ansible/nis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor Ansible tasks and templates for improved consistency and clarity

Browse Source
This commit is contained in:
Christoph
2026-07-31 02:24:42 +02:00
parent 81ef678904
commit 46327da2ac
52 changed files with 1679 additions and 1461 deletions
Download Patch File Download Diff File Expand all files Collapse all files
group_vars/akb.yml
-1
View File
@@ -689,4 +689,3 @@ sudo_pc_users:
# ========== # ==========
# vars used by roles/common/tasks/luks.yml # vars used by roles/common/tasks/luks.yml
# ========== # ==========
group_vars/flr.yml
-5
View File
@@ -133,14 +133,10 @@ resolved_dnssec: false
resolved_fallback_nameserver: resolved_fallback_nameserver:
- 172.16.102.254 - 172.16.102.254
# ========== # ==========
# vars used by roles/common/tasks/git.yml # vars used by roles/common/tasks/git.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/ntp.yml # vars used by roles/common/tasks/ntp.yml
# ========== # ==========
@@ -634,4 +630,3 @@ sudo_pc_users:
# ========== # ==========
# vars used by roles/common/tasks/luks.yml # vars used by roles/common/tasks/luks.yml
# ========== # ==========
group_vars/kb.yml
-8
View File
@@ -149,8 +149,6 @@ nfs_exports:
use_fsid_option: true use_fsid_option: true
# ========== # ==========
# vars used by roles/common/tasks/system-user.yml # vars used by roles/common/tasks/system-user.yml
# ========== # ==========
@@ -204,7 +202,6 @@ nis_groups:
group_id: 1200 group_id: 1200
# nis_groups: # nis_groups:
# - name: mbr-finanzen (wird zu vdk) # - name: mbr-finanzen (wird zu vdk)
# group_id: 1210 # group_id: 1210
@@ -309,7 +306,6 @@ nis_user:
password: '' password: ''
# ========== # ==========
# vars used by roles/common/tasks/samba-install.yml # vars used by roles/common/tasks/samba-install.yml
# ========== # ==========
@@ -348,7 +344,6 @@ samba_netbios_name: FILE-KB
samba_server_min_protocol: !!str "NT1" samba_server_min_protocol: !!str "NT1"
samba_shares: samba_shares:
# --- # ---
@@ -428,8 +423,6 @@ samba_shares:
recycle_path: '@Recycle.Bin' recycle_path: '@Recycle.Bin'
# ========== # ==========
# vars used by roles/common/tasks/system-user-systemfiles.yml # vars used by roles/common/tasks/system-user-systemfiles.yml
# ========== # ==========
@@ -477,4 +470,3 @@ sudo_pc_users:
# ========== # ==========
# vars used by roles/common/tasks/luks.yml # vars used by roles/common/tasks/luks.yml
# ========== # ==========
group_vars/mbr.yml
+138 -172
View File
@@ -3,30 +3,24 @@
# ========== # ==========
# vars used by roles/common/tasks/basic.yml # vars used by roles/common/tasks/basic.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/sshd.yml # vars used by roles/common/tasks/sshd.yml
# ========== # ==========
sshd_permit_root_login: !!str "prohibit-password" sshd_permit_root_login: !!str "prohibit-password"
# ========== # ==========
# vars used by roles/common/tasks/apt.yml # vars used by roles/common/tasks/apt.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/git.yml # vars used by roles/common/tasks/git.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/cups-install.yml # vars used by roles/common/tasks/cups-install.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/ntp.yml # vars used by roles/common/tasks/ntp.yml
# ========== # ==========
@@ -35,7 +29,6 @@ sshd_permit_root_login: !!str "prohibit-password"
# #
ntp_server: gw-mbr.mbr-bln.netz ntp_server: gw-mbr.mbr-bln.netz
# ========== # ==========
# vars used by roles/common/tasks/nfs.yml # vars used by roles/common/tasks/nfs.yml
# ========== # ==========
@@ -73,7 +66,6 @@ nfs_exports:
- 192.168.63.0/24 - 192.168.63.0/24
use_fsid_option: true use_fsid_option: true
# ========== # ==========
# vars used by roles/common/tasks/system-user.yml # vars used by roles/common/tasks/system-user.yml
# ========== # ==========
@@ -96,17 +88,14 @@ system_users: []
# password: '9xFXkdPR_2' # password: '9xFXkdPR_2'
system_groups: [] system_groups: []
base_home: /data/home base_home: /data/home
# ========== # ==========
# vars used by roles/common/tasks/nis-install-server.yml # vars used by roles/common/tasks/nis-install-server.yml
# vars used by roles/common/tasks/nis-user.yml # vars used by roles/common/tasks/nis-user.yml
# vars used by roles/common/tasks/nis-install-client.yml # vars used by roles/common/tasks/nis-install-client.yml
# ========== # ==========
# used by templates # used by templates
# - yp.conf.j2 # - yp.conf.j2
# - defaultdomain.j2 # - defaultdomain.j2
@@ -166,8 +155,6 @@ nis_groups:
- name: projektleitung - name: projektleitung
group_id: 2200 group_id: 2200
# !! Don't forgrt to delete also user konfiguration in this file !! # !! Don't forgrt to delete also user konfiguration in this file !!
# ================================================================= # =================================================================
# #
@@ -217,7 +204,6 @@ nis_groups:
# - name: vanessa.gelardo # - name: vanessa.gelardo
nis_user: nis_user:
- name: chris - name: chris
groups: groups:
- technik - technik
@@ -300,19 +286,19 @@ nis_user:
- direx - direx
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'KPk_Wf2F' password: "KPk_Wf2F"
- name: axis - name: axis
groups: groups:
- mbr-kamera - mbr-kamera
is_samba_user: true is_samba_user: true
password: '20_axis_16' password: "20_axis_16"
- name: scan - name: scan
groups: groups:
- buero-scan - buero-scan
is_samba_user: true is_samba_user: true
password: '20scan13' password: "20scan13"
# --- # ---
# Technik # Technik
@@ -324,7 +310,7 @@ nis_user:
- buero-scan - buero-scan
- technik - technik
is_samba_user: true is_samba_user: true
password: 'GYiI3-s/_7wG' password: "GYiI3-s/_7wG"
# --- # ---
# Verwaltung # Verwaltung
@@ -346,7 +332,7 @@ nis_user:
- regishut - regishut
- regishut-personal-finanzen - regishut-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'YA!LiLiC0MP5' password: "YA!LiLiC0MP5"
- name: bianca - name: bianca
groups: groups:
@@ -369,7 +355,7 @@ nis_user:
- direx - direx
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: '73_BiBole_29' password: "73_BiBole_29"
- name: birgit.erhardt - name: birgit.erhardt
groups: groups:
@@ -384,7 +370,7 @@ nis_user:
- rias-berlin - rias-berlin
- rias-berlin-finanzen-personal - rias-berlin-finanzen-personal
is_samba_user: true is_samba_user: true
password: '20_purpel!rain_17' password: "20_purpel!rain_17"
- name: christina.wendt - name: christina.wendt
groups: groups:
@@ -405,7 +391,7 @@ nis_user:
- direx-personal-finanzen - direx-personal-finanzen
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: '8!Varianten' password: "8!Varianten"
- name: hendrik.roth - name: hendrik.roth
groups: groups:
@@ -417,7 +403,7 @@ nis_user:
- regishut-personal-finanzen - regishut-personal-finanzen
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'H-S.tG3/wV46' password: "H-S.tG3/wV46"
- name: janine.budich - name: janine.budich
groups: groups:
@@ -441,7 +427,7 @@ nis_user:
- direx-personal-finanzen - direx-personal-finanzen
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: 'LoS_r3f_20_AS!' password: "LoS_r3f_20_AS!"
- name: luise.schirmer - name: luise.schirmer
groups: groups:
@@ -452,7 +438,7 @@ nis_user:
- direx - direx
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'AfZg3-9S/4IX' password: "AfZg3-9S/4IX"
- name: olga.masson - name: olga.masson
groups: groups:
@@ -464,7 +450,7 @@ nis_user:
- regishut-personal-finanzen - regishut-personal-finanzen
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: '6.7.mQ-sPE.o' password: "6.7.mQ-sPE.o"
- name: swetlana.nikitenko - name: swetlana.nikitenko
groups: groups:
@@ -479,7 +465,7 @@ nis_user:
- regishut-personal-finanzen - regishut-personal-finanzen
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'Ji53-dA.nwGz' password: "Ji53-dA.nwGz"
# --- # ---
# BgN # BgN
@@ -492,7 +478,7 @@ nis_user:
- bgn - bgn
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'LSr-tjo.U73V' password: "LSr-tjo.U73V"
- name: daniel.weber - name: daniel.weber
groups: groups:
@@ -502,7 +488,7 @@ nis_user:
- bgn-finanzen-personal - bgn-finanzen-personal
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'KQ+y-+9s/aL4' password: "KQ+y-+9s/aL4"
- name: karim.khan - name: karim.khan
groups: groups:
@@ -513,7 +499,7 @@ nis_user:
- bgn-finanzen-personal - bgn-finanzen-personal
- technik - technik
is_samba_user: true is_samba_user: true
password: 'g6Gb/J.fZU9F' password: "g6Gb/J.fZU9F"
- name: katja.teich - name: katja.teich
groups: groups:
@@ -524,7 +510,7 @@ nis_user:
- mbr-buero - mbr-buero
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: 'C+j3.w5.NJCI' password: "C+j3.w5.NJCI"
- name: katrin.breston - name: katrin.breston
groups: groups:
@@ -537,14 +523,14 @@ nis_user:
- vdk - vdk
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: 'nA-y.I6ReJ-M' password: "nA-y.I6ReJ-M"
- name: praktikum.bgn1 - name: praktikum.bgn1
groups: groups:
- all-users - all-users
- buero-scan - buero-scan
is_samba_user: true is_samba_user: true
password: 'MPL_baerin_20!' password: "MPL_baerin_20!"
- name: stephanie.kammler - name: stephanie.kammler
groups: groups:
@@ -558,7 +544,7 @@ nis_user:
- rias-berlin-finanzen-personal - rias-berlin-finanzen-personal
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'u-hw7.IMoQut' password: "u-hw7.IMoQut"
# - mbr-buero # - mbr-buero
# - bgn # - bgn
@@ -577,9 +563,7 @@ nis_user:
- bgn-finanzen-personal - bgn-finanzen-personal
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'ALL3_e6ene#' password: "ALL3_e6ene#"
# --- # ---
# BMB # BMB
@@ -607,7 +591,7 @@ nis_user:
- direx-personal-finanzen - direx-personal-finanzen
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: '5xp5ll9ar13us!' password: "5xp5ll9ar13us!"
- name: doku.mbr2 - name: doku.mbr2
groups: groups:
@@ -615,7 +599,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: '*M0ss4d*' password: "*M0ss4d*"
- name: doku.mbr4 - name: doku.mbr4
groups: groups:
@@ -623,7 +607,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'PwmNvPh9KM4T' password: "PwmNvPh9KM4T"
- name: doku.mbr5 - name: doku.mbr5
groups: groups:
@@ -632,7 +616,7 @@ nis_user:
- betriebsrat - betriebsrat
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'G6Hz.ev/e24E' password: "G6Hz.ev/e24E"
- name: doku.mbr6 - name: doku.mbr6
groups: groups:
@@ -640,7 +624,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'RIm/-f6.7.wa' password: "RIm/-f6.7.wa"
- name: doku.mbr7 - name: doku.mbr7
groups: groups:
@@ -648,7 +632,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'T-uSXk.79.vN' password: "T-uSXk.79.vN"
- name: florian.heuermann - name: florian.heuermann
groups: groups:
@@ -657,7 +641,7 @@ nis_user:
- mbr-buero - mbr-buero
- technik - technik
is_samba_user: true is_samba_user: true
password: 'i4/x3S-TJk.P' password: "i4/x3S-TJk.P"
- name: franziska.schilling - name: franziska.schilling
groups: groups:
@@ -665,7 +649,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'L.35c-CgvZn3' password: "L.35c-CgvZn3"
- name: honorar.mbr1 - name: honorar.mbr1
groups: groups:
@@ -674,7 +658,7 @@ nis_user:
- mbr-buero - mbr-buero
- direx - direx
is_samba_user: true is_samba_user: true
password: '_F313r4b3nd*' password: "_F313r4b3nd*"
- name: honorar.mbr2 - name: honorar.mbr2
groups: groups:
@@ -682,7 +666,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'kQviLU-4rA_2' password: "kQviLU-4rA_2"
- name: ljiljana.heise - name: ljiljana.heise
groups: groups:
@@ -690,7 +674,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'Ib_k/c75W-u6' password: "Ib_k/c75W-u6"
- name: judith.heinmueller - name: judith.heinmueller
groups: groups:
@@ -698,7 +682,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 't32_aHxV.' password: "t32_aHxV."
- name: katharina.mueller - name: katharina.mueller
groups: groups:
@@ -706,7 +690,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: '6.3b-5Vy/7-3' password: "6.3b-5Vy/7-3"
- name: kathrin.hain - name: kathrin.hain
groups: groups:
@@ -715,7 +699,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'H/T3X_3M_c9R' password: "H/T3X_3M_c9R"
- name: kerstin.kuballa - name: kerstin.kuballa
groups: groups:
@@ -725,7 +709,7 @@ nis_user:
- mbr-buero - mbr-buero
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'sVY2_2t+a+db' password: "sVY2_2t+a+db"
- name: laura.poerzgen - name: laura.poerzgen
groups: groups:
@@ -735,7 +719,7 @@ nis_user:
- mbr-buero - mbr-buero
- regishut - regishut
is_samba_user: true is_samba_user: true
password: 's9U.3xo-5Vq6' password: "s9U.3xo-5Vq6"
- name: manja.kasten - name: manja.kasten
groups: groups:
@@ -744,7 +728,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'Rasili_&n' password: "Rasili_&n"
- name: mathias - name: mathias
groups: groups:
@@ -753,7 +737,7 @@ nis_user:
- ag-antisem - ag-antisem
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'p3r*45p3r4*4d*45tr4m' password: "p3r*45p3r4*4d*45tr4m"
- name: matthias.mueller - name: matthias.mueller
groups: groups:
@@ -763,7 +747,7 @@ nis_user:
- mbr-buero - mbr-buero
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: 'V1v@H@f3rdr1nk' password: "V1v@H@f3rdr1nk"
- name: nazanin.bakhschy - name: nazanin.bakhschy
groups: groups:
@@ -772,7 +756,7 @@ nis_user:
- mbr-buero - mbr-buero
- technik - technik
is_samba_user: true is_samba_user: true
password: 'I.E7X.cUd-cc' password: "I.E7X.cUd-cc"
- name: nina.rink - name: nina.rink
groups: groups:
@@ -781,21 +765,21 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'BMW_mobit_2020!' password: "BMW_mobit_2020!"
- name: praktikum.mbr1 - name: praktikum.mbr1
groups: groups:
- all-users - all-users
- buero-scan - buero-scan
is_samba_user: true is_samba_user: true
password: '2001_RAT_urban!' password: "2001_RAT_urban!"
- name: praktikum.mbr2 - name: praktikum.mbr2
groups: groups:
- all-users - all-users
- buero-scan - buero-scan
is_samba_user: true is_samba_user: true
password: '20praktikum213' password: "20praktikum213"
# - name: samuel.signer # - name: samuel.signer
# groups: # groups:
@@ -813,7 +797,7 @@ nis_user:
- betriebsrat - betriebsrat
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'S4u3rkr4ut!' password: "S4u3rkr4ut!"
