.stat.exists == False + - not common_smb_conf_exists.stat.exists tags: - samba-server @@ -258,7 +266,7 @@ src: etc/samba/smb.conf.j2 owner: root group: root - mode: 644 + mode: "0644" when: - inventory_hostname in groups['samba_server'] notify: @@ -268,12 +276,12 @@ - samba-server - name: (samba-install.yml) Ensure file /etc/samba/users.map exists - copy: + ansible.builtin.copy: src: "{{ role_path + '/files/etc/samba/users.map' }}" dest: /etc/samba/users.map owner: root group: root - mode: 644 + mode: "0644" when: - inventory_hostname in groups['samba_server'] notify: @@ -287,9 +295,9 @@ # --- - name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists - stat: + ansible.builtin.stat: path: /root/bin/samba/clean_samba_trash.sh - register: clean_samba_trash_exists + register: common_clean_samba_trash_exists when: - inventory_hostname in groups['samba_server'] tags: @@ -300,9 +308,12 @@ ansible.builtin.template: dest: /root/bin/samba/conf/clean_samba_trash.conf src: root/bin/samba/conf/clean_samba_trash.conf.j2 + owner: root + group: root + mode: "0644" when: - inventory_hostname in groups['samba_server'] - - clean_samba_trash_exists.stat.exists|bool + - common_clean_samba_trash_exists.stat.exists | bool tags: - samba-server - samba-cron @@ -314,7 +325,7 @@ state: absent check_mode: true changed_when: false - register: clean_samba_trash_dirs + register: common_clean_samba_trash_dirs when: - inventory_hostname in groups['samba_server'] tags: [samba-server, samba-cron] @@ -331,8 +342,8 @@ job: "{{ samba_cronjob_trash_dirs.job }}" when: - inventory_hostname in groups['samba_server'] - - clean_samba_trash_exists.stat.exists | bool - - (clean_samba_trash_dirs.found | int) > 0 + - common_clean_samba_trash_exists.stat.exists | bool + - (common_clean_samba_trash_dirs.found | int) > 0 tags: [samba-server, samba-cron] # --- @@ -342,7 +353,7 @@ - name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists ansible.builtin.stat: path: /root/bin/samba/set_permissions_samba_shares.sh - register: set_permissions_on_samba_shares_exists + register: common_set_permissions_on_samba_shares_exists when: - inventory_hostname in groups['samba_server'] tags: [samba-server, samba-cron] @@ -351,9 +362,12 @@ ansible.builtin.template: dest: /root/bin/samba/conf/set_permissions_samba_shares.conf src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2 + owner: root + group: root + mode: "0644" when: - inventory_hostname in groups['samba_server'] - - set_permissions_on_samba_shares_exists.stat.exists | bool + - common_set_permissions_on_samba_shares_exists.stat.exists | bool tags: [samba-server, samba-cron] - name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs @@ -368,7 +382,7 @@ job: "{{ samba_cronjob_permissions.job }}" when: - inventory_hostname in groups['samba_server'] - - (clean_samba_trash_dirs.found | int) > 0 # << int -> bool + - (common_clean_samba_trash_dirs.found | int) > 0 # << int -> bool tags: [samba-server, samba-cron] # --- @@ -376,7 +390,7 @@ # --- - name: (samba-install.yml) Ensure samba packages clients are installed. - package: + ansible.builtin.package: pkg: "{{ apt_install_client_samba }}" state: present when: diff --git a/roles/common/tasks/samba-remove-user.yml b/roles/common/tasks/samba-remove-user.yml index cdc0288..9ac95cc 100644 --- a/roles/common/tasks/samba-remove-user.yml +++ b/roles/common/tasks/samba-remove-user.yml @@ -6,11 +6,15 @@ - name: (samba-remove-user.yml) Check if samba user exists for removable system user - shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}' - register: samba_remove_system_users_present - changed_when: "samba_remove_system_users_present.rc == 0" - failed_when: "samba_remove_system_users_present.rc > 1" - with_items: + ansible.builtin.shell: + cmd: >- + set -o pipefail && + pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}' + executable: /bin/bash + register: common_samba_remove_system_users_present + changed_when: false + failed_when: common_samba_remove_system_users_present.rc > 1 + with_items: - "{{ remove_system_users }}" loop_control: label: '{{ item.name }}' @@ -19,23 +23,27 @@ - name: (samba-remove-user.yml) Remove (old) system users from samba - shell: > - smbpasswd -s -x {{ item.item.name }} - with_items: - - "{{ samba_remove_system_users_present.results }}" + ansible.builtin.command: smbpasswd -s -x {{ item.item.name }} + changed_when: true + with_items: + - "{{ common_samba_remove_system_users_present.results }}" loop_control: label: '{{ item.item.name }}' - when: - - item.changed + when: + - item.rc == 0 tags: - samba-user - name: (samba-remove-user.yml) Check if samba user exists for removable nis user - shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}' - register: samba_remove_nis_users_present - changed_when: "samba_remove_nis_users_present.rc == 0" - failed_when: "samba_remove_nis_users_present.rc > 1" + ansible.builtin.shell: + cmd: >- + set -o pipefail && + pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}' + executable: /bin/bash + register: common_samba_remove_nis_users_present + changed_when: false + failed_when: common_samba_remove_nis_users_present.rc > 1 with_items: - "{{ remove_nis_users }}" loop_control: @@ -45,13 +53,13 @@ - name: (samba-remove-user.yml) Remove (old) nis users from samba - shell: > - smbpasswd -s -x {{ item.item.name }} + ansible.builtin.command: smbpasswd -s -x {{ item.item.name }} + changed_when: true with_items: - - "{{ samba_remove_nis_users_present.results }}" + - "{{ common_samba_remove_nis_users_present.results }}" loop_control: label: '{{ item.item.name }}' when: - - item.changed + - item.rc == 0 tags: - samba-user diff --git a/roles/common/tasks/samba-user.yml b/roles/common/tasks/samba-user.yml index ab85cfe..b42d1e6 100644 --- a/roles/common/tasks/samba-user.yml +++ b/roles/common/tasks/samba-user.yml @@ -5,26 +5,33 @@ # --- - name: (samba-user.yml) Check if samba user exists for nis user - shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}" - register: samba_nis_user_present - changed_when: "samba_nis_user_present.rc == 1" - failed_when: "samba_nis_user_present.rc > 1" + ansible.builtin.shell: + cmd: >- + set -o pipefail && + pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}" + executable: /bin/bash + register: common_samba_nis_user_present + changed_when: false + failed_when: common_samba_nis_user_present.rc > 1 loop: "{{ nis_user }}" loop_control: label: '{{ item.name }}' when: - - item.is_samba_user is defined and item.is_samba_user|bool + - item.is_samba_user is defined and item.is_samba_user | bool tags: - samba-user - name: (samba-user.yml) Add nis user to samba (with nis users password) - shell: > - (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') - | smbpasswd -s -a {{ item.item.name }} - loop: "{{ samba_nis_user_present.results }}" - when: item.changed + ansible.builtin.shell: + cmd: >- + set -o pipefail && + (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') | + smbpasswd -s -a {{ item.item.name }} + executable: /bin/bash + changed_when: true + loop: "{{ common_samba_nis_user_present.results }}" + when: item.rc == 1 loop_control: label: '{{ item.item.name }}' tags: - samba-user - diff --git a/roles/common/tasks/sshd.yml b/roles/common/tasks/sshd.yml index 6923dca..2741566 100644 --- a/roles/common/tasks/sshd.yml +++ b/roles/common/tasks/sshd.yml @@ -6,40 +6,40 @@ # --- - name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list) - set_fact: - fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}" + ansible.builtin.set_fact: + common_fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}" when: - sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_ciphers (comma separated list) - set_fact: - fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}" + ansible.builtin.set_fact: + common_fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}" when: - sshd_ciphers is defined and sshd_ciphers | length > 0 tags: - sshd-config -- name: (sshd.yml) Set fact_sshd_macs - set_fact: - fact_sshd_macs: "{{ sshd_macs | join (',') }}" +- name: (sshd.yml) Set fact_sshd_macs + ansible.builtin.set_fact: + common_fact_sshd_macs: "{{ sshd_macs | join(',') }}" when: - sshd_macs is defined and sshd_macs | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list) - set_fact: - fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}" + ansible.builtin.set_fact: + common_fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}" when: - sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list) - set_fact: - fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}" + ansible.builtin.set_fact: + common_fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}" when: - sshd_allowed_users is defined and sshd_allowed_users | length > 0 tags: @@ -50,15 +50,22 @@ # --- - name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/ssh/sshd_config.ORIG - register: etc_sshd_sshd_config_ORIG + register: common_etc_sshd_sshd_config_orig tags: - sshd-config - name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config' - command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG - when: etc_sshd_sshd_config_ORIG.stat.exists == False + ansible.builtin.copy: + src: /etc/ssh/sshd_config + dest: /etc/ssh/sshd_config.ORIG + remote_src: true + owner: root + group: root + mode: "0644" + force: false + when: not common_etc_sshd_sshd_config_orig.stat.exists tags: - sshd-config @@ -69,9 +76,9 @@ dest: /etc/ssh/sshd_config owner: root group: root - mode: 0644 + mode: "0644" validate: 'sshd -f %s -T' - #backup: yes + # backup: yes notify: "Restart ssh" when: - ansible_facts['distribution'] == "Ubuntu" @@ -85,7 +92,7 @@ dest: /etc/ssh/sshd_config owner: root group: root - mode: 0644 + mode: "0644" validate: 'sshd -f %s -T' notify: "Restart ssh" when: @@ -101,7 +108,7 @@ dest: /etc/ssh/sshd_config owner: root group: root - mode: 0644 + mode: "0644" validate: 'sshd -f %s -T -C user=sftp_users' notify: "Restart ssh" when: @@ -113,21 +120,21 @@ - name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'.. - lineinfile: + ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^Subsystem\s+sftp(.+)$' state: absent - check_mode: yes + check_mode: true changed_when: false register: sshd_config_sftp tags: - sshd-config - name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists - file: + ansible.builtin.file: path: /etc/ssh/sshd_config.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -142,7 +149,7 @@ dest: /etc/ssh/sshd_config.d/50-sshd-local.conf owner: root group: root - mode: 0644 + mode: "0644" notify: "Restart ssh" when: - ansible_facts['distribution'] == "Debian" diff --git a/roles/common/tasks/sudoers-pc.yml b/roles/common/tasks/sudoers-pc.yml index 8eeaaff..e9053c2 100644 --- a/roles/common/tasks/sudoers-pc.yml +++ b/roles/common/tasks/sudoers-pc.yml @@ -7,7 +7,7 @@ validate: visudo -cf %s owner: root group: root - mode: 0440 + mode: "0440" tags: - sudoers-file-configuration @@ -17,12 +17,12 @@ dest: /etc/sudoers owner: root group: root - mode: 0440 + mode: "0440" validate: visudo -cf %s tags: - sudoers-global-configuration -#- name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group +# - name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group # user: # name: "{{ item }}" # groups: sudo @@ -32,7 +32,10 @@ # - sudo-users - name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group - shell: usermod -a -G sudo "{{ item }}" + ansible.builtin.user: + name: "{{ item }}" + groups: sudo + append: true with_items: "{{ sudo_pc_users }}" tags: - sudo-users diff --git a/roles/common/tasks/sudoers-server.yml b/roles/common/tasks/sudoers-server.yml index 97f27a6..5f1235c 100644 --- a/roles/common/tasks/sudoers-server.yml +++ b/roles/common/tasks/sudoers-server.yml @@ -1,6 +1,6 @@ --- -#- name: (sudoers-server.yml) include variables +# - name: (sudoers-server.yml) include variables # include_vars: "{{ item }}" # with_first_found: # - "sudoers-{{ inventory_hostname }}.yml" @@ -11,15 +11,15 @@ # - sudoers-remove # - sudoers-file-configuration # - sudoers-global-configuration - + - name: (sudoers-server.yml) Remove user entries in file /etc/sudoers - lineinfile: + ansible.builtin.lineinfile: dest: /etc/sudoers state: absent regexp: '^{{ item }}' owner: root group: root - mode: 0440 + mode: "0440" validate: visudo -cf %s with_items: '{{ sudoers_server_remove_user }}' tags: @@ -29,10 +29,10 @@ ansible.builtin.template: src: etc/sudoers.d/50-user.server.j2 dest: /etc/sudoers.d/50-user - #validate: visudo -cf %s + # validate: visudo -cf %s owner: root group: root - mode: 0440 + mode: "0440" tags: - sudoers-file-configuration @@ -42,16 +42,16 @@ dest: /etc/sudoers owner: root group: root - mode: 0440 - #validate: visudo -cf %s + mode: "0440" + # validate: visudo -cf %s tags: - sudoers-global-configuration - name: (sudoers-server.yml) Ensure all sudo_users are in sudo group - user: + ansible.builtin.user: name: "{{ item }}" groups: sudo - append: yes + append: true with_items: "{{ sudo_server_users }}" tags: - sudo-users diff --git a/roles/common/tasks/system-remove-user.yml b/roles/common/tasks/system-remove-user.yml index 97bff14..8340fe1 100644 --- a/roles/common/tasks/system-remove-user.yml +++ b/roles/common/tasks/system-remove-user.yml @@ -5,10 +5,10 @@ # --- - name: (system-remove-user.yml) Remove (old) users from system - user: + ansible.builtin.user: name: '{{ item.name }}' state: absent - with_items: + with_items: - "{{ remove_nis_users }}" loop_control: label: '{{ item.name }}' @@ -17,10 +17,10 @@ - system-user - name: (system-remove-user.yml) Remove home directory from deleted users - file: + ansible.builtin.file: path: '{{ nis_base_home }}/{{ item.name }}' state: absent - with_items: + with_items: - "{{ remove_nis_users }}" loop_control: label: '{{ item.name }}' diff --git a/roles/common/tasks/system-user-systemfiles.yml b/roles/common/tasks/system-user-systemfiles.yml index 26aaf6d..bc1d418 100644 --- a/roles/common/tasks/system-user-systemfiles.yml +++ b/roles/common/tasks/system-user-systemfiles.yml @@ -6,16 +6,22 @@ # system_user - name: (system-user-systemfiles.yml) Check if local template directory exists for default users - local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }} + ansible.builtin.stat: + path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}" + delegate_to: localhost + become: false with_items: "{{ system_users }}" loop_control: label: '{{ item.name }}' - register: local_template_dir_system_users + register: common_local_template_dir_system_users # root - name: (system-user-systemfiles.yml) Check if local template directory exists for root - local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root - register: local_template_dir_root + ansible.builtin.stat: + path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root" + delegate_to: localhost + become: false + register: common_local_template_dir_root # -- @@ -23,9 +29,9 @@ # --- - name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.profile.ORIG" - register: profile_user_orig_exists + register: common_profile_user_orig_exists loop: "{{ system_users }}" loop_control: label: '{{ item.name }}' @@ -33,12 +39,19 @@ - profile - name: (user-systemfiles.yml) Backup existing users .profile file - command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG - loop: "{{ profile_user_orig_exists.results }}" + ansible.builtin.copy: + src: "~{{ item.item.name }}/.profile" + dest: "~{{ item.item.name }}/.profile.ORIG" + remote_src: true + owner: "{{ item.item.name }}" + group: "{{ item.item.name }}" + mode: "0644" + force: false + loop: "{{ common_profile_user_orig_exists.results }}" loop_control: label: '{{ item.item.name }}' when: - - item.stat.exists == False + - not item.stat.exists tags: - profile @@ -49,17 +62,17 @@ delegate_to: localhost become: false loop: "{{ default_user }}" - register: profile_stats + register: common_profile_stats loop_control: label: "{{ item.name }}" # 2) Prüfe ob eine lokale default _baschrc existiert -- name: stat DEFAULT _profile +- name: Stat DEFAULT _profile ansible.builtin.stat: path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile" delegate_to: localhost become: false - register: default_profile_stat + register: common_default_profile_stat # 2) Falls User _profile vorhanden, kopieren - name: (system-user-systemfiles.yml) copy .profile if it exists @@ -70,7 +83,7 @@ group: "{{ user.name }}" mode: "0644" become: true - loop: "{{ default_user | zip(profile_stats.results) | list }}" + loop: "{{ default_user | zip(common_profile_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -89,12 +102,12 @@ group: "{{ user.name }}" mode: "0644" become: true - loop: "{{ default_user | zip(profile_stats.results) | list }}" + loop: "{{ default_user | zip(common_profile_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: - not stat_result.stat.exists - - default_profile_stat.stat.exists | bool + - common_default_profile_stat.stat.exists | bool vars: user: "{{ item.0 }}" stat_result: "{{ item.1 }}" @@ -105,15 +118,22 @@ # --- - name: (system-user-systemfiles.yml) Check if file '/root/.profile.ORIG' exists - stat: + ansible.builtin.stat: path: /root/.profile.ORIG - register: profile_root_orig_exists + register: common_profile_root_orig_exists tags: - bash - name: (system-user-systemfiles.yml) Backup /root/.profile file - command: cp /root/.profile /root/.profile.ORIG - when: profile_root_orig_exists.stat.exists == False + ansible.builtin.copy: + src: /root/.profile + dest: /root/.profile.ORIG + remote_src: true + owner: root + group: root + mode: "0644" + force: false + when: not common_profile_root_orig_exists.stat.exists tags: - bash @@ -123,10 +143,10 @@ path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile" delegate_to: localhost become: false - register: profile_root_stat + register: common_profile_root_stat # 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost -- name: copy root .profile if it exists +- name: Copy root .profile if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile" dest: /root/.profile @@ -134,7 +154,7 @@ group: root mode: '0644' become: true - when: profile_root_stat.stat.exists + when: common_profile_root_stat.stat.exists tags: - bash @@ -144,9 +164,9 @@ # --- - name: (system-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.bashrc.ORIG" - register: bashrc_user_orig_exists + register: common_bashrc_user_orig_exists loop: "{{ system_users }}" loop_control: label: '{{ item.name }}' @@ -154,11 +174,18 @@ - bashrc - name: (system-user-systemfiles.yml) Backup existing users .bashrc file - command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG - loop: "{{ bashrc_user_orig_exists.results }}" + ansible.builtin.copy: + src: "~{{ item.item.name }}/.bashrc" + dest: "~{{ item.item.name }}/.bashrc.ORIG" + remote_src: true + owner: "{{ item.item.name }}" + group: "{{ item.item.name }}" + mode: "0644" + force: false + loop: "{{ common_bashrc_user_orig_exists.results }}" loop_control: label: '{{ item.item.name }}' - when: item.stat.exists == False + when: not item.stat.exists tags: - bashrc @@ -169,17 +196,17 @@ delegate_to: localhost become: false loop: "{{ default_user }}" - register: bashrc_stats + register: common_bashrc_stats loop_control: label: "{{ item.name }}" # 2) Prüfe ob eine lokale default _baschrc existiert -- name: stat DEFAULT _bashrc +- name: Stat