- name: stefan.jung - name: stefan.jung
groups: groups:
@@ -821,7 +805,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'q9.mL5-a-aYA' password: "q9.mL5-a-aYA"
- name: tirza.seene - name: tirza.seene
groups: groups:
@@ -829,7 +813,7 @@ nis_user:
- buero-scan - buero-scan
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: '7a9-7Rz-Rc2p' password: "7a9-7Rz-Rc2p"
# --- # ---
# RIAS Berlin und Bund # RIAS Berlin und Bund
@@ -846,7 +830,7 @@ nis_user:
- rias-berlin - rias-berlin
- rias-berlin-finanzen-personal - rias-berlin-finanzen-personal
is_samba_user: true is_samba_user: true
password: 'C2-0U#ch' password: "C2-0U#ch"
- name: christiane.ketteler - name: christiane.ketteler
groups: groups:
@@ -854,7 +838,7 @@ nis_user:
- buero-scan - buero-scan
- rias-berlin - rias-berlin
is_samba_user: true is_samba_user: true
password: 'y_P.ev.azy47' password: "y_P.ev.azy47"
- name: christian.obermueller - name: christian.obermueller
groups: groups:
@@ -863,7 +847,7 @@ nis_user:
- ag-antisem - ag-antisem
- rias-berlin - rias-berlin
is_samba_user: true is_samba_user: true
password: 'i6...rs2ILRn' password: "i6...rs2ILRn"
- name: jonas.empen - name: jonas.empen
groups: groups:
@@ -871,7 +855,7 @@ nis_user:
- buero-scan - buero-scan
- rias-berlin - rias-berlin
is_samba_user: true is_samba_user: true
password: 'GN-E.fd6w6n%' password: "GN-E.fd6w6n%"
- name: julia.kopp - name: julia.kopp
groups: groups:
@@ -883,7 +867,7 @@ nis_user:
- rias-berlin-finanzen-personal - rias-berlin-finanzen-personal
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: '-a2%3bTzkW.A' password: "-a2%3bTzkW.A"
- name: memphis.krickeberg - name: memphis.krickeberg
groups: groups:
@@ -891,7 +875,7 @@ nis_user:
- buero-scan - buero-scan
- rias-berlin - rias-berlin
is_samba_user: true is_samba_user: true
password: '6-K/F9uf/75u' password: "6-K/F9uf/75u"
- name: ruth.hatlapa - name: ruth.hatlapa
groups: groups:
@@ -903,7 +887,7 @@ nis_user:
- rias-berlin - rias-berlin
- rias-berlin-finanzen-personal - rias-berlin-finanzen-personal
is_samba_user: true is_samba_user: true
password: 'q2Sc.C7-6hZR' password: "q2Sc.C7-6hZR"
- name: sophie.tadeus - name: sophie.tadeus
groups: groups:
@@ -911,7 +895,7 @@ nis_user:
- buero-scan - buero-scan
- rias-berlin - rias-berlin
is_samba_user: true is_samba_user: true
password: '3.5.JQby/ubw' password: "3.5.JQby/ubw"
- name: steffen.klaevers - name: steffen.klaevers
groups: groups:
@@ -919,8 +903,7 @@ nis_user:
- buero-scan - buero-scan
- rias-berlin - rias-berlin
is_samba_user: true is_samba_user: true
password: 'pRU.g5W5h-rY' password: "pRU.g5W5h-rY"
# --- # ---
# Regishut # Regishut
@@ -934,7 +917,7 @@ nis_user:
- regishut - regishut
- regishut-personal-finanzen - regishut-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'R3GI_20_poliz_!' password: "R3GI_20_poliz_!"
- name: christin.sommerfeld - name: christin.sommerfeld
groups: groups:
@@ -946,7 +929,7 @@ nis_user:
- direx-personal-finanzen - direx-personal-finanzen
- projektleitung - projektleitung
is_samba_user: true is_samba_user: true
password: 'bbMIQ.3/gZ3s' password: "bbMIQ.3/gZ3s"
- name: lilith.daxner - name: lilith.daxner
groups: groups:
@@ -955,7 +938,7 @@ nis_user:
- buero-scan - buero-scan
- regishut - regishut
is_samba_user: true is_samba_user: true
password: 'n2Ud7kwA-M-c' password: "n2Ud7kwA-M-c"
- name: mischa.luy - name: mischa.luy
groups: groups:
@@ -967,7 +950,7 @@ nis_user:
- technik - technik
- direx-personal-finanzen - direx-personal-finanzen
is_samba_user: true is_samba_user: true
password: 'V-V3/2usuzjq' password: "V-V3/2usuzjq"
- name: sebastian.beer - name: sebastian.beer
groups: groups:
@@ -976,8 +959,7 @@ nis_user:
- regishut - regishut
- technik - technik
is_samba_user: true is_samba_user: true
password: '7A2i-Iz.mUHz' password: "7A2i-Iz.mUHz"
# --- # ---
# DiRex # DiRex
@@ -990,7 +972,7 @@ nis_user:
- direx - direx
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'VVLvkmH.r5-q' password: "VVLvkmH.r5-q"
- name: lisa.wildenhain - name: lisa.wildenhain
groups: groups:
@@ -999,12 +981,10 @@ nis_user:
- direx - direx
- mbr-buero - mbr-buero
is_samba_user: true is_samba_user: true
password: 'RmMq-3Z--2.2' password: "RmMq-3Z--2.2"
samba_homes_virusfilter: true samba_homes_virusfilter: true
# ========== # ==========
# vars used by roles/common/tasks/samba-install.yml # vars used by roles/common/tasks/samba-install.yml
# ========== # ==========
@@ -1013,7 +993,6 @@ samba_server: file-mbr.mbr-bln.netz
samba_server_ip: 192.168.112.10 samba_server_ip: 192.168.112.10
samba_server_cidr_prefix: 24 samba_server_cidr_prefix: 24
# ========== # ==========
# vars used by roles/common/tasks/samba-user.yml # vars used by roles/common/tasks/samba-user.yml
# ========== # ==========
@@ -1026,7 +1005,6 @@ samba_server_cidr_prefix: 24
# - remove_nis_users: roles/common/tasks/nis-install-server.yml # - remove_nis_users: roles/common/tasks/nis-install-server.yml
# - nis_user: roles/common/tasks/nis-install-server.yml # - nis_user: roles/common/tasks/nis-install-server.yml
# ========== # ==========
# vars used by roles/common/tasks/mount_samba_shares.yml # vars used by roles/common/tasks/mount_samba_shares.yml
# ========== # ==========
@@ -1040,10 +1018,7 @@ samba_server_cidr_prefix: 24
samba_workgroup: MBR samba_workgroup: MBR
samba_netbios_name: FILE-MBR samba_netbios_name: FILE-MBR
samba_shares: samba_shares:
# --- # ---
# Bürogemeinschaft # Bürogemeinschaft
# --- # ---
@@ -1052,33 +1027,33 @@ samba_shares:
path: /data/shares/Buero-Organisation path: /data/shares/Buero-Organisation
group_valid_users: all-users group_valid_users: all-users
group_write_list: all-users group_write_list: all-users
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Install - name: Install
path: /data/shares/Install path: /data/shares/Install
group_valid_users: mbr-admins group_valid_users: mbr-admins
group_write_list: mbr-admins group_write_list: mbr-admins
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
- name: Kamera - name: Kamera
path: /data/shares/Kamera path: /data/shares/Kamera
group_valid_users: mbr-kamera group_valid_users: mbr-kamera
group_write_list: mbr-kamera group_write_list: mbr-kamera
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
- name: SCAN - name: SCAN
path: /data/shares/SCAN path: /data/shares/SCAN
group_valid_users: buero-scan group_valid_users: buero-scan
group_write_list: buero-scan group_write_list: buero-scan
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
#recycle_path: '@Recycle.Bin' #recycle_path: '@Recycle.Bin'
@@ -1087,31 +1062,31 @@ samba_shares:
path: /data/shares/Technik-und-Sicherheit path: /data/shares/Technik-und-Sicherheit
group_valid_users: technik group_valid_users: technik
group_write_list: technik group_write_list: technik
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: AG-Antisemitismus - name: AG-Antisemitismus
path: /data/shares/AG-Antisemitismus path: /data/shares/AG-Antisemitismus
group_valid_users: ag-antisem group_valid_users: ag-antisem
group_write_list: ag-antisem group_write_list: ag-antisem
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Projektleitung - name: Projektleitung
path: /data/shares/Projektleitung path: /data/shares/Projektleitung
group_valid_users: projektleitung group_valid_users: projektleitung
group_write_list: projektleitung group_write_list: projektleitung
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# VDK # VDK
@@ -1121,40 +1096,40 @@ samba_shares:
path: /data/shares/Arbeitsrechtliches path: /data/shares/Arbeitsrechtliches
group_valid_users: vdk group_valid_users: vdk
group_write_list: vdk group_write_list: vdk
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Finanzen - name: Finanzen
path: /data/shares/Finanzen path: /data/shares/Finanzen
group_valid_users: vdk group_valid_users: vdk
group_write_list: vdk group_write_list: vdk
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: VDK - name: VDK
path: /data/shares/VDK path: /data/shares/VDK
group_valid_users: vdk group_valid_users: vdk
group_write_list: vdk group_write_list: vdk
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Betriebsrat - name: Betriebsrat
path: /data/shares/Betriebsrat path: /data/shares/Betriebsrat
group_valid_users: betriebsrat group_valid_users: betriebsrat
group_write_list: betriebsrat group_write_list: betriebsrat
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# BgN # BgN
@@ -1164,21 +1139,21 @@ samba_shares:
path: /data/shares/BGN-Finanzen-Personal path: /data/shares/BGN-Finanzen-Personal
group_valid_users: bgn-finanzen-personal group_valid_users: bgn-finanzen-personal
group_write_list: bgn-finanzen-personal group_write_list: bgn-finanzen-personal
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Mobilisierungsplattform - name: Mobilisierungsplattform
path: /data/shares/Mobilisierungsplattform path: /data/shares/Mobilisierungsplattform
group_valid_users: bgn group_valid_users: bgn
group_write_list: bgn group_write_list: bgn
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# BMB # BMB
@@ -1188,11 +1163,11 @@ samba_shares:
path: /data/shares/BMB path: /data/shares/BMB
group_valid_users: bmb group_valid_users: bmb
group_write_list: bmb group_write_list: bmb
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# MBR # MBR
@@ -1202,41 +1177,41 @@ samba_shares:
path: /data/shares/MBR-Finanzen-Personal path: /data/shares/MBR-Finanzen-Personal
group_valid_users: mbr-finanzen-personal group_valid_users: mbr-finanzen-personal
group_write_list: mbr-finanzen-personal group_write_list: mbr-finanzen-personal
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: BVV-Projekt - name: BVV-Projekt
path: /data/shares/BVV-Projekt path: /data/shares/BVV-Projekt
group_valid_users: mbr-buero group_valid_users: mbr-buero
group_write_list: mbr-buero group_write_list: mbr-buero
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: MBR - name: MBR
path: /data/shares/MBR path: /data/shares/MBR
group_valid_users: mbr-buero group_valid_users: mbr-buero
group_write_list: mbr-buero group_write_list: mbr-buero
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Video - name: Video
path: /data/shares/Video path: /data/shares/Video
group_valid_users: mbr-buero group_valid_users: mbr-buero
group_write_list: mbr-buero group_write_list: mbr-buero
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# RIAS # RIAS
@@ -1246,41 +1221,41 @@ samba_shares:
path: /data/shares/RIAS-Berlin path: /data/shares/RIAS-Berlin
group_valid_users: rias-berlin group_valid_users: rias-berlin
group_write_list: rias-berlin group_write_list: rias-berlin
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: RIAS-Berlin-Finanzen-Personal - name: RIAS-Berlin-Finanzen-Personal
path: /data/shares/RIAS-Berlin-Finanzen-Personal path: /data/shares/RIAS-Berlin-Finanzen-Personal
group_valid_users: rias-berlin-finanzen-personal group_valid_users: rias-berlin-finanzen-personal
group_write_list: rias-berlin-finanzen-personal group_write_list: rias-berlin-finanzen-personal
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: RIAS-Bund - name: RIAS-Bund
path: /data/shares/RIAS-Bund path: /data/shares/RIAS-Bund
group_valid_users: rias-bund group_valid_users: rias-bund
group_write_list: rias-bund group_write_list: rias-bund
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: RIAS-Bund-Finanzen-Personal - name: RIAS-Bund-Finanzen-Personal
path: /data/shares/RIAS-Bund-Finanzen-Personal path: /data/shares/RIAS-Bund-Finanzen-Personal
group_valid_users: rias-bund-finanzen-personal group_valid_users: rias-bund-finanzen-personal
group_write_list: rias-bund-finanzen-personal group_write_list: rias-bund-finanzen-personal
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# Regishut # Regishut
@@ -1290,21 +1265,21 @@ samba_shares:
path: /data/shares/Regishut path: /data/shares/Regishut
group_valid_users: regishut group_valid_users: regishut
group_write_list: regishut group_write_list: regishut
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: Regishut-Personal-Finanzen - name: Regishut-Personal-Finanzen
path: /data/shares/Regishut-Personal-Finanzen path: /data/shares/Regishut-Personal-Finanzen
group_valid_users: regishut-personal-finanzen group_valid_users: regishut-personal-finanzen
group_write_list: regishut-personal-finanzen group_write_list: regishut-personal-finanzen
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# --- # ---
# DiRex - Direkte Intervention bei Rechtsextremismus, Rassismus und Antisemitismus in der Schule" # DiRex - Direkte Intervention bei Rechtsextremismus, Rassismus und Antisemitismus in der Schule"
@@ -1314,24 +1289,21 @@ samba_shares:
path: /data/shares/DiRex path: /data/shares/DiRex
group_valid_users: direx group_valid_users: direx
group_write_list: direx group_write_list: direx
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
- name: DiRex-Personal-Finanzen - name: DiRex-Personal-Finanzen
path: /data/shares/DiRex-Personal-Finanzen path: /data/shares/DiRex-Personal-Finanzen
group_valid_users: direx-personal-finanzen group_valid_users: direx-personal-finanzen
group_write_list: direx-personal-finanzen group_write_list: direx-personal-finanzen
file_create_mask: '0660' file_create_mask: "0660"
dir_create_mask: '2770' dir_create_mask: "2770"
vfs_object_virusfilter: true vfs_object_virusfilter: true
vfs_object_recycle: true vfs_object_recycle: true
recycle_path: '@Recycle.Bin' recycle_path: "@Recycle.Bin"
# ========== # ==========
# vars used by roles/common/tasks/system-user-systemfiles.yml # vars used by roles/common/tasks/system-user-systemfiles.yml
@@ -1343,7 +1315,6 @@ samba_shares:
# #
# - system_users: roles/common/tasks/system-user.yml # - system_users: roles/common/tasks/system-user.yml
# ========== # ==========
# vars used by roles/common/tasks/nis-user-systemfiles.yml # vars used by roles/common/tasks/nis-user-systemfiles.yml
# ========== # ==========
@@ -1354,7 +1325,6 @@ samba_shares:
# #
# - nis_user: roles/common/tasks/nis-install-server.yml # - nis_user: roles/common/tasks/nis-install-server.yml
# ========== # ==========
# vars used by roles/common/tasks/sudoers-pc.yml # vars used by roles/common/tasks/sudoers-pc.yml
# ========== # ==========
@@ -1364,19 +1334,15 @@ sudo_pc_users:
- sysadm - sysadm
- lokaladmin - lokaladmin
# ========== # ==========
# vars used by roles/common/tasks/sudoers-server.yml # vars used by roles/common/tasks/sudoers-server.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml # vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml
# vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml # vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/luks.yml # vars used by roles/common/tasks/luks.yml
# ========== # ==========
group_vars/sprachenatelier.yml
-7
View File
@@ -134,7 +134,6 @@ nis_groups:
# - name: simone # - name: simone
nis_user: nis_user:
- name: chris - name: chris
groups: groups:
- intern - intern
@@ -451,19 +450,13 @@ sudo_pc_users:
- sysadm - sysadm
- localadmin - localadmin
# ========== # ==========
# vars used by roles/common/tasks/sudoers-server.yml # vars used by roles/common/tasks/sudoers-server.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml # vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml
# vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml # vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml
# ========== # ==========
# ========== # ==========
# vars used by roles/common/tasks/luks.yml # vars used by roles/common/tasks/luks.yml
# ========== # ==========
host_vars/file-akb.akb.netz.yml
+2 -11
View File
@@ -4,12 +4,11 @@
# vars used by roles/network_interfaces # vars used by roles/network_interfaces
# --- # ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: True network_manage_devices: true
# Should the interfaces be reloaded after config change? # Should the interfaces be reloaded after config change?
network_interface_reload: False network_interface_reload: false
network_interface_path: /etc/network/interfaces.d network_interface_path: /etc/network/interfaces.d
network_interface_required_packages: network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
- ifupdown - ifupdown
- ifenslave - ifenslave
network_interfaces: network_interfaces:
- device: eno1 - device: eno1
@@ -48,14 +46,12 @@ network_interfaces:
- 192.168.82.1 - 192.168.82.1
search: akb.netz search: akb.netz
# --- # ---
# vars used by roles/common/tasks/basic.yml # vars used by roles/common/tasks/basic.yml
# --- # ---
set_default_limit_nofile: true set_default_limit_nofile: true
# --- # ---
# roles/common/tasks/default-users.yml # roles/common/tasks/default-users.yml
# --- # ---
@@ -75,14 +71,12 @@ set_default_limit_nofile: true
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhbQo8gm3zNCkNTSHrLE1np0IDiSUHgfyy8469guHFz root@file-akb' # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhbQo8gm3zNCkNTSHrLE1np0IDiSUHgfyy8469guHFz root@file-akb'
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlm5VPClcXv5O8GaL9H5EVgXaP3/FY7aafB0Jes3BvH root@gw-akb' # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlm5VPClcXv5O8GaL9H5EVgXaP3/FY7aafB0Jes3BvH root@gw-akb'
# --- # ---
# vars used by roles/common/tasks/systemd-resolved.yml # vars used by roles/common/tasks/systemd-resolved.yml
# --- # ---
systemd_resolved: true systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139 # Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67 # Sekundäre DNS-Adresse: 194.187.251.67
@@ -143,7 +137,6 @@ resolved_dnssec: false
resolved_fallback_nameserver: resolved_fallback_nameserver:
- 172.16.82.254 - 172.16.82.254
# --- # ---
# vars used by roles/common/tasks/sshd.yml # vars used by roles/common/tasks/sshd.yml
# --- # ---
@@ -156,7 +149,6 @@ sshd_password_authentication: !!str "yes"
# sshd_use_pam: !!str "no" # sshd_use_pam: !!str "no"
# --- # ---
# vars used by roles/common/tasks/cron.yml # vars used by roles/common/tasks/cron.yml
# --- # ---
@@ -191,7 +183,6 @@ cron_user_entries:
hour: "23" hour: "23"
job: /root/bin/admin-stuff/cleanup_from_old_files.sh job: /root/bin/admin-stuff/cleanup_from_old_files.sh
cron_user_special_time_entries: cron_user_special_time_entries:
- name: "Restart DNS Cache service 'systemd-resolved'" - name: "Restart DNS Cache service 'systemd-resolved'"
host_vars/file-flr.flr.netz.yml
+2 -12
View File
@@ -4,12 +4,11 @@
# vars used by roles/network_interfaces # vars used by roles/network_interfaces
# --- # ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: True network_manage_devices: true
# Should the interfaces be reloaded after config change? # Should the interfaces be reloaded after config change?
network_interface_reload: False network_interface_reload: false
network_interface_path: /etc/network/interfaces.d network_interface_path: /etc/network/interfaces.d
network_interface_required_packages: network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
- ifupdown - ifupdown
- ifenslave - ifenslave
network_interfaces: network_interfaces:
- device: eno1 - device: eno1
@@ -48,14 +46,12 @@ network_interfaces:
- 192.168.102.1 - 192.168.102.1
search: flr.netz search: flr.netz
# --- # ---
# vars used by roles/common/tasks/basic.yml # vars used by roles/common/tasks/basic.yml
# --- # ---
set_default_limit_nofile: true set_default_limit_nofile: true
# --- # ---
# vars used by roles/common/tasks/default-users.yml # vars used by roles/common/tasks/default-users.yml
# --- # ---
@@ -75,14 +71,12 @@ set_default_limit_nofile: true
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTvxBfneJxBjMdpO9JCSkDyXQZUFXjYa/rqA6gQ0TL2 root@file-flr' # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTvxBfneJxBjMdpO9JCSkDyXQZUFXjYa/rqA6gQ0TL2 root@file-flr'
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSvVJ6MbYdXhIeS6FWFx2M/p7Gb6aG3oy25ZJRctXYd root@gw-flr' # - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSvVJ6MbYdXhIeS6FWFx2M/p7Gb6aG3oy25ZJRctXYd root@gw-flr'
# --- # ---
# vars used by roles/common/tasks/systemd-resolved.yml # vars used by roles/common/tasks/systemd-resolved.yml
# --- # ---
systemd_resolved: true systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139 # Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67 # Sekundäre DNS-Adresse: 194.187.251.67
@@ -142,7 +136,6 @@ resolved_dnssec: false
resolved_fallback_nameserver: resolved_fallback_nameserver:
- 172.16.102.254 - 172.16.102.254
# --- # ---
# vars used by roles/common/tasks/sshd.yml # vars used by roles/common/tasks/sshd.yml
# --- # ---
@@ -155,7 +148,6 @@ sshd_password_authentication: !!str "yes"
# sshd_use_pam: !!str "no" # sshd_use_pam: !!str "no"
# --- # ---
# vars used by roles/common/tasks/cron.yml # vars used by roles/common/tasks/cron.yml
# --- # ---
@@ -181,11 +173,9 @@ cron_user_entries:
hour: "7-22" hour: "7-22"
job: /root/bin/monitoring/check_cups-browsed.sh job: /root/bin/monitoring/check_cups-browsed.sh
cron_user_special_time_entries: cron_user_special_time_entries:
- name: "Restart DNS Cache service 'systemd-resolved'" - name: "Restart DNS Cache service 'systemd-resolved'"
special_time: reboot special_time: reboot
job: "sleep 10 ; /bin/systemctl restart systemd-resolved" job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
insertafter: PATH insertafter: PATH
host_vars/file-kb.anw-kb.netz.yml
+2 -13
View File
@@ -4,14 +4,11 @@
# vars used by roles/network_interfaces # vars used by roles/network_interfaces
# --- # ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: False network_manage_devices: false
# Should the interfaces be reloaded after config change? # Should the interfaces be reloaded after config change?
network_interface_reload: False network_interface_reload: false
# --- # ---
# vars used by roles/common/tasks/basic.yml # vars used by roles/common/tasks/basic.yml
@@ -19,15 +16,12 @@ network_interface_reload: False
set_default_limit_nofile: true set_default_limit_nofile: true
# --- # ---
# vars used by roles/common/tasks/systemd-resolved.yml # vars used by roles/common/tasks/systemd-resolved.yml
# --- # ---
systemd_resolved: true systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139 # Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67 # Sekundäre DNS-Adresse: 194.187.251.67
@@ -87,7 +81,6 @@ resolved_dnssec: false
resolved_fallback_nameserver: resolved_fallback_nameserver:
- 172.16.32.254 - 172.16.32.254
# --- # ---
# vars used by roles/common/tasks/sshd.yml # vars used by roles/common/tasks/sshd.yml
# --- # ---
@@ -100,7 +93,6 @@ sshd_password_authentication: !!str "yes"
# sshd_use_pam: !!str "no" # sshd_use_pam: !!str "no"
# --- # ---
# vars used by roles/common/tasks/cron.yml # vars used by roles/common/tasks/cron.yml
# --- # ---
@@ -111,12 +103,9 @@ cron_user_entries:
minute: "*/15" minute: "*/15"
job: /root/bin/monitoring/check_postfix.sh job: /root/bin/monitoring/check_postfix.sh
cron_user_special_time_entries: cron_user_special_time_entries:
- name: "Restart DNS Cache service 'systemd-resolved'" - name: "Restart DNS Cache service 'systemd-resolved'"
special_time: reboot special_time: reboot
job: "sleep 10 ; /bin/systemctl restart systemd-resolved" job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
insertafter: PATH insertafter: PATH
host_vars/file-mbr.mbr-bln.netz.yml
+2 -13
View File
@@ -4,12 +4,11 @@
# vars used by roles/network_interfaces # vars used by roles/network_interfaces
# --- # ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: True network_manage_devices: true
# Should the interfaces be reloaded after config change? # Should the interfaces be reloaded after config change?
network_interface_reload: False network_interface_reload: false
network_interface_path: /etc/network/interfaces.d network_interface_path: /etc/network/interfaces.d
network_interface_required_packages: network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
- ifupdown - ifupdown
- ifenslave - ifenslave
network_interfaces: network_interfaces:
- device: br0 - device: br0
@@ -80,22 +78,18 @@ network_interfaces:
address: 192.168.112.211 address: 192.168.112.211
netmask: 32 netmask: 32
# --- # ---
# vars used by roles/common/tasks/basic.yml # vars used by roles/common/tasks/basic.yml
# --- # ---
set_default_limit_nofile: true set_default_limit_nofile: true
# --- # ---
# vars used by roles/common/tasks/systemd-resolved.yml # vars used by roles/common/tasks/systemd-resolved.yml
# --- # ---
systemd_resolved: true systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139 # Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67 # Sekundäre DNS-Adresse: 194.187.251.67
@@ -155,7 +149,6 @@ resolved_dnssec: false
resolved_fallback_nameserver: resolved_fallback_nameserver:
- 172.16.112.254 - 172.16.112.254
# --- # ---
# vars used by roles/common/tasks/sshd.yml # vars used by roles/common/tasks/sshd.yml
# --- # ---
@@ -168,7 +161,6 @@ sshd_password_authentication: !!str "yes"
# sshd_use_pam: !!str "no" # sshd_use_pam: !!str "no"
# --- # ---
# vars used by roles/common/tasks/cron.yml # vars used by roles/common/tasks/cron.yml
# --- # ---
@@ -199,12 +191,9 @@ cron_user_entries:
hour: "23" hour: "23"
job: /root/bin/admin-stuff/cleanup_from_old_files.sh job: /root/bin/admin-stuff/cleanup_from_old_files.sh
cron_user_special_time_entries: cron_user_special_time_entries:
- name: "Restart DNS Cache service 'systemd-resolved'" - name: "Restart DNS Cache service 'systemd-resolved'"
special_time: reboot special_time: reboot
job: "sleep 10 ; /bin/systemctl restart systemd-resolved" job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
insertafter: PATH insertafter: PATH
host_vars/file-spr.sprachenatelier.netz.yml
+2 -10
View File
@@ -4,12 +4,11 @@
# vars used by roles/network_interfaces # vars used by roles/network_interfaces
# --- # ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: True network_manage_devices: true
# Should the interfaces be reloaded after config change? # Should the interfaces be reloaded after config change?
network_interface_reload: False network_interface_reload: false
network_interface_path: /etc/network/interfaces.d network_interface_path: /etc/network/interfaces.d
network_interface_required_packages: network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
- ifupdown - ifupdown
- ifenslave - ifenslave
network_interfaces: network_interfaces:
- device: eno1 - device: eno1
@@ -48,21 +46,18 @@ network_interfaces:
- 192.168.92.1 - 192.168.92.1
search: sprachenatelier.netz search: sprachenatelier.netz
# --- # ---
# vars used by roles/common/tasks/basic.yml # vars used by roles/common/tasks/basic.yml
# --- # ---
set_default_limit_nofile: true set_default_limit_nofile: true
# --- # ---
# vars used by roles/common/tasks/systemd-resolved.yml # vars used by roles/common/tasks/systemd-resolved.yml
# --- # ---
systemd_resolved: true systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139 # Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67 # Sekundäre DNS-Adresse: 194.187.251.67
@@ -122,7 +117,6 @@ resolved_dnssec: false
resolved_fallback_nameserver: resolved_fallback_nameserver:
- 172.16.92.254 - 172.16.92.254
# --- # ---
# vars used by roles/common/tasks/sshd.yml # vars used by roles/common/tasks/sshd.yml
# --- # ---
@@ -135,7 +129,6 @@ sshd_password_authentication: !!str "yes"
# sshd_use_pam: !!str "no" # sshd_use_pam: !!str "no"
# --- # ---
# vars used by roles/common/tasks/cron.yml # vars used by roles/common/tasks/cron.yml
# --- # ---
@@ -161,7 +154,6 @@ cron_user_entries:
hour: "7-22" hour: "7-22"
job: /root/bin/monitoring/check_cups-browsed.sh job: /root/bin/monitoring/check_cups-browsed.sh
cron_user_special_time_entries: cron_user_special_time_entries:
- name: "Restart DNS Cache service 'systemd-resolved'" - name: "Restart DNS Cache service 'systemd-resolved'"
roles/common/tasks/apt.yml
+60 -61
View File
@@ -1,6 +1,6 @@
--- ---
- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list' - name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
state: absent state: absent
with_items: with_items:
@@ -15,8 +15,8 @@
dest: /etc/apt/sources.list dest: /etc/apt/sources.list
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
register: apt_config_updated register: common_apt_config_updated
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
@@ -25,7 +25,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13) - name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
apt: ansible.builtin.apt:
name: debian-archive-keyring name: debian-archive-keyring
state: present state: present
when: when:
@@ -37,7 +37,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13) - name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
copy: ansible.builtin.copy:
src: /etc/apt/sources.list src: /etc/apt/sources.list
dest: /etc/apt/sources.list.before-deb822 dest: /etc/apt/sources.list.before-deb822
remote_src: true remote_src: true
@@ -50,14 +50,14 @@
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13 - (ansible_facts['distribution_major_version'] | int) >= 13
failed_when: failed_when:
- apt_sources_list_backup.failed - common_apt_sources_list_backup.failed
- "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))" - "'No such file or directory' not in (common_apt_sources_list_backup.msg | default(''))"
register: apt_sources_list_backup register: common_apt_sources_list_backup
tags: tags:
- apt-configuration - apt-configuration
- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13) - name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
copy: ansible.builtin.copy:
dest: /etc/apt/sources.list dest: /etc/apt/sources.list
content: | content: |
# {{ ansible_managed }} # {{ ansible_managed }}
@@ -67,7 +67,7 @@
owner: root owner: root
group: root group: root
mode: "0644" mode: "0644"
register: apt_config_updated_sources_list register: common_apt_config_updated_sources_list
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
@@ -82,7 +82,7 @@
owner: root owner: root
group: root group: root
mode: "0644" mode: "0644"
register: apt_config_updated_debian_sources register: common_apt_config_updated_debian_sources
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
@@ -97,7 +97,7 @@
owner: root owner: root
group: root group: root
mode: "0644" mode: "0644"
register: apt_config_updated_security_sources register: common_apt_config_updated_security_sources
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
@@ -112,7 +112,7 @@
owner: root owner: root
group: root group: root
mode: "0644" mode: "0644"
register: apt_config_updated_backports_sources register: common_apt_config_updated_backports_sources
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
@@ -124,10 +124,10 @@
# If 'backports' was enabled in a previous run but is now disabled. # If 'backports' was enabled in a previous run but is now disabled.
# #
- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13) - name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
file: ansible.builtin.file:
path: /etc/apt/sources.list.d/backports.sources path: /etc/apt/sources.list.d/backports.sources
state: absent state: absent
register: apt_config_removed_backports_sources register: common_apt_config_removed_backports_sources
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian' - ansible_facts['distribution'] == 'Debian'
@@ -139,15 +139,15 @@
# Collect change states from all Debian >=13 deb822 source tasks so apt update # Collect change states from all Debian >=13 deb822 source tasks so apt update
# can force a fresh cache refresh when repository files changed. # can force a fresh cache refresh when repository files changed.