DEFAULT _bashrc ansible.builtin.stat: path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_bashrc" delegate_to: localhost become: false - register: default_bashrc_stat + register: common_default_bashrc_stat # 2) Falls User _bashrc vorhanden, kopieren - name: (system-user-systemfiles.yml) copy .bashrc if it exists @@ -190,7 +217,7 @@ group: "{{ user.name }}" mode: "0644" become: true - loop: "{{ default_user | zip(bashrc_stats.results) | list }}" + loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -209,12 +236,12 @@ group: "{{ user.name }}" mode: "0644" become: true - loop: "{{ default_user | zip(bashrc_stats.results) | list }}" + loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: - not stat_result.stat.exists - - default_bashrc_stat.stat.exists | bool + - common_default_bashrc_stat.stat.exists | bool vars: user: "{{ item.0 }}" stat_result: "{{ item.1 }}" @@ -225,28 +252,35 @@ # --- - name: (system-user-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists - stat: + ansible.builtin.stat: path: /root/.bashrc.ORIG - register: bashrc_root_orig_exists + register: common_bashrc_root_orig_exists tags: - bash - name: (system-user-systemfiles.yml) Backup /root/.bashrc file - command: cp /root/.bashrc /root/.bashrc.ORIG - when: bashrc_root_orig_exists.stat.exists == False + ansible.builtin.copy: + src: /root/.bashrc + dest: /root/.bashrc.ORIG + remote_src: true + owner: root + group: root + mode: "0644" + force: false + when: not common_bashrc_root_orig_exists.stat.exists tags: - bash # 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert -- name: stat root _bashrc on control node +- name: Stat root _bashrc on control node ansible.builtin.stat: path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc" delegate_to: localhost become: false - register: bashrc_root_stat + register: common_bashrc_root_stat # 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost -- name: copy root .bashrc if it exists +- name: Copy root .bashrc if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc" dest: /root/.bashrc @@ -254,7 +288,7 @@ group: root mode: '0644' become: true - when: bashrc_root_stat.stat.exists + when: common_bashrc_root_stat.stat.exists tags: - bash @@ -269,19 +303,19 @@ delegate_to: localhost become: false loop: "{{ default_user }}" - register: vimrc_stats + register: common_vimrc_stats loop_control: label: '{{ item.name }}' # 2. Falls vorhanden, Datei kopieren -- name: (system-user-systemfiles.yml) copy .vimrc if it exists +- name: (system-user-systemfiles.yml) Copy .vimrc if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_vimrc" dest: "~{{ user.name }}/.vimrc" owner: "{{ user.name }}" group: "{{ user.name }}" mode: '0644' - loop: "{{ default_user | zip(vimrc_stats.results) | list }}" + loop: "{{ default_user | zip(common_vimrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -300,7 +334,7 @@ delegate_to: localhost become: false loop: "{{ default_user }}" - register: dotvim_stats + register: common_dotvim_stats loop_control: label: "{{ item.name }}" @@ -312,7 +346,7 @@ dest: "~{{ user.name }}/" mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch become: true - loop: "{{ default_user | zip(dotvim_stats.results) | list }}" + loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -332,7 +366,7 @@ recurse: true state: directory become: true - loop: "{{ default_user | zip(dotvim_stats.results) | list }}" + loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}" loop_control: label: "{{ user.name }}" when: @@ -353,10 +387,10 @@ path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc" delegate_to: localhost become: false - register: vimrc_root_stat + register: common_vimrc_root_stat # 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost -- name: (system-user-systemfiles.yml)copy root .vimrc if it exists +- name: (system-user-systemfiles.yml) Copy root .vimrc if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc" dest: /root/.vimrc @@ -365,17 +399,17 @@ mode: '0644' become: true when: - - vimrc_root_stat.stat.exists + - common_vimrc_root_stat.stat.exists tags: - bash - # 1) Lokal prüfen, ob ./files/{{ nis_domain }}/homedirs/root/.vim existiert +# 1) Lokal prüfen, ob ./files/{{ nis_domain }}/homedirs/root/.vim existiert - name: (system-user-systemfiles.yml) stat local .vim for root ansible.builtin.stat: path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim" delegate_to: localhost become: false - register: root_dotvim_stat + register: common_root_dotvim_stat tags: [vim] @@ -387,11 +421,11 @@ mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen become: true when: - - root_dotvim_stat.stat.exists | bool + - common_root_dotvim_stat.stat.exists | bool tags: [vim] # 2) Wenn vorhanden, nach /root/ kopieren -#- name: (system-user-systemfiles.yml) rsync root .vim if it exists +# - name: (system-user-systemfiles.yml) rsync root .vim if it exists # ansible.posix.synchronize: # src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim/" # dest: "/root/.vim/" @@ -400,7 +434,7 @@ # rsync_path: "sudo -n rsync" # -n = kein Passwort-Prompt; erfordert NOPASSWD # delegate_to: localhost # when: -# - root_dotvim_stat.stat.exists | bool +# - common_root_dotvim_stat.stat.exists | bool # tags: [vim] # 3) Ownership sicherstellen (rekursiv) @@ -413,5 +447,5 @@ state: directory become: true when: - - root_dotvim_stat.stat.exists | bool + - common_root_dotvim_stat.stat.exists | bool tags: [vim] diff --git a/roles/common/tasks/system-user.yml b/roles/common/tasks/system-user.yml index ccaff32..ecc7b17 100644 --- a/roles/common/tasks/system-user.yml +++ b/roles/common/tasks/system-user.yml @@ -5,10 +5,10 @@ # --- - name: (user.yml) Remove (old) users from system - user: + ansible.builtin.user: name: '{{ item.name }}' state: absent - with_items: + with_items: - "{{ remove_system_users }}" loop_control: label: '{{ item.name }}' @@ -16,10 +16,10 @@ - system-user - name: (user.yml) Remove home directory from deleted users - file: + ansible.builtin.file: path: '{{ base_home }}/{{ item.name }}' state: absent - with_items: + with_items: - "{{ remove_system_users }}" loop_control: label: '{{ item.name }}' @@ -31,7 +31,7 @@ # --- - name: (user.yml) Ensure system groups exists - group: + ansible.builtin.group: name: '{{ item.name }}' state: present gid: '{{ item.group_id | default(omit) }}' @@ -42,17 +42,17 @@ notify: Renew nis databases tags: - system-user - -#- meta: end_host + +# - meta: end_host - name: (system-user.yml) Get database of nis (system) users - getent: + ansible.builtin.getent: database: passwd tags: - system-user - - name: (system-user.yml) Add (system) users if not yet exists.. - shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" + ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" + changed_when: true loop: "{{ system_users }}" loop_control: label: '{{ item.name }}' @@ -62,4 +62,3 @@ notify: Renew nis databases tags: - system-user - diff --git a/roles/common/tasks/systemd-resolved.yml b/roles/common/tasks/systemd-resolved.yml index ec28177..ed21e58 100644 --- a/roles/common/tasks/systemd-resolved.yml +++ b/roles/common/tasks/systemd-resolved.yml @@ -4,79 +4,73 @@ # Set some facts # --- -- name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list) - set_fact: - fact_resolved_nameserver: "{{ resolved_nameserver | join (' ') }}" +- name: (systemd-resolved.yml) Set common_fact_resolved_nameserver (blank separated list) + ansible.builtin.set_fact: + common_fact_resolved_nameserver: "{{ resolved_nameserver | join(' ') }}" when: - resolved_nameserver is defined and resolved_nameserver | length > 0 tags: - systemd-resolved -- name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list) - set_fact: - fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join (' ') }}" +- name: (systemd-resolved.yml) Set common_fact_resolved_fallback_nameserver (blank separated list) + ansible.builtin.set_fact: + common_fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join(' ') }}" when: - resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0 tags: - systemd-resolved -- name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list) - set_fact: - fact_resolved_domains: "{{ resolved_domains | join (' ') }}" +- name: (systemd-resolved.yml) Set common_fact_resolved_domains (blank separated list) + ansible.builtin.set_fact: + common_fact_resolved_domains: "{{ resolved_domains | join(' ') }}" when: - resolved_domains is defined and resolved_domains | length > 0 tags: - systemd-resolved - - # --- # Install/Enable systemd-resolved package # --- -- name: (systemd-resolved.yml) Ensure systemd-resolved package is installed. - package: +- name: (systemd-resolved.yml) Ensure systemd-resolved package is installed. + ansible.builtin.package: pkg: systemd-resolved state: present when: - - systemd_resolved is defined and systemd_resolved|bool + - systemd_resolved is defined and systemd_resolved | bool tags: - systemd-resolved -- name: (systemd-services.yml) Enable service - systemd: +- name: (systemd-services.yml) Enable systemd-resolved service + ansible.builtin.systemd: name: systemd-resolved enabled: true when: - - systemd_resolved is defined and systemd_resolved|bool + - systemd_resolved is defined and systemd_resolved | bool tags: - systemd-resolved - - # --- # Create configuration for systemd-resolved # --- - name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists - file: + ansible.builtin.file: path: /etc/systemd/resolved.conf.d state: directory - mode: 0755 + mode: "0755" group: root owner: root -- name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2 +- name: (systemd-resolved.yml) Create/update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' ansible.builtin.template: src: etc/systemd/resolved.conf.d/50-resolved-local.conf dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf owner: root group: root - mode: 0644 + mode: "0644" -- name: Restart systemd-resolved service +- name: (systemd-resolved.yml) Restart systemd-resolved service ansible.builtin.service: name: systemd-resolved state: restarted - - diff --git a/roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml b/roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml index 3541be4..1a3e455 100644 --- a/roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml +++ b/roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml @@ -1,55 +1,62 @@ --- - # Title: app-x11vnc-server - # - # Author: Luc Rutten - # Version: 1.0 - # File: tasks/main.yml - # - # Description: - # Remote support - # - # Source: - # - http://c-nergy.be/blog/?p=8984 +# Title: app-x11vnc-server +# +# Author: Luc Rutten +# Version: 1.0 +# File: tasks/main.yml +# +# Description: +# Remote support +# +# Source: +# - http://c-nergy.be/blog/?p=8984 - - name: "(ubuntu-x11vnc-1604-amd64.yml) check if x11vnc is already installed, if not found skipping...." - stat: - path: /usr/bin/x11vnc - register: x11vnc_active - - - name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages" - apt: - name: ['x11vnc'] - update_cache: yes - state: present - when: x11vnc_active.stat.exists == False +- name: "(ubuntu-x11vnc-1604-amd64.yml) Check if x11vnc is already installed, if not found skipping...." + ansible.builtin.stat: + path: /usr/bin/x11vnc + register: common_x11vnc_active - - name: "(ubuntu-x11vnc-1604-amd64.yml) Store password" - shell: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" +- name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages" + ansible.builtin.apt: + name: ['x11vnc'] + update_cache: true + state: present + when: not common_x11vnc_active.stat.exists - - name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass" - file: - path: /etc/x11vnc.pass - mode: 0644 +- name: "(ubuntu-x11vnc-1604-amd64.yml) Store password" + ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass + changed_when: true - - name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - ansible.builtin.template: - src: lib/systemd/system/x11vnc.service.j2 - dest: /lib/systemd/system/x11vnc.service +- name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass" + ansible.builtin.file: + path: /etc/x11vnc.pass + owner: root + group: root + mode: "0644" + state: file + +- name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" + ansible.builtin.template: + src: lib/systemd/system/x11vnc.service.j2 + dest: /lib/systemd/system/x11vnc.service + owner: root + group: root + mode: "0644" # - name: "(ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service" # shell: service x11vnc start - - name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service - service: - name: x11vnc - state: started +- name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service + ansible.builtin.service: + name: x11vnc + state: started - - name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot" - systemd: - name: x11vnc.service - daemon_reload: yes - enabled: yes - state: started +- name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot" + ansible.builtin.systemd: + name: x11vnc.service + daemon_reload: true + enabled: true + state: started # - name: "(ubuntu-x11vnc-1604-amd64.yml) Blocks x11vnc in GreenOS Desktop Environment for enduser " # file: @@ -57,4 +64,3 @@ # mode: 0740 # owner: root # group: administrator - diff --git a/roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml b/roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml index 5425eb2..128d34f 100644 --- a/roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml +++ b/roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml @@ -1,61 +1,68 @@ --- - # Title: app-x11vnc-server - # - # Author: Luc Rutten - # Version: 1.0 - # File: tasks/main.yml - # - # Description: - # Remote support - # - # Source: - # - http://c-nergy.be/blog/?p=8984 +# Title: app-x11vnc-server +# +# Author: Luc Rutten +# Version: 1.0 +# File: tasks/main.yml +# +# Description: +# Remote support +# +# Source: +# - http://c-nergy.be/blog/?p=8984 - - name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages" - apt: - name: "{{ packages }}" - update_cache: yes - state: present - vars: - packages: - - x11vnc +- name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages" + ansible.builtin.apt: + name: "{{ packages }}" + update_cache: true + state: present + vars: + packages: + - x11vnc - - name: "(ubuntu-x11vnc-1804-amd64.yml) get numeric id for group 'gdm'" - shell: echo "$(id -u gdm)" - register: grp_id_gdm +- name: "(ubuntu-x11vnc-1804-amd64.yml) Get numeric id for group 'gdm'" + ansible.builtin.command: id -u gdm + register: common_grp_id_gdm + changed_when: false - - name: Check if file '/etc/gdm3/custom.conf' exists - stat: - path: /etc/gdm3/custom.conf - register: etc_gdm_custom_conf_exists +- name: Check if file '/etc/gdm3/custom.conf' exists + ansible.builtin.stat: + path: /etc/gdm3/custom.conf + register: common_etc_gdm_custom_conf_exists - - name: Adjust file '/etc/gdm3/custom.conf' - lineinfile: - dest: /etc/gdm3/custom.conf - state: present - regexp: '^WaylandEnable' - line: 'WaylandEnable=false' - insertafter: '^#?\s*WaylandEnable' - when: - - etc_gdm_custom_conf_exists.stat.exists +- name: Adjust file '/etc/gdm3/custom.conf' + ansible.builtin.lineinfile: + dest: /etc/gdm3/custom.conf + state: present + regexp: '^WaylandEnable' + line: 'WaylandEnable=false' + insertafter: '^#?\s*WaylandEnable' + when: + - common_etc_gdm_custom_conf_exists.stat.exists - - name: "(ubuntu-x11vnc-1804-amd64.yml) Store password" - raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" +- name: "(ubuntu-x11vnc-1804-amd64.yml) Store password" + ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass + changed_when: true - - name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass" - file: - path: "/etc/x11vnc.pass" - mode: 0644 +- name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass" + ansible.builtin.file: + path: /etc/x11vnc.pass + owner: root + group: root + mode: "0644" + state: file - - name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - ansible.builtin.template: - src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2 - dest: /lib/systemd/system/x11vnc.service - - - name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service" - systemd: - name: x11vnc.service - daemon_reload: yes - enabled: yes - state: restarted +- name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" + ansible.builtin.template: + src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2 + dest: /lib/systemd/system/x11vnc.service + owner: root + group: root + mode: "0644" +- name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service" + ansible.builtin.systemd: + name: x11vnc.service + daemon_reload: true + enabled: true + state: restarted diff --git a/roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml b/roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml index 595b835..252dbce 100644 --- a/roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml +++ b/roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml @@ -1,66 +1,71 @@ --- - # Title: app-x11vnc-server - # - # Author: Luc Rutten - # Version: 1.0 - # File: tasks/main.yml - # - # Description: - # Remote support - # - # Source: - # - http://c-nergy.be/blog/?p=8984 +# Title: app-x11vnc-server +# +# Author: Luc Rutten +# Version: 1.0 +# File: tasks/main.yml +# +# Description: +# Remote support +# +# Source: +# - http://c-nergy.be/blog/?p=8984 - - name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages" - apt: - name: "{{ packages }}" - update_cache: yes - state: present - vars: - packages: - - x11vnc +- name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages" + ansible.builtin.apt: + name: "{{ packages }}" + update_cache: true + state: present + vars: + packages: + - x11vnc - - name: "(ubuntu-x11vnc-2004-amd64.yml) get numeric id for group 'gdm'" - shell: echo "$(id -u gdm)" - register: grp_id_gdm +- name: "(ubuntu-x11vnc-2004-amd64.yml) Get numeric id for group 'gdm'" + ansible.builtin.command: id -u gdm + register: common_grp_id_gdm + changed_when: false - - name: "(ubuntu-x11vnc-2004-amd64.yml) Store password" - raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" +- name: "(ubuntu-x11vnc-2004-amd64.yml) Store password" + ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass + changed_when: true - - name: Check if file '/etc/gdm3/custom.conf' exists - stat: - path: /etc/gdm3/custom.conf - register: etc_gdm_custom_conf_exists +- name: Check if file '/etc/gdm3/custom.conf' exists + ansible.builtin.stat: + path: /etc/gdm3/custom.conf + register: common_etc_gdm_custom_conf_exists - - name: Adjust file '/etc/gdm3/custom.conf' - lineinfile: - dest: /etc/gdm3/custom.conf - state: present - regexp: '^WaylandEnable' - line: 'WaylandEnable=false' - insertafter: '^#?\s*WaylandEnable' - when: - - etc_gdm_custom_conf_exists.stat.exists +- name: Adjust file '/etc/gdm3/custom.conf' + ansible.builtin.lineinfile: + dest: /etc/gdm3/custom.conf + state: present + regexp: '^WaylandEnable' + line: 'WaylandEnable=false' + insertafter: '^#?