- name: (apt.yml) aggregate deb822 source changes (Debian >= 13) - name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
set_fact: ansible.builtin.set_fact:
apt_config_updated: common_apt_config_updated:
changed: >- changed: >-
{{ {{
(apt_config_updated_sources_list.changed | default(false)) (common_apt_config_updated_sources_list.changed | default(false))
or (apt_config_updated_debian_sources.changed | default(false)) or (common_apt_config_updated_debian_sources.changed | default(false))
or (apt_config_updated_security_sources.changed | default(false)) or (common_apt_config_updated_security_sources.changed | default(false))
or (apt_config_updated_backports_sources.changed | default(false)) or (common_apt_config_updated_backports_sources.changed | default(false))
or (apt_config_removed_backports_sources.changed | default(false)) or (common_apt_config_removed_backports_sources.changed | default(false))
}} }}
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
@@ -157,9 +157,9 @@
- apt-configuration - apt-configuration
- name: (apt.yml) apt update - name: (apt.yml) apt update
apt: ansible.builtin.apt:
update_cache: true update_cache: true
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
when: apt_update|bool when: apt_update|bool
tags: tags:
- apt-update - apt-update
@@ -172,9 +172,9 @@
- name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a' - name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
ansible.builtin.command: dpkg --configure -a ansible.builtin.command: dpkg --configure -a
register: _dpkg_configure register: common_dpkg_configure
changed_when: (_dpkg_configure.stdout | default('')) | length > 0 changed_when: (common_dpkg_configure.stdout | default('')) | length > 0
failed_when: _dpkg_configure.rc != 0 failed_when: common_dpkg_configure.rc != 0
when: apt_dpkg_configure|bool when: apt_dpkg_configure|bool
tags: tags:
- apt-dpkg-configure - apt-dpkg-configure
@@ -184,7 +184,7 @@
- apt-webserver-pkgs - apt-webserver-pkgs
- name: (apt.yml) apt upgrade - name: (apt.yml) apt upgrade
apt: ansible.builtin.apt:
upgrade: "{{ apt_upgrade_type }}" upgrade: "{{ apt_upgrade_type }}"
update_cache: true update_cache: true
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
@@ -197,7 +197,7 @@
- apt-webserver-pkgs - apt-webserver-pkgs
- name: (apt.yml) Initial install debian packages (stretch) - name: (apt.yml) Initial install debian packages (stretch)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_stretch }}" name: "{{ apt_initial_install_stretch }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -208,7 +208,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (buster) - name: (apt.yml) Initial install debian packages (buster)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_buster }}" name: "{{ apt_initial_install_buster }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -219,7 +219,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (bullseye) - name: (apt.yml) Initial install debian packages (bullseye)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_bullseye }}" name: "{{ apt_initial_install_bullseye }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -230,7 +230,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (bookworm) - name: (apt.yml) Initial install debian packages (bookworm)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_bookworm }}" name: "{{ apt_initial_install_bookworm }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -241,7 +241,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (trixie) - name: (apt.yml) Initial install debian packages (trixie)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_trixie }}" name: "{{ apt_initial_install_trixie }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -252,7 +252,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (bionic) - name: (apt.yml) Initial install ubuntu packages (bionic)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_bionic }}" name: "{{ apt_initial_install_bionic }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -262,7 +262,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (xenial) - name: (apt.yml) Initial install ubuntu packages (xenial)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_xenial }}" name: "{{ apt_initial_install_xenial }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -272,7 +272,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (jammy) - name: (apt.yml) Initial install ubuntu packages (jammy)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_jammy }}" name: "{{ apt_initial_install_jammy }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -282,7 +282,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (noble) - name: (apt.yml) Initial install ubuntu packages (noble)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_noble }}" name: "{{ apt_initial_install_noble }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -296,7 +296,7 @@
# --- # ---
- name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch) - name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch)
apt: ansible.builtin.apt:
name: "{{ microcode_intel_package }}" name: "{{ microcode_intel_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}-backports" default_release: "{{ ansible_facts['distribution_release'] }}-backports"
@@ -310,21 +310,22 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie) - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
apt: ansible.builtin.apt:
name: "{{ microcode_intel_package }}" name: "{{ microcode_intel_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
when: when:
- apt_debian_contrib_nonfree_enable - apt_debian_contrib_nonfree_enable
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11"or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13" - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or
ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
- ansible_facts['processor']|string is search("Intel") - ansible_facts['processor']|string is search("Intel")
tags: tags:
- apt-initial-install - apt-initial-install
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for AMD CPU (debian buster) - name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
apt: ansible.builtin.apt:
name: "{{ microcode_amd_package }}" name: "{{ microcode_amd_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -338,7 +339,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic) - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
apt: ansible.builtin.apt:
name: "{{ microcode_intel_package }}" name: "{{ microcode_intel_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -351,7 +352,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic) - name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
apt: ansible.builtin.apt:
name: "{{ microcode_amd_package }}" name: "{{ microcode_amd_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -365,7 +366,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial) - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
apt: ansible.builtin.apt:
name: "{{ microcode_intel_package }}" name: "{{ microcode_intel_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -378,7 +379,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial) - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
apt: ansible.builtin.apt:
name: "{{ microcode_amd_package }}" name: "{{ microcode_amd_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -392,7 +393,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble) - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
apt: ansible.builtin.apt:
name: "{{ microcode_intel_package }}" name: "{{ microcode_intel_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -405,7 +406,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble) - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
apt: ansible.builtin.apt:
name: "{{ microcode_amd_package }}" name: "{{ microcode_amd_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -423,7 +424,7 @@
# --- # ---
- name: (apt.yml) Install Firmware packages (Ubuntu) - name: (apt.yml) Install Firmware packages (Ubuntu)
apt: ansible.builtin.apt:
name: "{{ firmware_packages_ubuntu }}" name: "{{ firmware_packages_ubuntu }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -434,7 +435,7 @@
- apt-firmware - apt-firmware
- name: (apt.yml) Install Firmware packages (Debian) - name: (apt.yml) Install Firmware packages (Debian)
apt: ansible.builtin.apt:
name: "{{ firmware_packages_debian }}" name: "{{ firmware_packages_debian }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -445,7 +446,7 @@
- apt-firmware - apt-firmware
- name: (apt.yml) Install non-free Firmware packages (Debian) - name: (apt.yml) Install non-free Firmware packages (Debian)
apt: ansible.builtin.apt:
name: "{{ firmware_non_free_packages_debian }}" name: "{{ firmware_non_free_packages_debian }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -461,7 +462,7 @@
# --- # ---
- name: (apt.yml) Remove unwanted packages - name: (apt.yml) Remove unwanted packages
apt: ansible.builtin.apt:
name: "{{ apt_remove }}" name: "{{ apt_remove }}"
state: absent state: absent
purge: "{{ apt_remove_purge }}" purge: "{{ apt_remove_purge }}"
@@ -469,7 +470,7 @@
- apt-remove - apt-remove
- name: (apt.yml) Remove unwanted packages Ubuntu bionic - name: (apt.yml) Remove unwanted packages Ubuntu bionic
apt: ansible.builtin.apt:
name: "{{ apt_remove_bionic }}" name: "{{ apt_remove_bionic }}"
state: absent state: absent
purge: "{{ apt_remove_purge }}" purge: "{{ apt_remove_purge }}"
@@ -480,7 +481,7 @@
- apt-remove - apt-remove
- name: (apt.yml) Remove unwanted packages Ubuntu xenial - name: (apt.yml) Remove unwanted packages Ubuntu xenial
apt: ansible.builtin.apt:
name: "{{ apt_remove_xenial }}" name: "{{ apt_remove_xenial }}"
state: absent state: absent
purge: "{{ apt_remove_purge }}" purge: "{{ apt_remove_purge }}"
@@ -491,7 +492,7 @@
- apt-remove - apt-remove
- name: (apt.yml) Remove unwanted packages Ubuntu jammy - name: (apt.yml) Remove unwanted packages Ubuntu jammy
apt: ansible.builtin.apt:
name: "{{ apt_remove_jammy }}" name: "{{ apt_remove_jammy }}"
state: absent state: absent
purge: "{{ apt_remove_purge }}" purge: "{{ apt_remove_purge }}"
@@ -502,7 +503,7 @@
- apt-remove - apt-remove
- name: (apt.yml) Remove unwanted packages Ubuntu noble - name: (apt.yml) Remove unwanted packages Ubuntu noble
apt: ansible.builtin.apt:
name: "{{ apt_remove_noble }}" name: "{{ apt_remove_noble }}"
state: absent state: absent
purge: "{{ apt_remove_purge }}" purge: "{{ apt_remove_purge }}"
@@ -513,7 +514,7 @@
- apt-remove - apt-remove
- name: (apt.yml) autoremove - name: (apt.yml) autoremove
apt: ansible.builtin.apt:
autoremove: true autoremove: true
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
when: apt_autoremove|bool when: apt_autoremove|bool
@@ -522,11 +523,9 @@
- apt-initial-install - apt-initial-install
- apt-microcode - apt-microcode
- name: (apt.yml) clean - name: (apt.yml) autoclean cache
command: apt-get -y clean ansible.builtin.apt:
#args: autoclean: true
# warn: false
changed_when: false
when: apt_clean | bool when: apt_clean | bool
tags: tags:
- apt-clean - apt-clean
roles/common/tasks/basic.yml
+47 -34
View File
@@ -1,22 +1,21 @@
--- ---
- name: (basic.yml) Ensure timezone is is correct - name: (basic.yml) Ensure timezone is is correct
timezone: name={{ time_zone }} community.general.timezone:
name: "{{ time_zone }}"
tags: tags:
- timezone - timezone
- name: (basic.yml) Ensure locales are present - name: (basic.yml) Ensure locales are present
locale_gen: community.general.locale_gen:
name: "{{ item }}" name: "{{ item }}"
state: present state: present
with_items: "{{ locales }}" with_items: "{{ locales }}"
tags: tags:
- locales - locales
- name: (basic.yml) Create a symbolic link /bin/sh -> bash - name: (basic.yml) Create a symbolic link /bin/sh -> bash
file: ansible.builtin.file:
src: bash src: bash
dest: /bin/sh dest: /bin/sh
owner: root owner: root
@@ -27,16 +26,15 @@
tags: tags:
- symlink-sh - symlink-sh
# ---------- # ----------
# security limit (maybe DEPRECATED see systemd settings) # security limit (maybe DEPRECATED see systemd settings)
# ---------- # ----------
- name: (basic.yml) Ensure directory '/etc/security/limits.d' exists - name: (basic.yml) Ensure directory '/etc/security/limits.d' exists
file: ansible.builtin.file:
path: /etc/security/limits.d path: /etc/security/limits.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -47,7 +45,7 @@
- systemd-config - systemd-config
- name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists - name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: '{{ item.src_path }}'
dest: '{{ item.dest_path }}' dest: '{{ item.dest_path }}'
owner: root owner: root
@@ -63,16 +61,15 @@
tags: tags:
- systemd-config - systemd-config
# ---------- # ----------
# systemd stuff # systemd stuff
# ---------- # ----------
- name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists - name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists
file: ansible.builtin.file:
path: /etc/systemd/system.conf.d path: /etc/systemd/system.conf.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -83,7 +80,7 @@
- systemd-config - systemd-config
- name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists - name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: '{{ item.src_path }}'
dest: '{{ item.dest_path }}' dest: '{{ item.dest_path }}'
owner: root owner: root
@@ -100,10 +97,10 @@
- systemd-config - systemd-config
- name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists - name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists
file: ansible.builtin.file:
path: /etc/systemd/journald.conf.d path: /etc/systemd/journald.conf.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -113,7 +110,7 @@
- systemd-config - systemd-config
- name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists - name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: '{{ item.src_path }}'
dest: '{{ item.dest_path }}' dest: '{{ item.dest_path }}'
owner: root owner: root
@@ -129,45 +126,56 @@
tags: tags:
- systemd-config - systemd-config
# ---------- # ----------
# unattended upgrades # unattended upgrades
# ---------- # ----------
- name: (basic.yml) install unattended-upgrades - name: (basic.yml) install unattended-upgrades
apt: pkg=unattended-upgrades state=present ansible.builtin.apt:
pkg: unattended-upgrades
state: present
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- unattended-upgrades - unattended-upgrades
- name: (basic.yml) install apt-listchanges - name: (basic.yml) install apt-listchanges
apt: pkg=apt-listchanges state=present ansible.builtin.apt:
pkg: apt-listchanges
state: present
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- unattended-upgrades - unattended-upgrades
- name: (basic.yml) remove apticron - name: (basic.yml) remove apticron
apt: pkg=apticron state=absent ansible.builtin.apt:
pkg: apticron
state: absent
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- unattended-upgrades - unattended-upgrades
- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists - name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
stat: path=/etc/apt/apt.conf.d/20auto-upgrades ansible.builtin.stat:
register: ua_enabled path: /etc/apt/apt.conf.d/20auto-upgrades
register: common_ua_enabled
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- unattended-upgrades - unattended-upgrades
- name: (basic.yml) activate unattended upgrades - name: (basic.yml) activate unattended upgrades
shell: DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true dpkg-reconfigure -plow unattended-upgrades ansible.builtin.command:
cmd: dpkg-reconfigure -plow unattended-upgrades
creates: /etc/apt/apt.conf.d/20auto-upgrades
environment:
DEBIAN_FRONTEND: noninteractive
DEBCONF_NONINTERACTIVE_SEEN: "true"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- ua_enabled.stat.exists == False - not common_ua_enabled.stat.exists
tags: tags:
- unattended-upgrades - unattended-upgrades
@@ -177,7 +185,7 @@
dest: /etc/apt/listchanges.conf dest: /etc/apt/listchanges.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
@@ -187,39 +195,45 @@
ansible.builtin.template: ansible.builtin.template:
src: etc/apt/apt.conf.d/50unattended-upgrades.j2 src: etc/apt/apt.conf.d/50unattended-upgrades.j2
dest: /etc/apt/apt.conf.d/50unattended-upgrades dest: /etc/apt/apt.conf.d/50unattended-upgrades
backup: yes backup: true
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- unattended-upgrades - unattended-upgrades
# ---------- # ----------
# - /etc/hosts # - /etc/hosts
# ---------- # ----------
- name: (basic.yml) Check file '/etc/hosts.ORIG' exists - name: (basic.yml) Check file '/etc/hosts.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/hosts.ORIG path: /etc/hosts.ORIG
register: etc_hosts_ORIG register: common_etc_hosts_orig
when: when:
- "groups['file_server']|string is search(inventory_hostname)" - "groups['file_server']|string is search(inventory_hostname)"
tags: tags:
- etc_hosts - etc_hosts
- name: (basic.yml) Backup installation version of file '/etc/hosts' - name: (basic.yml) Backup installation version of file '/etc/hosts'
command: cp -a /etc/hosts /etc/hosts.ORIG ansible.builtin.copy:
src: /etc/hosts
dest: /etc/hosts.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- "groups['file_server']|string is search(inventory_hostname)" - "groups['file_server']|string is search(inventory_hostname)"
- etc_hosts_ORIG.stat.exists == False - not common_etc_hosts_orig.stat.exists
tags: tags:
- etc_hosts - etc_hosts
- name: (basic.yml) addjust '/etc/hosts' add nis-server .. - name: (basic.yml) addjust '/etc/hosts' add nis-server ..
lineinfile: ansible.builtin.lineinfile:
path: /etc/hosts path: /etc/hosts
regexp: '^192\.168\.' regexp: '^192\.168\.'
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}' line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
@@ -227,4 +241,3 @@
- "groups['nis_server']|string is search(inventory_hostname)" - "groups['nis_server']|string is search(inventory_hostname)"
tags: tags:
- etc_hosts - etc_hosts
roles/common/tasks/cron.yml
+3 -3
View File
@@ -1,6 +1,6 @@
--- ---
- name: (cron.yml) Set env entries in user crontabs - name: (cron.yml) Set env entries in user crontabs
cron: ansible.builtin.cron:
name: "{{ item.name }}" name: "{{ item.name }}"
env: "yes" env: "yes"
user: '{{ item.user | default("root") }}' user: '{{ item.user | default("root") }}'
@@ -14,7 +14,7 @@
- user_crontab - user_crontab
- name: (cron.yml) Set special time entries in user crontabs - name: (cron.yml) Set special time entries in user crontabs
cron: ansible.builtin.cron:
name: "{{ item.name }}" name: "{{ item.name }}"
special_time: "{{ item.special_time }}" special_time: "{{ item.special_time }}"
user: '{{ item.user | default("root") }}' user: '{{ item.user | default("root") }}'
@@ -28,7 +28,7 @@
- user_crontab - user_crontab
- name: (cron.yml) Set normal entries in user crontabs - name: (cron.yml) Set normal entries in user crontabs
cron: ansible.builtin.cron:
name: "{{ item.name }}" name: "{{ item.name }}"
minute: "{{ item.minute | default(omit) }}" minute: "{{ item.minute | default(omit) }}"
hour: "{{ item.hour | default(omit) }}" hour: "{{ item.hour | default(omit) }}"
roles/common/tasks/cups-install.yml
+46 -31
View File
@@ -1,26 +1,24 @@
--- ---
# --- # ---
# Cups Server # Cups Server
# --- # ---
- name: (cups-install.yml) Ensure CUPS packages server (buster) are installed. - name: (cups-install.yml) Ensure CUPS packages server (buster) are installed.
package: ansible.builtin.package:
pkg: '{{ apt_install_server_cups }}' pkg: "{{ apt_install_server_cups }}"
state: present state: present
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- cups-server - cups-server
# --- # ---
# Cups clients # Cups clients
# --- # ---
- name: (cups.yml) Ensure CUPS packages clients are installed. - name: (cups.yml) Ensure CUPS packages clients are installed.
package: ansible.builtin.package:
pkg: "{{ apt_install_client_cups }}" pkg: "{{ apt_install_client_cups }}"
state: present state: present
when: when:
@@ -30,20 +28,25 @@
tags: tags:
- cups-client - cups-client
# -- file /etc/cups/cups-browsed.conf # -- file /etc/cups/cups-browsed.conf
- name: (cups.yml) Check if file '/etc/cups/cups-browsed.conf.ORIGi' exists - name: (cups.yml) Check if file '/etc/cups/cups-browsed.conf.ORIGi' exists
stat: ansible.builtin.stat:
path: /etc/cups/cups-browsed.conf.ORIG path: /etc/cups/cups-browsed.conf.ORIG
register: cups_browsed_conf_orig_exists register: common_cups_browsed_conf_orig_exists
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
- name: (cups.yml) Backup /etc/cups/cups-browsed.conf file - name: (cups.yml) Backup /etc/cups/cups-browsed.conf file
command: cp /etc/cups/cups-browsed.conf /etc/cups/cups-browsed.conf.ORIG ansible.builtin.copy:
when: cups_browsed_conf_orig_exists.stat.exists == False src: /etc/cups/cups-browsed.conf
dest: /etc/cups/cups-browsed.conf.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: not common_cups_browsed_conf_orig_exists.stat.exists
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
@@ -54,9 +57,9 @@
dest: /etc/cups/cups-browsed.conf dest: /etc/cups/cups-browsed.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: notify:
Restart cups-browsed - Restart cups-browsed
when: when:
- groups['file_server']|string is search(inventory_hostname) - groups['file_server']|string is search(inventory_hostname)
tags: tags:
@@ -68,27 +71,33 @@
dest: /etc/cups/cups-browsed.conf dest: /etc/cups/cups-browsed.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: notify:
Restart cups-browsed - Restart cups-browsed
when: when:
- groups['client_pc']|string is search(inventory_hostname) - groups['client_pc']|string is search(inventory_hostname)
tags: tags:
- cups-client - cups-client
# -- file /etc/cups/cupsd.conf # -- file /etc/cups/cupsd.conf
- name: (cups.yml) Check if file '/etc/cups/cupsd.conf.ORIG' exists - name: (cups.yml) Check if file '/etc/cups/cupsd.conf.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/cups/cupsd.conf.ORIG path: /etc/cups/cupsd.conf.ORIG
register: cupsd_conf_orig_exists register: common_cupsd_conf_orig_exists
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
- name: (cups.yml) Backup /etc/cups/cupsd.conf file - name: (cups.yml) Backup /etc/cups/cupsd.conf file
command: cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.ORIG ansible.builtin.copy:
when: cupsd_conf_orig_exists.stat.exists == False src: /etc/cups/cupsd.conf
dest: /etc/cups/cupsd.conf.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: not common_cupsd_conf_orig_exists.stat.exists
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
@@ -99,9 +108,9 @@
dest: /etc/cups/cupsd.conf dest: /etc/cups/cupsd.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: notify:
Restart cups - Restart cups
when: when:
- groups['file_server']|string is search(inventory_hostname) - groups['file_server']|string is search(inventory_hostname)
tags: tags:
@@ -113,9 +122,9 @@
dest: /etc/cups/cupsd.conf dest: /etc/cups/cupsd.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: notify:
Restart cups - Restart cups
when: when:
- groups['client_pc']|string is search(inventory_hostname) - groups['client_pc']|string is search(inventory_hostname)
tags: tags:
@@ -123,16 +132,23 @@
# -- file /etc/cups/cups-files.conf # -- file /etc/cups/cups-files.conf
- name: (cups.yml) Check if file '/etc/cups/cups-files.conf.ORIGi' exists - name: (cups.yml) Check if file '/etc/cups/cups-files.conf.ORIGi' exists
stat: ansible.builtin.stat:
path: /etc/cups/cups-files.conf.ORIG path: /etc/cups/cups-files.conf.ORIG
register: cups_files_conf_orig_exists register: common_cups_files_conf_orig_exists
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
- name: (cups.yml) Backup /etc/cups/cups-files.conf file - name: (cups.yml) Backup /etc/cups/cups-files.conf file
command: cp /etc/cups/cups-files.conf /etc/cups/cups-files.conf.ORIG ansible.builtin.copy:
when: cups_files_conf_orig_exists.stat.exists == False src: /etc/cups/cups-files.conf
dest: /etc/cups/cups-files.conf.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: not common_cups_files_conf_orig_exists.stat.exists
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
@@ -143,10 +159,9 @@
dest: /etc/cups/cups-files.conf dest: /etc/cups/cups-files.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: notify:
Restart cups - Restart cups
tags: tags:
- cups-server - cups-server
- cups-client - cups-client
roles/common/tasks/default-users.yml
+20 -24
View File
@@ -5,7 +5,7 @@
# --- # ---
- name: (default-users.yml) Ensure default groups exists - name: (default-users.yml) Ensure default groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: '{{ item.group_id | default(omit) }}'
@@ -17,7 +17,7 @@
- groups-exists - groups-exists
- name: (default-users.yml) Ensure default users exists - name: (default-users.yml) Ensure default users exists
user: ansible.builtin.user:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: '{{ item.user_id | default(omit) }}'
@@ -34,7 +34,7 @@
- users-exists - users-exists
- name: (default-users.yml) Ensure authorized_key files for default users are present - name: (default-users.yml) Ensure authorized_key files for default users are present
authorized_key: ansible.posix.authorized_key:
user: "{{ item.0.name }}" user: "{{ item.0.name }}"
key: "{{ item.1 }}" key: "{{ item.1 }}"
state: present state: present
@@ -51,7 +51,7 @@
# --- # ---
- name: (default-users.yml) Ensure extra groups exists - name: (default-users.yml) Ensure extra groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: '{{ item.group_id | default(omit) }}'
@@ -64,7 +64,7 @@
- groups-exists - groups-exists
- name: (default-users.yml) Ensure extra users exists - name: (default-users.yml) Ensure extra users exists
user: ansible.builtin.user:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: '{{ item.user_id | default(omit) }}'
@@ -81,7 +81,7 @@
- users-exists - users-exists
- name: (default-users.yml) Ensure authorized_key files for extra users are present - name: (default-users.yml) Ensure authorized_key files for extra users are present
authorized_key: ansible.posix.authorized_key:
user: "{{ item.0.name }}" user: "{{ item.0.name }}"
key: "{{ item.1 }}" key: "{{ item.1 }}"
state: present state: present
@@ -95,7 +95,7 @@
- authorized_key - authorized_key
- name: (default-users.yml) other entries authorized_key files - name: (default-users.yml) other entries authorized_key files
authorized_key: ansible.posix.authorized_key:
user: "{{ item.user }}" user: "{{ item.user }}"
key: "{{ item.key }}" key: "{{ item.key }}"
state: present state: present
@@ -111,10 +111,10 @@
# --- # ---
- name: (default-users.yml) extra system user exists? - name: (default-users.yml) extra system user exists?
user: ansible.builtin.user:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
system: yes system: true
home: '{{ item.home }}' home: '{{ item.home }}'
shell: '{{ item.shell | d("/usr/sbin/nologin") }}' shell: '{{ item.shell | d("/usr/sbin/nologin") }}'
groups: '{{ item.groups | default(omit) }}' groups: '{{ item.groups | default(omit) }}'
@@ -125,37 +125,36 @@
tags: tags:
- user-exists - user-exists
# --- # ---
# - extra system groups 'sftp_users' # - extra system groups 'sftp_users'
# --- # ---
- name: (default-users.yml) Extra system group sftp_users - name: (default-users.yml) Extra system group sftp_users
group: ansible.builtin.group:
name: 'sftp_users' name: 'sftp_users'
state: present state: present
system: yes system: true
when: when:
- create_sftp_group is defined and create_sftp_group > 0 - create_sftp_group is defined and create_sftp_group > 0
tags: tags:
- groups-exists - groups-exists
# ======================================================= # =======================================================
# --- # ---
# - Allow connection via ssh to backup host # - Allow connection via ssh to backup host
# --- # ---
- name: Ensure root's .ssh directory exists - name: Ensure root's .ssh directory exists
file: ansible.builtin.file:
path: /root/.ssh path: /root/.ssh
state: directory state: directory
owner: root
group: root
mode: '0700'
- name: (default-users.yml) Copy (backup) ed25519 ssh private key to user root - name: (default-users.yml) Copy (backup) ed25519 ssh private key to user root
copy: ansible.builtin.copy:
src: '{{ item.priv_key_src }}' src: '{{ item.priv_key_src }}'
dest: '{{ item.priv_key_dest }}' dest: '{{ item.priv_key_dest }}'
owner: root owner: root
@@ -172,7 +171,7 @@
- insert_ssh_keypair_backup_server - insert_ssh_keypair_backup_server
- name: (default-users.yml) Copy (backup) ed25519 ssh public key to user root - name: (default-users.yml) Copy (backup) ed25519 ssh public key to user root
copy: ansible.builtin.copy:
src: '{{ item.pub_key_src }}' src: '{{ item.pub_key_src }}'
dest: '{{ item.pub_key_dest }}' dest: '{{ item.pub_key_dest }}'
owner: root owner: root
@@ -189,7 +188,7 @@
- insert_ssh_keypair_backup_server - insert_ssh_keypair_backup_server
- name: (default-users.yml) Ensure authorized_key (root) on backup hosts contains public key - name: (default-users.yml) Ensure authorized_key (root) on backup hosts contains public key
authorized_key: ansible.posix.authorized_key:
user: root user: root
key: "{{ lookup('file', item.pub_key_src) }}" key: "{{ lookup('file', item.pub_key_src) }}"
state: present state: present
@@ -204,9 +203,8 @@
- authorized_key - authorized_key
- ssh-keypair-backup-server - ssh-keypair-backup-server
- name: (default-users.yml) Copy further ssh private key(s) to user root - name: (default-users.yml) Copy further ssh private key(s) to user root
copy: ansible.builtin.copy:
src: '{{ item.priv_key_src }}' src: '{{ item.priv_key_src }}'
dest: '{{ item.priv_key_dest }}' dest: '{{ item.priv_key_dest }}'
owner: root owner: root
@@ -222,9 +220,8 @@
tags: tags:
- insert_root_ssh_keypair - insert_root_ssh_keypair
- root-defaut-ssh-keypair - root-defaut-ssh-keypair
- name: (default-users.yml) Copy further ssh public key(s) to user root - name: (default-users.yml) Copy further ssh public key(s) to user root
copy: ansible.builtin.copy:
src: '{{ item.pub_key_src }}' src: '{{ item.pub_key_src }}'
dest: '{{ item.pub_key_dest }}' dest: '{{ item.pub_key_dest }}'
owner: root owner: root
@@ -240,4 +237,3 @@
tags: tags:
- insert_root_ssh_keypair - insert_root_ssh_keypair
- root-defaut-ssh-keypair - root-defaut-ssh-keypair
roles/common/tasks/git.yml
+67 -19
View File
@@ -5,10 +5,20 @@
# --- # ---
- name: (git.yml) Install/Update default repositories - name: (git.yml) Install/Update default repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_default_repositories }}' version: >-
{{
item.version
| default(item.branch)
| default(
'master'
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
else 'main'
)
}}
with_items: "{{ git_default_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
tags: tags:
@@ -20,10 +30,20 @@
# --- # ---
- name: (git.yml) Install/Update file_server repositories - name: (git.yml) Install/Update file_server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_oopen_server_repositories }}' version: >-
{{
item.version
| default(item.branch)
| default(
'master'
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
else 'main'
)
}}
with_items: "{{ git_oopen_server_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['file_server']|string is search(inventory_hostname)" when: "groups['file_server']|string is search(inventory_hostname)"
@@ -36,14 +56,34 @@
# --- # ---
- name: (git.yml) Install/Update samba server repositories - name: (git.yml) Install/Update samba server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_samba_repositories }}' version: >-
{{
item.version
| default(item.branch)
| default(
'master'
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
else 'main'
)
}}
with_items: "{{ git_samba_repositories }}"
register: common_git_samba_result
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['samba_server']|string is search(inventory_hostname)" when: "groups['samba_server']|string is search(inventory_hostname)"
ignore_errors: True failed_when: >-
(common_git_samba_result.failed | default(false)) and (
common_git_samba_result.msg is not defined or (
('Could not resolve host' not in common_git_samba_result.msg)
and ('Connection timed out' not in common_git_samba_result.msg)
and ('Failed to connect to' not in common_git_samba_result.msg)
and ('Connection reset by peer' not in common_git_samba_result.msg)
and ('Operation timed out' not in common_git_samba_result.msg)
)
)
tags: tags:
- git-samba-server-repositories - git-samba-server-repositories
@@ -53,14 +93,22 @@
# --- # ---
- name: (git.yml) Install/Update gateway repositories - name: (git.yml) Install/Update gateway repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_gateway_repositories }}' version: >-
{{
item.version
| default(item.branch)