\s*WaylandEnable' + when: + - common_etc_gdm_custom_conf_exists.stat.exists +- name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass" + ansible.builtin.file: + path: /etc/x11vnc.pass + owner: root + group: root + mode: "0644" + state: file - - name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass" - file: - path: /etc/x11vnc.pass - owner: root - group: root - mode: 0644 +- name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" + ansible.builtin.template: + src: lib/systemd/system/x11vnc-gdm3.service.j2 + dest: /lib/systemd/system/x11vnc.service + owner: root + group: root + mode: "0644" - - name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - ansible.builtin.template: - src: lib/systemd/system/x11vnc-gdm3.service.j2 - dest: /lib/systemd/system/x11vnc.service - - - name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service" - systemd: - name: x11vnc.service - daemon_reload: yes - enabled: yes - state: restarted +- name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service" + ansible.builtin.systemd: + name: x11vnc.service + daemon_reload: true + enabled: true + state: restarted # - name: "(ubuntu-x11vnc-2004-amd64.yml) Remove whisker menu entry for allusers (except owner and group)" # file: @@ -68,4 +73,3 @@ # mode: 0750 # owner: root # group: root - diff --git a/roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml b/roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml index 7f32182..305f913 100644 --- a/roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml +++ b/roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml @@ -1,66 +1,71 @@ --- - # Title: app-x11vnc-server - # - # Author: Luc Rutten - # Version: 1.0 - # File: tasks/main.yml - # - # Description: - # Remote support - # - # Source: - # - http://c-nergy.be/blog/?p=8984 +# Title: app-x11vnc-server +# +# Author: Luc Rutten +# Version: 1.0 +# File: tasks/main.yml +# +# Description: +# Remote support +# +# Source: +# - http://c-nergy.be/blog/?p=8984 - - name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages" - apt: - name: "{{ packages }}" - update_cache: yes - state: present - vars: - packages: - - x11vnc +- name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages" + ansible.builtin.apt: + name: "{{ packages }}" + update_cache: true + state: present + vars: + packages: + - x11vnc - - name: "(ubuntu-x11vnc-2204-amd64.yml) get numeric id for group 'gdm'" - shell: echo "$(id -u gdm)" - register: grp_id_gdm +- name: "(ubuntu-x11vnc-2204-amd64.yml) Get numeric id for group 'gdm'" + ansible.builtin.command: id -u gdm + register: common_grp_id_gdm + changed_when: false - - name: "(ubuntu-x11vnc-2204-amd64.yml) Store password" - raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" +- name: "(ubuntu-x11vnc-2204-amd64.yml) Store password" + ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass + changed_when: true - - name: Check if file '/etc/gdm3/custom.conf' exists - stat: - path: /etc/gdm3/custom.conf - register: etc_gdm_custom_conf_exists +- name: Check if file '/etc/gdm3/custom.conf' exists + ansible.builtin.stat: + path: /etc/gdm3/custom.conf + register: common_etc_gdm_custom_conf_exists - - name: Adjust file '/etc/gdm3/custom.conf' - lineinfile: - dest: /etc/gdm3/custom.conf - state: present - regexp: '^WaylandEnable' - line: 'WaylandEnable=false' - insertafter: '^#?\s*WaylandEnable' - when: - - etc_gdm_custom_conf_exists.stat.exists +- name: Adjust file '/etc/gdm3/custom.conf' + ansible.builtin.lineinfile: + dest: /etc/gdm3/custom.conf + state: present + regexp: '^WaylandEnable' + line: 'WaylandEnable=false' + insertafter: '^#?\s*WaylandEnable' + when: + - common_etc_gdm_custom_conf_exists.stat.exists +- name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass" + ansible.builtin.file: + path: /etc/x11vnc.pass + owner: root + group: root + mode: "0644" + state: file - - name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass" - file: - path: /etc/x11vnc.pass - owner: root - group: root - mode: 0644 +- name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" + ansible.builtin.template: + src: lib/systemd/system/x11vnc-gdm3.service.j2 + dest: /lib/systemd/system/x11vnc.service + owner: root + group: root + mode: "0644" - - name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - ansible.builtin.template: - src: lib/systemd/system/x11vnc-gdm3.service.j2 - dest: /lib/systemd/system/x11vnc.service - - - name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service" - systemd: - name: x11vnc.service - daemon_reload: yes - enabled: yes - state: restarted +- name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service" + ansible.builtin.systemd: + name: x11vnc.service + daemon_reload: true + enabled: true + state: restarted # - name: "(ubuntu-x11vnc-2204-amd64.yml) Remove whisker menu entry for allusers (except owner and group)" # file: @@ -68,4 +73,3 @@ # mode: 0750 # owner: root # group: root - diff --git a/roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml b/roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml index b2d4ad2..78a271d 100644 --- a/roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml +++ b/roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml @@ -1,66 +1,71 @@ --- - # Title: app-x11vnc-server - # - # Author: Luc Rutten - # Version: 1.0 - # File: tasks/main.yml - # - # Description: - # Remote support - # - # Source: - # - http://c-nergy.be/blog/?p=8984 +# Title: app-x11vnc-server +# +# Author: Luc Rutten +# Version: 1.0 +# File: tasks/main.yml +# +# Description: +# Remote support +# +# Source: +# - http://c-nergy.be/blog/?p=8984 - - name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages" - apt: - name: "{{ packages }}" - update_cache: yes - state: present - vars: - packages: - - x11vnc +- name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages" + ansible.builtin.apt: + name: "{{ packages }}" + update_cache: true + state: present + vars: + packages: + - x11vnc - - name: "(ubuntu-x11vnc-2404-amd64.yml) get numeric id for group 'gdm'" - shell: echo "$(id -u gdm)" - register: grp_id_gdm +- name: "(ubuntu-x11vnc-2404-amd64.yml) Get numeric id for group 'gdm'" + ansible.builtin.command: id -u gdm + register: common_grp_id_gdm + changed_when: false - - name: "(ubuntu-x11vnc-2404-amd64.yml) Store password" - raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" +- name: "(ubuntu-x11vnc-2404-amd64.yml) Store password" + ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass + changed_when: true - - name: Check if file '/etc/gdm3/custom.conf' exists - stat: - path: /etc/gdm3/custom.conf - register: etc_gdm_custom_conf_exists +- name: Check if file '/etc/gdm3/custom.conf' exists + ansible.builtin.stat: + path: /etc/gdm3/custom.conf + register: common_etc_gdm_custom_conf_exists - - name: Adjust file '/etc/gdm3/custom.conf' - lineinfile: - dest: /etc/gdm3/custom.conf - state: present - regexp: '^WaylandEnable' - line: 'WaylandEnable=false' - insertafter: '^#?