| default(
'master'
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
else 'main'
)
}}
with_items: "{{ git_gateway_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['gateway_server']|string is search(inventory_hostname)" when: "groups['gateway_server']|string is search(inventory_hostname)"
tags: tags:
- git-gateway-server-repositories - git-gateway-server-repositories
roles/common/tasks/luks.yml
+1 -2
View File
@@ -1,6 +1,5 @@
- name: (luks.ym) add new key to the LUKS container (container has to exist) - name: (luks.ym) add new key to the LUKS container (container has to exist)
luks_device: community.crypto.luks_device:
device: "{{ luks_device }}" device: "{{ luks_device }}"
keyfile: "{{ role_path + '/files/vault/luks_default_passwd' }}" keyfile: "{{ role_path + '/files/vault/luks_default_passwd' }}"
new_keyfile: "{{ role_path + '/files/vault/luks_chris_passwd' }}" new_keyfile: "{{ role_path + '/files/vault/luks_chris_passwd' }}"
roles/common/tasks/main.yml
+52 -31
View File
@@ -5,7 +5,8 @@
# timezone # timezone
# locales # locales
# systemd-nofiles # systemd-nofiles
- import_tasks: basic.yml - name: (main.yml) Import basic.yml tasks
ansible.builtin.import_tasks: basic.yml
tags: tags:
- basic - basic
@@ -13,7 +14,8 @@
# tags supported inside sshd.yml # tags supported inside sshd.yml
# #
# sshd-config # sshd-config
- import_tasks: sshd.yml - name: (main.yml) Import sshd.yml tasks
ansible.builtin.import_tasks: sshd.yml
tags: sshd tags: sshd
@@ -27,18 +29,21 @@
# apt-remove # apt-remove
# apt-autoremove # apt-autoremove
# apt-clean # apt-clean
- import_tasks: apt.yml - name: (main.yml) Import apt.yml tasks
ansible.builtin.import_tasks: apt.yml
tags: apt tags: apt
- import_tasks: default-users.yml - name: (main.yml) Import default-users.yml tasks
ansible.builtin.import_tasks: default-users.yml
tags: default-user tags: default-user
# tags supported inside systemd-resolved.yml # tags supported inside systemd-resolved.yml
# #
# systemd-resolved # systemd-resolved
- import_tasks: systemd-resolved.yml - name: (main.yml) Import systemd-resolved.yml tasks
ansible.builtin.import_tasks: systemd-resolved.yml
tags: tags:
- systemd-resolved - systemd-resolved
when: when:
@@ -52,7 +57,8 @@
# git-default-repositories # git-default-repositories
# git-file-server-repositories # git-file-server-repositories
# git-gateway-server-repositories # git-gateway-server-repositories
- import_tasks: git.yml - name: (main.yml) Import git.yml tasks
ansible.builtin.import_tasks: git.yml
tags: git tags: git
@@ -60,7 +66,8 @@
# #
# cups-server # cups-server
# cups-client # cups-client
- import_tasks: cups-install.yml - name: (main.yml) Import cups-install.yml tasks
ansible.builtin.import_tasks: cups-install.yml
tags: tags:
- cups - cups
@@ -68,7 +75,8 @@
# tags supported inside nis-user.yml: # tags supported inside nis-user.yml:
# #
# nis-user # nis-user
- import_tasks: nis-user.yml - name: (main.yml) Import nis-user.yml tasks
ansible.builtin.import_tasks: nis-user.yml
when: "groups['nis_server']|string is search(inventory_hostname)" when: "groups['nis_server']|string is search(inventory_hostname)"
tags: tags:
- nis-user - nis-user
@@ -77,14 +85,16 @@
# tags supported inside ntp.yml: # tags supported inside ntp.yml:
# #
# ntp-server # ntp-server
- import_tasks: ntp.yml - name: (main.yml) Import ntp.yml tasks
ansible.builtin.import_tasks: ntp.yml
tags: tags:
- ntp - ntp
# tags supported inside pure-ftpd-install.yml: # tags supported inside pure-ftpd-install.yml:
# #
- import_tasks: pure-ftpd-install.yml - name: (main.yml) Import pure-ftpd-install.yml tasks
ansible.builtin.import_tasks: pure-ftpd-install.yml
when: when:
- groups['ftp_server']|string is search(inventory_hostname) - groups['ftp_server']|string is search(inventory_hostname)
tags: tags:
@@ -95,7 +105,8 @@
# #
# nfs-server # nfs-server
# nfs-client # nfs-client
- import_tasks: nfs.yml - name: (main.yml) Import nfs.yml tasks
ansible.builtin.import_tasks: nfs.yml
tags: tags:
- nfs - nfs
@@ -104,7 +115,8 @@
# #
# samba-server # samba-server
# samba-client # samba-client
- import_tasks: samba-install.yml - name: (main.yml) Import samba-install.yml tasks
ansible.builtin.import_tasks: samba-install.yml
tags: tags:
- samba-install - samba-install
- samba - samba
@@ -112,14 +124,16 @@
# tags supported inside samba-remove-user.yml: # tags supported inside samba-remove-user.yml:
# #
- import_tasks: samba-remove-user.yml - name: (main.yml) Import samba-remove-user.yml tasks
ansible.builtin.import_tasks: samba-remove-user.yml
tags: tags:
- samba-remove-user - samba-remove-user
# tags supported inside system-remove-user.yml: # tags supported inside system-remove-user.yml:
# #
- import_tasks: system-remove-user.yml - name: (main.yml) Import system-remove-user.yml tasks
ansible.builtin.import_tasks: system-remove-user.yml
tags: tags:
- system-remove-user - system-remove-user
@@ -127,7 +141,8 @@
# tags supported inside system-user.yml: # tags supported inside system-user.yml:
# #
# system-user # system-user
- import_tasks: system-user.yml - name: (main.yml) Import system-user.yml tasks
ansible.builtin.import_tasks: system-user.yml
when: "groups['file_server']|string is search(inventory_hostname)" when: "groups['file_server']|string is search(inventory_hostname)"
tags: tags:
- system-user - system-user
@@ -136,7 +151,8 @@
# tags supported inside nis-install-server.yml: # tags supported inside nis-install-server.yml:
# #
# nis-install-server # nis-install-server
- import_tasks: nis-install-server.yml - name: (main.yml) Import nis-install-server.yml tasks
ansible.builtin.import_tasks: nis-install-server.yml
when: "groups['nis_server']|string is search(inventory_hostname)" when: "groups['nis_server']|string is search(inventory_hostname)"
tags: tags:
- nis-install - nis-install
@@ -146,7 +162,8 @@
# tags supported inside nis-install-client.yml: # tags supported inside nis-install-client.yml:
# #
# nis-install-client # nis-install-client
- import_tasks: nis-install-client.yml - name: (main.yml) Import nis-install-client.yml tasks
ansible.builtin.import_tasks: nis-install-client.yml
when: "groups['nis_client']|string is search(inventory_hostname)" when: "groups['nis_client']|string is search(inventory_hostname)"
tags: tags:
- nis-install - nis-install
@@ -156,7 +173,8 @@
# tags supported inside samba-user.yml: # tags supported inside samba-user.yml:
# #
# samba-user # samba-user
- import_tasks: samba-user.yml - name: (main.yml) Import samba-user.yml tasks
ansible.builtin.import_tasks: samba-user.yml
when: "groups['samba_server']|string is search(inventory_hostname)" when: "groups['samba_server']|string is search(inventory_hostname)"
tags: tags:
- nis-samba-user - nis-samba-user
@@ -167,7 +185,8 @@
# profile # profile
# bashrc # bashrc
# vimrc # vimrc
- import_tasks: system-user-systemfiles.yml - name: (main.yml) Import system-user-systemfiles.yml tasks
ansible.builtin.import_tasks: system-user-systemfiles.yml
when: "groups['file_server']|string is search(inventory_hostname)" when: "groups['file_server']|string is search(inventory_hostname)"
tags: tags:
- user-systemfiles - user-systemfiles
@@ -178,7 +197,8 @@
# profile # profile
# bashrc # bashrc
# vimrc # vimrc
- import_tasks: nis-user-systemfiles.yml - name: (main.yml) Import nis-user-systemfiles.yml tasks
ansible.builtin.import_tasks: nis-user-systemfiles.yml
when: "groups['nis_server']|string is search(inventory_hostname)" when: "groups['nis_server']|string is search(inventory_hostname)"
tags: tags:
- user-systemfiles - user-systemfiles
@@ -188,7 +208,8 @@
# tags supported root-files-scripts.yml: # tags supported root-files-scripts.yml:
# wakeup_lan # wakeup_lan
- import_tasks: root-files-scripts.yml - name: (main.yml) Import root-files-scripts.yml tasks
ansible.builtin.import_tasks: root-files-scripts.yml
tags: tags:
- root-files-scripts - root-files-scripts
@@ -198,7 +219,8 @@
# sudoers-remove # sudoers-remove
# sudoers-file-configuration # sudoers-file-configuration
# sudoers-global-configuration # sudoers-global-configuration
- import_tasks: sudoers-pc.yml - name: (main.yml) Import sudoers-pc.yml tasks
ansible.builtin.import_tasks: sudoers-pc.yml
when: "groups['client_pc']|string is search(inventory_hostname)" when: "groups['client_pc']|string is search(inventory_hostname)"
tags: tags:
- sudoers - sudoers
@@ -209,18 +231,18 @@
# sudoers-remove # sudoers-remove
# sudoers-file-configuration # sudoers-file-configuration
# sudoers-global-configuration # sudoers-global-configuration
- import_tasks: sudoers-server.yml - name: (main.yml) Import sudoers-server.yml tasks
ansible.builtin.import_tasks: sudoers-server.yml
when: "groups['file_server']|string is search(inventory_hostname)" when: "groups['file_server']|string is search(inventory_hostname)"
tags: tags:
- sudoers - sudoers
- import_tasks: cron.yml - name: (main.yml) Import cron.yml tasks
ansible.builtin.import_tasks: cron.yml
tags: tags:
- cron - cron
# tags supported inside mount_samba_shares.yml: # tags supported inside mount_samba_shares.yml:
# #
# - import_tasks: mount_samba_shares.yml # - import_tasks: mount_samba_shares.yml
@@ -236,7 +258,7 @@
# - Ubuntu 18.04LTSi # - Ubuntu 18.04LTSi
- name: "For OS: Ubuntu 16.04LTS, Arch: amd64" - name: "For OS: Ubuntu 16.04LTS, Arch: amd64"
import_tasks: ubuntu-x11vnc-1604-amd64.yml ansible.builtin.import_tasks: ubuntu-x11vnc-1604-amd64.yml
when: when:
- ansible_facts["distribution_version"] == "16.04" - ansible_facts["distribution_version"] == "16.04"
- ansible_architecture == "x86_64" - ansible_architecture == "x86_64"
@@ -247,7 +269,7 @@
- name: "For OS: Ubuntu 18.04LTS, Arch: amd64" - name: "For OS: Ubuntu 18.04LTS, Arch: amd64"
import_tasks: ubuntu-x11vnc-1804-amd64.yml ansible.builtin.import_tasks: ubuntu-x11vnc-1804-amd64.yml
when: when:
- ansible_facts["distribution_version"] == "18.04" - ansible_facts["distribution_version"] == "18.04"
- ansible_architecture == "x86_64" - ansible_architecture == "x86_64"
@@ -258,7 +280,7 @@
- name: "For OS: Ubuntu 20.04LTS, Arch: amd64" - name: "For OS: Ubuntu 20.04LTS, Arch: amd64"
import_tasks: ubuntu-x11vnc-2004-amd64.yml ansible.builtin.import_tasks: ubuntu-x11vnc-2004-amd64.yml
when: when:
- ansible_facts["distribution_version"] == "20.04" - ansible_facts["distribution_version"] == "20.04"
- ansible_architecture == "x86_64" - ansible_architecture == "x86_64"
@@ -269,7 +291,7 @@
- name: "For OS: Ubuntu 22.04LTS, Arch: amd64" - name: "For OS: Ubuntu 22.04LTS, Arch: amd64"
import_tasks: ubuntu-x11vnc-2204-amd64.yml ansible.builtin.import_tasks: ubuntu-x11vnc-2204-amd64.yml
when: when:
- ansible_facts["distribution_version"] == "22.04" - ansible_facts["distribution_version"] == "22.04"
- ansible_architecture == "x86_64" - ansible_architecture == "x86_64"
@@ -279,7 +301,6 @@
- finish-client-install - finish-client-install
# - name: "Configure LUKS" # - name: "Configure LUKS"
# import_tasks: luks.yml # import_tasks: luks.yml
# when: "groups['client_pc']|string is search(inventory_hostname)" # when: "groups['client_pc']|string is search(inventory_hostname)"
roles/common/tasks/mount_samba_shares.yml
+1 -1
View File
@@ -2,7 +2,7 @@
- name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists - name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists
file: ansible.builtin.file:
path: "/mnt/{{ item.name }}" path: "/mnt/{{ item.name }}"
owner: "{{ item.name }}" owner: "{{ item.name }}"
group: "{{ item.name }}" group: "{{ item.name }}"
roles/common/tasks/nfs.yml
+24 -20
View File
@@ -5,7 +5,7 @@
# --- # ---
- name: (nfs.yml) Ensure NFS utilities (server) are installed. - name: (nfs.yml) Ensure NFS utilities (server) are installed.
apt: ansible.builtin.apt:
name: name:
- nfs-common - nfs-common
- nfs-kernel-server - nfs-kernel-server
@@ -17,7 +17,7 @@
- nfs-server - nfs-server
- name: (nfs.yml) Ensure directories to export exist - name: (nfs.yml) Ensure directories to export exist
file: ansible.builtin.file:
path: '{{ item.src.split(":")[1] }}' path: '{{ item.src.split(":")[1] }}'
owner: root owner: root
group: root group: root
@@ -37,7 +37,7 @@
dest: /etc/exports dest: /etc/exports
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
when: when:
- inventory_hostname in groups['nfs_server'] - inventory_hostname in groups['nfs_server']
notify: Reload nfs notify: Reload nfs
@@ -45,15 +45,15 @@
- nfs-server - nfs-server
- name: Enable service rpc-statd and ensure it is not masked - name: Enable service rpc-statd and ensure it is not masked
systemd: ansible.builtin.systemd:
name: rpc-statd name: rpc-statd
enabled: yes enabled: true
masked: no masked: false
when: when:
- inventory_hostname in groups['nfs_server'] - inventory_hostname in groups['nfs_server']
- name: Make sure service rpc-statd is running - name: Make sure service rpc-statd is running
systemd: ansible.builtin.systemd:
state: started state: started
name: rpc-statd name: rpc-statd
when: when:
@@ -66,24 +66,31 @@
# --- # ---
- name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists - name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/default/nfs-kernel-server path: /etc/default/nfs-kernel-server
register: default_nfs_kernel_server_exists register: common_default_nfs_kernel_server_exists
when: when:
- inventory_hostname in groups['nfs_server'] - inventory_hostname in groups['nfs_server']
tags: tags:
- nfs-server - nfs-server
- name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server - name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server
command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG ansible.builtin.copy:
src: /etc/default/nfs-kernel-server
dest: /etc/default/nfs-kernel-server.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- inventory_hostname in groups['nfs_server'] - inventory_hostname in groups['nfs_server']
- default_nfs_kernel_server_exists.stat.exists == False - common_default_nfs_kernel_server_exists.stat.exists
tags: tags:
- nfs-server - nfs-server
- name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server) - name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server)
replace: ansible.builtin.replace:
path: /etc/default/nfs-kernel-server path: /etc/default/nfs-kernel-server
regexp: '^RPCNFSDCOUNT=.*' regexp: '^RPCNFSDCOUNT=.*'
replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}" replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}"
@@ -97,10 +104,10 @@
# --- # ---
- name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists - name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists
file: ansible.builtin.file:
path: /etc/nfs.conf.d path: /etc/nfs.conf.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -115,7 +122,7 @@
dest: /etc/nfs.conf.d/20-start_servers.conf dest: /etc/nfs.conf.d/20-start_servers.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: "Restart nfs-kernel-server" notify: "Restart nfs-kernel-server"
when: when:
- inventory_hostname in groups['nfs_server'] - inventory_hostname in groups['nfs_server']
@@ -128,7 +135,7 @@
# --- # ---
- name: (nfs.yml) Ensure NFS utilities (clients) are installed. - name: (nfs.yml) Ensure NFS utilities (clients) are installed.
apt: ansible.builtin.apt:
pkg: nfs-common pkg: nfs-common
state: present state: present
when: when:
@@ -138,7 +145,7 @@
- nfs-client - nfs-client
- name: (nfs.yml) NFS Mount exports from nfs server - name: (nfs.yml) NFS Mount exports from nfs server
mount: ansible.posix.mount:
path: "{{ item.path }}" path: "{{ item.path }}"
src: "{{ item.src }}" src: "{{ item.src }}"
fstype: nfs fstype: nfs
@@ -153,6 +160,3 @@
- inventory_hostname in groups['nfs_client'] - inventory_hostname in groups['nfs_client']
tags: tags:
- nfs-client - nfs-client
roles/common/tasks/nis-install-client.yml
+50 -30
View File
@@ -10,7 +10,7 @@
src: etc/defaultdomain.j2 src: etc/defaultdomain.j2
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
@@ -21,13 +21,13 @@
src: etc/yp.conf.j2 src: etc/yp.conf.j2
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Install nis common packages - name: (nis-install-client.yml) Install nis common packages
package: ansible.builtin.package:
name: "{{ item }}" name: "{{ item }}"
state: present state: present
with_items: "{{ nis_common_packages }}" with_items: "{{ nis_common_packages }}"
@@ -41,23 +41,30 @@
# --- # ---
- name: (nis-install-client.yml) Check if file '/etc/default/nis.ORIG' exists - name: (nis-install-client.yml) Check if file '/etc/default/nis.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/default/nis.ORIG path: /etc/default/nis.ORIG
register: default_nis_exists register: common_default_nis_exists
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Backup existing file /etc/default/nis - name: (nis-install-client.yml) Backup existing file /etc/default/nis
command: cp -a /etc/default/nis /etc/default/nis.ORIG ansible.builtin.copy:
src: /etc/default/nis
dest: /etc/default/nis.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- default_nis_exists.stat.exists == False - not common_default_nis_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISSERVER' (client) - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISSERVER' (client)
replace: ansible.builtin.replace:
path: /etc/default/nis path: /etc/default/nis
regexp: '^NISSERVER=.*' regexp: '^NISSERVER=.*'
replace: 'NISSERVER=false' replace: 'NISSERVER=false'
@@ -66,7 +73,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (client) - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (client)
replace: ansible.builtin.replace:
path: /etc/default/nis path: /etc/default/nis
regexp: '^NISCLIENT=.*' regexp: '^NISCLIENT=.*'
replace: 'NISCLIENT=true' replace: 'NISCLIENT=true'
@@ -75,7 +82,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'YPBINDARGS' (client) - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'YPBINDARGS' (client)
replace: ansible.builtin.replace:
path: /etc/default/nis path: /etc/default/nis
regexp: '^YPBINDARGS=.*' regexp: '^YPBINDARGS=.*'
replace: 'YPBINDARGS=' replace: 'YPBINDARGS='
@@ -89,7 +96,7 @@
# --- # ---
- name: (nis-install-client.yml) Add '+::::::' to file /etc/passwd - name: (nis-install-client.yml) Add '+::::::' to file /etc/passwd
lineinfile: ansible.builtin.lineinfile:
path: /etc/passwd path: /etc/passwd
line: '+::::::' line: '+::::::'
insertafter: EOF insertafter: EOF
@@ -103,7 +110,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Add '+:::' to file /etc/group - name: (nis-install-client.yml) Add '+:::' to file /etc/group
lineinfile: ansible.builtin.lineinfile:
path: /etc/group path: /etc/group
line: '+:::' line: '+:::'
insertafter: EOF insertafter: EOF
@@ -117,7 +124,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Add '+::::::::' to file /etc/shadow - name: (nis-install-client.yml) Add '+::::::::' to file /etc/shadow
lineinfile: ansible.builtin.lineinfile:
path: /etc/shadow path: /etc/shadow
line: '+::::::::' line: '+::::::::'
insertafter: EOF insertafter: EOF
@@ -136,23 +143,30 @@
# --- # ---
- name: (nis-install-client.yml) Check if file '/etc/hosts.ORIG' exists - name: (nis-install-client.yml) Check if file '/etc/hosts.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/hosts.ORIG path: /etc/hosts.ORIG
register: etc_hosts_orig_exists register: common_etc_hosts_orig_exists
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Backup existing file /etc/hosts - name: (nis-install-client.yml) Backup existing file /etc/hosts
command: cp -a /etc/hosts /etc/hosts.ORIG ansible.builtin.copy:
src: /etc/hosts
dest: /etc/hosts.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- etc_hosts_orig_exists.stat.exists == False - not common_etc_hosts_orig_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Add nis-server to file /etc/hosts - name: (nis-install-client.yml) Add nis-server to file /etc/hosts
lineinfile: ansible.builtin.lineinfile:
path: /etc/hosts path: /etc/hosts
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}' line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
insertafter: EOF insertafter: EOF
@@ -170,23 +184,30 @@
# --- # ---
- name: (nis-install-client.yml) Check if file '/etc/nsswitch.conf.ORIG' exists - name: (nis-install-client.yml) Check if file '/etc/nsswitch.conf.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/nsswitch.conf.ORIG path: /etc/nsswitch.conf.ORIG
register: nsswitch_conf_orig_exists register: common_nsswitch_conf_orig_exists
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Backup existing file /etc/nsswitch.conf - name: (nis-install-client.yml) Backup existing file /etc/nsswitch.conf
command: cp -a /etc/nsswitch.conf /etc/nsswitch.conf.ORIG ansible.builtin.copy:
src: /etc/nsswitch.conf
dest: /etc/nsswitch.conf.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- nsswitch_conf_orig_exists.stat.exists == False - not common_nsswitch_conf_orig_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set hosts) - name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set hosts)
replace: ansible.builtin.replace:
path: /etc/nsswitch.conf path: /etc/nsswitch.conf
regexp: '(hosts:\s+files)\s+((?!nis).*)$' regexp: '(hosts:\s+files)\s+((?!nis).*)$'
replace: '\1 nis \2' replace: '\1 nis \2'
@@ -195,7 +216,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set passwd/group/shadow) - name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set passwd/group/shadow)
replace: ansible.builtin.replace:
path: /etc/nsswitch.conf path: /etc/nsswitch.conf
regexp: '^({{ item }}:\s+((?!nis).)*)$' regexp: '^({{ item }}:\s+((?!nis).)*)$'
replace: '\1 nis' replace: '\1 nis'
@@ -239,7 +260,7 @@
# - systemctl restart systemd-logind.service # - systemctl restart systemd-logind.service
- name: (nis-install-client.yml) Ensure directory /etc/systemd/system/systemd-logind.service.d exists - name: (nis-install-client.yml) Ensure directory /etc/systemd/system/systemd-logind.service.d exists
file: ansible.builtin.file:
path: /etc/systemd/system/systemd-logind.service.d path: /etc/systemd/system/systemd-logind.service.d
owner: root owner: root
group: root group: root
@@ -251,7 +272,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf exists - name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf exists
copy: ansible.builtin.copy:
src: "{{ role_path + '/files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf' }}" src: "{{ role_path + '/files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf' }}"
dest: /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf dest: /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
owner: root owner: root
@@ -281,7 +302,7 @@
# - cat /etc/systemd/system/rpcbind.socket.d/override.conf # - cat /etc/systemd/system/rpcbind.socket.d/override.conf
- name: (nis-install-client.yml) Ensure directory /etc/systemd/system/rpcbind.socket.d exists - name: (nis-install-client.yml) Ensure directory /etc/systemd/system/rpcbind.socket.d exists
file: ansible.builtin.file:
path: /etc/systemd/system/rpcbind.socket.d path: /etc/systemd/system/rpcbind.socket.d
owner: root owner: root
group: root group: root
@@ -293,7 +314,7 @@
- nis-install-client - nis-install-client
- name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/rpcbind.socket.d/override.conf exists - name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/rpcbind.socket.d/override.conf exists
copy: ansible.builtin.copy:
src: "{{ role_path + '/files/etc/systemd/system/rpcbind.socket.d/override.conf' }}" src: "{{ role_path + '/files/etc/systemd/system/rpcbind.socket.d/override.conf' }}"
dest: /etc/systemd/system/rpcbind.socket.d/override.conf dest: /etc/systemd/system/rpcbind.socket.d/override.conf
owner: root owner: root
@@ -307,7 +328,7 @@
- nis-install-client - nis-install-client
- name: Make sure service rpcbind, nscd and ypbind are started and enabled - name: Make sure service rpcbind, nscd and ypbind are started and enabled
systemd: ansible.builtin.systemd:
name: "{{ item }}" name: "{{ item }}"
state: restarted state: restarted
enabled: true enabled: true
@@ -315,4 +336,3 @@
- rpcbind - rpcbind
- nscd - nscd
- ypbind - ypbind
roles/common/tasks/nis-install-server.yml
+78 -44
View File
@@ -5,11 +5,11 @@
# --- # ---
- name: (nis-install-server.yml) Install nis common packages - name: (nis-install-server.yml) Install nis common packages
package: ansible.builtin.package:
name: "{{ item }}" name: "{{ item }}"
state: present state: present
with_items: "{{ nis_common_packages }}" with_items: "{{ nis_common_packages }}"
register: nis_installed register: common_nis_installed
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
@@ -20,7 +20,7 @@
src: etc/defaultdomain.j2 src: etc/defaultdomain.j2
owner: root owner: root
group: root group: root
mode: 644 mode: "0644"
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
@@ -31,13 +31,14 @@
src: etc/yp.conf.j2 src: etc/yp.conf.j2
owner: root owner: root
group: root group: root
mode: 644 mode: "0644"
tags: tags:
- nis-install - nis-install
- nis-install-client - nis-install-client
- name: (nis-install-server.yml) Set local host's domain name - name: (nis-install-server.yml) Set local host's domain name
command: domainname "{{ nis_domain }}" ansible.builtin.command: domainname "{{ nis_domain }}"
changed_when: false
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
@@ -51,9 +52,9 @@
# --- # ---
- name: (nis-install-server.yml) Check if file '/etc/pam.d/common-password' exists - name: (nis-install-server.yml) Check if file '/etc/pam.d/common-password' exists
stat: ansible.builtin.stat:
path: /etc/pam.d/common-password path: /etc/pam.d/common-password
register: file_etc_pam_d_common_password register: common_file_etc_pam_d_common_password
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
@@ -62,27 +63,27 @@
- ansible_facts['distribution_major_version']|int >= 11 - ansible_facts['distribution_major_version']|int >= 11
- name: (nis-install-server.yml) Check if default hash for password is 'yescrypt' - name: (nis-install-server.yml) Check if default hash for password is 'yescrypt'
shell: "grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password" ansible.builtin.command: grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password
register: presence_of_passwprd_hashing_yescrypt register: common_presence_of_passwprd_hashing_yescrypt
changed_when: changed_when: false
- presence_of_passwprd_hashing_yescrypt.rc < 1
failed_when: failed_when:
- presence_of_passwprd_hashing_yescrypt.rc >= 2 - common_presence_of_passwprd_hashing_yescrypt.rc >= 2
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- ansible_facts['distribution_major_version']|int >= 11 - ansible_facts['distribution_major_version']|int >= 11
- file_etc_pam_d_common_password.stat.exists == True - common_file_etc_pam_d_common_password.stat.exists
# - ansible_distribution_major_version|int <= 12 # - ansible_distribution_major_version|int <= 12
- name: (nis-install-server.yml) Change default password hash for local system - name: (nis-install-server.yml) Change default password hash for local system accounts from yescrypt to SHA-512
accounts from SHA-512 to yescrypt ansible.builtin.replace:
shell: perl -i -n -p -e "s/^(password.+)yescrypt/\1sha512/" path: /etc/pam.d/common-password
/etc/pam.d/common-password regexp: '^(password.+)yescrypt'
replace: '\1sha512'
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- ansible_facts['distribution_major_version']|int >= 11 - ansible_facts['distribution_major_version']|int >= 11
- file_etc_pam_d_common_password.stat.exists == True - common_file_etc_pam_d_common_password.stat.exists
- presence_of_passwprd_hashing_yescrypt is changed - common_presence_of_passwprd_hashing_yescrypt.rc == 0
# - ansible_facts['distribution_major_version']|int <= 12 # - ansible_facts['distribution_major_version']|int <= 12
@@ -91,24 +92,31 @@
# --- # ---
- name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists - name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/default/nis.ORIG path: /etc/default/nis.ORIG
register: default_nis_exists register: common_default_nis_exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Backup existing file /etc/default/nis - name: (nis-install-server.yml) Backup existing file /etc/default/nis
command: cp -a /etc/default/nis /etc/default/nis.ORIG ansible.builtin.copy:
src: /etc/default/nis
dest: /etc/default/nis.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- default_nis_exists.stat.exists == False - not common_default_nis_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER' - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER'
(server) (server)
replace: ansible.builtin.replace:
path: /etc/default/nis path: /etc/default/nis
regexp: "^NISSERVER=.*" regexp: "^NISSERVER=.*"
replace: "NISSERVER=master" replace: "NISSERVER=master"
@@ -118,7 +126,7 @@
- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT' - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT'
(server) (server)
replace: ansible.builtin.replace:
path: /etc/default/nis path: /etc/default/nis
regexp: "^NISCLIENT=.*" regexp: "^NISCLIENT=.*"
replace: "NISCLIENT=false" replace: "NISCLIENT=false"
@@ -131,24 +139,31 @@
# --- # ---
- name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists - name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/ypserv.securenets.ORIG path: /etc/ypserv.securenets.ORIG
register: ypserv_securenets_orig_exists register: common_ypserv_securenets_orig_exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets - name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets
command: cp -a /etc/ypserv.securenets /etc/ypserv.securenets.ORIG ansible.builtin.copy:
src: /etc/ypserv.securenets
dest: /etc/ypserv.securenets.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- ypserv_securenets_orig_exists.stat.exists == False - not common_ypserv_securenets_orig_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file - name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file
/etc/ypserv.securenets /etc/ypserv.securenets
replace: ansible.builtin.replace:
path: /etc/ypserv.securenets path: /etc/ypserv.securenets
regexp: "^(0.0.0.0\\s+.*)" regexp: "^(0.0.0.0\\s+.*)"
replace: "#\\1" replace: "#\\1"
@@ -158,7 +173,7 @@
- name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file - name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file
/etc/ypserv.securenets /etc/ypserv.securenets
lineinfile: ansible.builtin.lineinfile:
path: /etc/ypserv.securenets path: /etc/ypserv.securenets
line: "255.255.0.0 192.168.0.0" line: "255.255.0.0 192.168.0.0"
insertafter: EOF insertafter: EOF
@@ -172,7 +187,7 @@
- name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file - name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file
/etc/ypserv.securenets /etc/ypserv.securenets
lineinfile: ansible.builtin.lineinfile:
path: /etc/ypserv.securenets path: /etc/ypserv.securenets
line: "255.0.0.0 10.0.0.0" line: "255.0.0.0 10.0.0.0"
insertafter: EOF insertafter: EOF
@@ -185,8 +200,13 @@
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m' - name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m'
shell: printf '\n' | /usr/lib/yp/ypinit -m ansible.builtin.command: /usr/lib/yp/ypinit -m
when: nis_installed.changed args:
stdin: "\n"
changed_when: false
when:
- ansible_facts['distribution'] == "Debian"
- ansible_facts['distribution_major_version'] | int >= 11
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
@@ -197,7 +217,7 @@
- name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually - name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually
/data/home) exists /data/home) exists
file: ansible.builtin.file:
path: "{{ nis_base_home }}" path: "{{ nis_base_home }}"
owner: root owner: root
group: root group: root
@@ -230,9 +250,9 @@
# --- # ---
- name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists' - name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists'
stat: ansible.builtin.stat:
path: /etc/adduser.conf.ORIG path: /etc/adduser.conf.ORIG
register: adduser_conf_exists register: common_adduser_conf_exists
when: when:
- nis_base_home is defined - nis_base_home is defined
- nis_base_home != '/home' - nis_base_home != '/home'
@@ -241,11 +261,18 @@
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Backup existing file /etc/adduser.conf - name: (nis-install-server.yml) Backup existing file /etc/adduser.conf
command: cp -a /etc/adduser.conf /etc/adduser.conf.ORIG ansible.builtin.copy:
src: /etc/adduser.conf