\s*WaylandEnable' - when: - - etc_gdm_custom_conf_exists.stat.exists +- name: Adjust file '/etc/gdm3/custom.conf' + ansible.builtin.lineinfile: + dest: /etc/gdm3/custom.conf + state: present + regexp: '^WaylandEnable' + line: 'WaylandEnable=false' + insertafter: '^#?\s*WaylandEnable' + when: + - common_etc_gdm_custom_conf_exists.stat.exists +- name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass" + ansible.builtin.file: + path: /etc/x11vnc.pass + owner: root + group: root + mode: "0644" + state: file - - name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass" - file: - path: /etc/x11vnc.pass - owner: root - group: root - mode: 0644 +- name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" + ansible.builtin.template: + src: lib/systemd/system/x11vnc-gdm3.service.j2 + dest: /lib/systemd/system/x11vnc.service + owner: root + group: root + mode: "0644" - - name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - ansible.builtin.template: - src: lib/systemd/system/x11vnc-gdm3.service.j2 - dest: /lib/systemd/system/x11vnc.service - - - name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service" - systemd: - name: x11vnc.service - daemon_reload: yes - enabled: yes - state: restarted +- name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service" + ansible.builtin.systemd: + name: x11vnc.service + daemon_reload: true + enabled: true + state: restarted # - name: "(ubuntu-x11vnc-2404-amd64.yml) Remove whisker menu entry for allusers (except owner and group)" # file: @@ -68,4 +73,3 @@ # mode: 0750 # owner: root # group: root - diff --git a/roles/common/templates/etc/ssh/sshd_config.j2 b/roles/common/templates/etc/ssh/sshd_config.j2 index 2b85304..4398592 100644 --- a/roles/common/templates/etc/ssh/sshd_config.j2 +++ b/roles/common/templates/etc/ssh/sshd_config.j2 @@ -177,8 +177,8 @@ HostbasedAuthentication no # The allow/deny directives are processed in the following order: DenyUsers, # AllowUsers, DenyGroups, and finally AllowGroups. # By default, login is allowed for all users. -{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %} -AllowUsers {{ fact_sshd_allowed_users }} +{% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %} +AllowUsers {{ common_fact_sshd_allowed_users }} {% else %} #AllowUsers back chris sysadm cityslang christoph {% endif %} @@ -239,8 +239,8 @@ UsePAM {{ sshd_use_pam }} # # The list of available key exchange algorithms may also be obtained using "ssh -Q kex". # -{% if (fact_sshd_kexalgorithms is defined) and fact_sshd_kexalgorithms %} -KexAlgorithms {{ fact_sshd_kexalgorithms }} +{% if (common_fact_sshd_kexalgorithms is defined) and common_fact_sshd_kexalgorithms %} +KexAlgorithms {{ common_fact_sshd_kexalgorithms }} {% else %} #KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1 {% endif %} @@ -273,8 +273,8 @@ KexAlgorithms {{ fact_sshd_kexalgorithms }} # # The list of available ciphers may also be obtained using "ssh -Q cipher". # -{% if (fact_sshd_ciphers is defined) and fact_sshd_ciphers %} -Ciphers {{ fact_sshd_ciphers }} +{% if (common_fact_sshd_ciphers is defined) and common_fact_sshd_ciphers %} +Ciphers {{ common_fact_sshd_ciphers }} {% else %} #Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr {% endif %} @@ -317,8 +317,8 @@ Ciphers {{ fact_sshd_ciphers }} # # The list of available MAC algorithms may also be obtained using "ssh -Q mac". # -{% if (fact_sshd_macs is defined) and fact_sshd_macs %} -MACs {{ fact_sshd_macs }} +{% if (common_fact_sshd_macs is defined) and common_fact_sshd_macs %} +MACs {{ common_fact_sshd_macs }} {% else %} #MACs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,mac-sha2-256,hmac-sha2-512,hmac-sha1 {% endif %} @@ -337,8 +337,8 @@ MACs {{ fact_sshd_macs }} # ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa # # The list of available key types may also be obtained using "ssh -Q key". -{% if (fact_sshd_hostkeyalgorithms is defined) and fact_sshd_hostkeyalgorithms %} -HostKeyAlgorithms {{ fact_sshd_hostkeyalgorithms }} +{% if (common_fact_sshd_hostkeyalgorithms is defined) and common_fact_sshd_hostkeyalgorithms %} +HostKeyAlgorithms {{ common_fact_sshd_hostkeyalgorithms }} {% endif %} diff --git a/roles/common/templates/etc/ssh/sshd_config.ubuntu.j2 b/roles/common/templates/etc/ssh/sshd_config.ubuntu.j2 index 83df11f..2ba1bc0 100644 --- a/roles/common/templates/etc/ssh/sshd_config.ubuntu.j2 +++ b/roles/common/templates/etc/ssh/sshd_config.ubuntu.j2 @@ -171,8 +171,8 @@ HostbasedAuthentication no # The allow/deny directives are processed in the following order: DenyUsers, # AllowUsers, DenyGroups, and finally AllowGroups. # By default, login is allowed for all users. -{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %} -AllowUsers {{ fact_sshd_allowed_users }} +{% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %} +AllowUsers {{ common_fact_sshd_allowed_users }} {% else %} #AllowUsers back chris sysadm cityslang christoph {% endif %} diff --git a/roles/common/templates/etc/systemd/resolved.conf.d/50-resolved-local.conf b/roles/common/templates/etc/systemd/resolved.conf.d/50-resolved-local.conf index f5167c5..32dce66 100644 --- a/roles/common/templates/etc/systemd/resolved.conf.d/50-resolved-local.conf +++ b/roles/common/templates/etc/systemd/resolved.conf.d/50-resolved-local.conf @@ -5,20 +5,20 @@ # *** ---------------------------------------------- *** [Resolve] -{% if (fact_resolved_nameserver is defined) and fact_resolved_nameserver %} -DNS={{ fact_resolved_nameserver}} +{% if (common_fact_resolved_nameserver is defined) and common_fact_resolved_nameserver %} +DNS={{ common_fact_resolved_nameserver }} {% else %} #DNS= {% endif -%} -{% if (fact_resolved_fallback_nameserver is defined) and fact_resolved_fallback_nameserver %} -FallbackDNS={{ fact_resolved_fallback_nameserver }} +{% if (common_fact_resolved_fallback_nameserver is defined) and common_fact_resolved_fallback_nameserver %} +FallbackDNS={{ common_fact_resolved_fallback_nameserver }} {% else %} #FallbackDNS= {% endif -%} -{% if (fact_resolved_domains is defined) and fact_resolved_domains %} -Domains={{ fact_resolved_domains }} +{% if (common_fact_resolved_domains is defined) and common_fact_resolved_domains %} +Domains={{ common_fact_resolved_domains }} {% else %} #Domains= {% endif -%}