dest: /etc/adduser.conf.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- nis_base_home is defined - nis_base_home is defined
- nis_base_home != '/home' - nis_base_home != '/home'
- adduser_conf_exists.stat.exists == False - not common_adduser_conf_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
@@ -267,23 +294,30 @@
# --- # ---
- name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists' - name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists'
stat: ansible.builtin.stat:
path: /var/yp/Makefile.ORIG path: /var/yp/Makefile.ORIG
register: adduser_conf_exists register: common_yp_makefile_orig_exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Backup existing file /var/yp/Makefile - name: (nis-install-server.yml) Backup existing file /var/yp/Makefile
command: cp -a /var/yp/Makefile /var/yp/Makefile.ORIG ansible.builtin.copy:
src: /var/yp/Makefile
dest: /var/yp/Makefile.ORIG
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when: when:
- adduser_conf_exists.stat.exists == False - not common_yp_makefile_orig_exists.stat.exists
tags: tags:
- nis-install - nis-install
- nis-install-server - nis-install-server
- name: (nis-install-server.yml) Adjust file '/var/yp/Makefile' - name: (nis-install-server.yml) Adjust file '/var/yp/Makefile'
replace: ansible.builtin.replace:
path: /var/yp/Makefile path: /var/yp/Makefile
regexp: "^#?{{ item }}=.*" regexp: "^#?{{ item }}=.*"
replace: "{{ item }}=true" replace: "{{ item }}=true"
roles/common/tasks/nis-user-systemfiles.yml
+38 -27
View File
@@ -10,19 +10,19 @@
# with_items: "{{ nis_user }}" # with_items: "{{ nis_user }}"
# loop_control: # loop_control:
# label: '{{ item.name }}' # label: '{{ item.name }}'
# register: local_template_dir_nis_user # register: common_local_template_dir_nis_user
- name: (nis-user-systemfiles.yml) Check if local template directory exists for default users - name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
delegate_to: localhost delegate_to: localhost
stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
with_items: "{{ nis_user }}" with_items: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
register: local_template_dir_nis_user register: common_local_template_dir_nis_user
#- name: Print variable local_template_dir_nis_user # - name: Print variable common_local_template_dir_nis_user
# debug: var=local_template_dir_nis_user.results # debug: var=common_local_template_dir_nis_user.results
# - meta: end_play # - meta: end_play
@@ -32,9 +32,9 @@
# --- # ---
- name: (nis-user-systemfiles.yml) Check if users file '.profile.ORIG' exists - name: (nis-user-systemfiles.yml) Check if users file '.profile.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.profile.ORIG" path: "~{{ item.name }}/.profile.ORIG"
register: profile_user_orig_exists register: common_profile_user_orig_exists
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -42,12 +42,19 @@
- profile - profile
- name: (nis-user-systemfiles.yml) Backup existing users .profile file - name: (nis-user-systemfiles.yml) Backup existing users .profile file
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG ansible.builtin.copy:
loop: "{{ profile_user_orig_exists.results }}" src: "~{{ item.item.name }}/.profile"
dest: "~{{ item.item.name }}/.profile.ORIG"
remote_src: true
force: false
owner: "{{ item.item.name }}"
group: "{{ item.item.name }}"
mode: "0644"
loop: "{{ common_profile_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: when:
- item.stat.exists == False - not item.stat.exists
tags: tags:
- profile - profile
@@ -59,7 +66,7 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
register: profile_template_stats register: common_profile_template_stats
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -72,7 +79,7 @@
group: "{{ user.name }}" group: "{{ user.name }}"
mode: "0644" mode: "0644"
become: true become: true
loop: "{{ nis_user | zip(profile_template_stats.results) | list }}" loop: "{{ nis_user | zip(common_profile_template_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -83,16 +90,14 @@
tags: [bash] tags: [bash]
# -- # --
# Copy .bashrc # Copy .bashrc
# --- # ---
- name: (nis-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists - name: (nis-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.bashrc.ORIG" path: "~{{ item.name }}/.bashrc.ORIG"
register: bashrc_user_orig_exists register: common_bashrc_user_orig_exists
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -100,11 +105,18 @@
- bashrc - bashrc
- name: (nis-user-systemfiles.yml) Backup existing users .bashrc file - name: (nis-user-systemfiles.yml) Backup existing users .bashrc file
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG ansible.builtin.copy:
loop: "{{ bashrc_user_orig_exists.results }}" src: "~{{ item.item.name }}/.bashrc"
dest: "~{{ item.item.name }}/.bashrc.ORIG"
remote_src: true
force: false
owner: "{{ item.item.name }}"
group: "{{ item.item.name }}"
mode: "0644"
loop: "{{ common_bashrc_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: item.stat.exists == False when: not item.stat.exists
tags: tags:
- bashrc - bashrc
@@ -115,7 +127,7 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
register: bashrc_stats register: common_bashrc_stats
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -128,7 +140,7 @@
group: "{{ user.name }}" group: "{{ user.name }}"
mode: "0644" mode: "0644"
become: true become: true
loop: "{{ nis_user | zip(bashrc_stats.results) | list }}" loop: "{{ nis_user | zip(common_bashrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -150,7 +162,7 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
register: vimrc_stats register: common_vimrc_stats
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -162,7 +174,7 @@
owner: "{{ user.name }}" owner: "{{ user.name }}"
group: "{{ user.name }}" group: "{{ user.name }}"
mode: '0644' mode: '0644'
loop: "{{ nis_user | zip(vimrc_stats.results) | list }}" loop: "{{ nis_user | zip(common_vimrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -181,7 +193,7 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
register: dotvim_stats register: common_dotvim_stats
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -193,7 +205,7 @@
dest: "~{{ user.name }}/" dest: "~{{ user.name }}/"
mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch
become: true become: true
loop: "{{ nis_user | zip(dotvim_stats.results) | list }}" loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -213,7 +225,7 @@
recurse: true recurse: true
state: directory state: directory
become: true become: true
loop: "{{ nis_user | zip(dotvim_stats.results) | list }}" loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -222,4 +234,3 @@
user: "{{ item.0 }}" user: "{{ item.0 }}"
stat_result: "{{ item.1 }}" stat_result: "{{ item.1 }}"
tags: [vim] tags: [vim]
roles/common/tasks/nis-user.yml
+20 -21
View File
@@ -33,7 +33,7 @@
# --- # ---
- name: (nis_user.yml) Ensure nis groups exists - name: (nis_user.yml) Ensure nis groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: '{{ item.group_id | default(omit) }}'
@@ -49,14 +49,15 @@
# - meta: end_host # - meta: end_host
- name: (nis_user.yml) Get database of nis (system) users - name: (nis_user.yml) Get database of nis (system) users
getent: ansible.builtin.getent:
database: passwd database: passwd
tags: tags:
- nis-user - nis-user
- system-user - system-user
- name: (nis_user.yml) Add nis (system) users if not yet exists.. - name: (nis_user.yml) Add nis (system) users if not yet exists..
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
changed_when: true
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -69,7 +70,7 @@
- system-user - system-user
- name: (nis_user.yml) Ensure nis users exists - name: (nis_user.yml) Ensure nis users exists
user: ansible.builtin.user:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: '{{ item.user_id | default(omit) }}'
@@ -79,7 +80,7 @@
shell: '{{ item.shell | d("/bin/bash") }}' shell: '{{ item.shell | d("/bin/bash") }}'
password: "{{ item.password | password_hash('sha512') }}" password: "{{ item.password | password_hash('sha512') }}"
update_password: on_create update_password: on_create
append: yes append: true
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -90,26 +91,26 @@
- name: (nis_user.yml) Check if directory ~/.config/autostart exists - name: (nis_user.yml) Check if directory ~/.config/autostart exists
stat: ansible.builtin.stat:
path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart' path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
register: home_config_autostart register: common_home_config_autostart
tags: tags:
- nis-user - nis-user
- x11vnc - x11vnc
- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists - name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
file: ansible.builtin.file:
path: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart' path: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart'
state: directory state: directory
owner: "{{ item.item.name }}" owner: "{{ item.item.name }}"
group: "{{ item.item.name }}" group: "{{ item.item.name }}"
mode: 0700 mode: "0700"
recurse: yes recurse: true
loop: "{{ home_config_autostart.results }}" loop: "{{ common_home_config_autostart.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: not item.stat.exists|bool when: not item.stat.exists|bool
@@ -124,8 +125,8 @@
# state: directory # state: directory
# owner: "{{ item.name }}" # owner: "{{ item.name }}"
# group: "{{ item.name }}" # group: "{{ item.name }}"
# mode: 0700 # mode: "0700"
# recurse: yes # recurse: true
# loop: "{{ nis_user }}" # loop: "{{ nis_user }}"
# loop_control: # loop_control:
# label: '{{ item.name }}' # label: '{{ item.name }}'
@@ -135,24 +136,24 @@
- name: (nis_user.yml) Check if file ~/.config/autostart/x11vnc.desktop exists - name: (nis_user.yml) Check if file ~/.config/autostart/x11vnc.desktop exists
stat: ansible.builtin.stat:
path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop' path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
register: home_config_autostart_x11vnc register: common_home_config_autostart_x11vnc
tags: tags:
- nis-user - nis-user
- x11vnc - x11vnc
- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists - name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
copy: ansible.builtin.copy:
src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}" src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
dest: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart/x11vnc.desktop' dest: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart/x11vnc.desktop'
owner: '{{ item.item.name }}' owner: '{{ item.item.name }}'
group: '{{ item.item.name }}' group: '{{ item.item.name }}'
mode: 0600 mode: "0600"
loop: "{{ home_config_autostart_x11vnc.results }}" loop: "{{ common_home_config_autostart_x11vnc.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
tags: tags:
@@ -165,12 +166,10 @@
# dest: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop' # dest: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
# owner: '{{ item.name }}' # owner: '{{ item.name }}'
# group: '{{ item.name }}' # group: '{{ item.name }}'
# mode: 0600 # mode: "0600"
# loop: "{{ nis_user }}" # loop: "{{ nis_user }}"
# loop_control: # loop_control:
# label: '{{ item.name }}' # label: '{{ item.name }}'
# tags: # tags:
# - nis-user # - nis-user
# - x11vnc # - x11vnc
roles/common/tasks/ntp.yml
+14 -9
View File
@@ -5,7 +5,7 @@
# --- # ---
- name: (ntp.yml) Ensure ntpsec package is installed. - name: (ntp.yml) Ensure ntpsec package is installed.
apt: ansible.builtin.apt:
name: name:
- ntpsec - ntpsec
state: present state: present
@@ -16,17 +16,16 @@
- ntp-server - ntp-server
- name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists - name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/ntpsec/ntp.conf.ORIG path: /etc/ntpsec/ntp.conf.ORIG
register: etc_ntpsec_conf_ORIG register: common_etc_ntpsec_conf_orig
when: when:
- groups['file_server'] | string is search(inventory_hostname) - groups['file_server'] | string is search(inventory_hostname)
tags: tags:
- ntp-server - ntp-server
- name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present - name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present
file: ansible.builtin.file:
path: /var/log/ntpsec path: /var/log/ntpsec
state: directory state: directory
owner: ntpsec owner: ntpsec
@@ -37,10 +36,17 @@
- name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf' - name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf'
command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG ansible.builtin.copy:
src: /etc/ntpsec/ntp.conf
dest: /etc/ntpsec/ntp.conf.ORIG
remote_src: true
owner: root
group: root
mode: "0644"
force: false
when: when:
- groups['file_server'] | string is search(inventory_hostname) - groups['file_server'] | string is search(inventory_hostname)
- etc_ntpsec_conf_ORIG.stat.exists == False - not common_etc_ntpsec_conf_orig.stat.exists
tags: tags:
- ntp-server - ntp-server
@@ -50,10 +56,9 @@
dest: /etc/ntpsec/ntp.conf dest: /etc/ntpsec/ntp.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: Restart ntp notify: Restart ntp
when: when:
- groups['file_server'] | string is search(inventory_hostname) - groups['file_server'] | string is search(inventory_hostname)
tags: tags:
- ntp-server - ntp-server
roles/common/tasks/pure-ftpd-install.yml
+12 -10
View File
@@ -13,40 +13,42 @@
# Install PureFTP Daemon # Install PureFTP Daemon
# --- # ---
- include_tasks: pure-ftpd/setup.yml - name: (pure-ftpd-install.yml) Include pure-ftpd setup tasks.
ansible.builtin.include_tasks: pure-ftpd/setup.yml
# --- # ---
# Configure PureFTP Daemon # Configure PureFTP Daemon
# --- # ---
- include_tasks: pure-ftpd/configure.yml - name: (pure-ftpd-install.yml) Include pure-ftpd configure tasks.
ansible.builtin.include_tasks: pure-ftpd/configure.yml
# --- # ---
# Authentication Configuration # Authentication Configuration
# --- # ---
- include_tasks: pure-ftpd/authentication.yml - name: (pure-ftpd-install.yml) Include pure-ftpd authentication tasks.
ansible.builtin.include_tasks: pure-ftpd/authentication.yml
# --- # ---
# Virtual user # Virtual user
# --- # ---
- include_tasks: pure-ftpd/virtual-users.yml - name: (pure-ftpd-install.yml) Include pure-ftpd virtual user tasks.
ansible.builtin.include_tasks: pure-ftpd/virtual-users.yml
# --- # ---
# TLS Certificate # TLS Certificate
# --- # ---
- include_tasks: pure-ftpd/tls-certificate.yml - name: (pure-ftpd-install.yml) Include pure-ftpd TLS certificate tasks.
ansible.builtin.include_tasks: pure-ftpd/tls-certificate.yml
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd service is started enabled on startup. - name: (pure-ftpd-install.yml) Ensure Pure-FTPd service is started enabled on startup.
service: ansible.builtin.service:
name: pure-ftpd name: pure-ftpd
state: started state: started
enabled: yes enabled: true
roles/common/tasks/pure-ftpd/authentication.yml
+16 -16
View File
@@ -5,16 +5,16 @@
# --- # ---
- name: (pure-ftpd-install.yml) Get current authentications. - name: (pure-ftpd-install.yml) Get current authentications.
command: ls -1 {{ pureftpd_config_auth_dir }} ansible.builtin.command: ls -1 {{ pureftpd_config_auth_dir }}
register: pureftpd_current_auth register: common_pureftpd_current_auth
changed_when: false changed_when: false
- name: (pure-ftpd-install.yml) Define empty pureftpd_authentications variable. - name: (pure-ftpd-install.yml) Define empty pureftpd_authentications variable.
set_fact: ansible.builtin.set_fact:
pureftpd_authentications: [] common_pureftpd_authentications: []
- name: (pure-ftpd-install.yml) Enable PureDB authentication. - name: (pure-ftpd-install.yml) Enable PureDB authentication.
file: ansible.builtin.file:
src: "{{ pureftpd_config_conf_dir }}/PureDB" src: "{{ pureftpd_config_conf_dir }}/PureDB"
dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_puredb }}pure" dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_puredb }}pure"
state: link state: link
@@ -22,18 +22,18 @@
notify: restart Pure-FTPd notify: restart Pure-FTPd
- name: (pure-ftpd-install.yml) Add PureDB to Pure-FTPd authentications. - name: (pure-ftpd-install.yml) Add PureDB to Pure-FTPd authentications.
set_fact: ansible.builtin.set_fact:
pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']" common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']"
when: pureftpd_auth_puredb > 0 and pureftpd_config['PureDB'] is defined when: pureftpd_auth_puredb > 0 and pureftpd_config['PureDB'] is defined
- name: (pure-ftpd-install.yml) Add PAM to Pure-FTPd authentications. - name: (pure-ftpd-install.yml) Add PAM to Pure-FTPd authentications.
set_fact: ansible.builtin.set_fact:
pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']" common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']"
when: pureftpd_auth_pam > 0 and pureftpd_config['PAMAuthentication'] is defined when: pureftpd_auth_pam > 0 and pureftpd_config['PAMAuthentication'] is defined
- name: (pure-ftpd-install.yml) Enable UNIX authentication. - name: (pure-ftpd-install.yml) Enable UNIX authentication.
file: ansible.builtin.file:
src: "{{ pureftpd_config_conf_dir }}/UnixAuthentication" src: "{{ pureftpd_config_conf_dir }}/UnixAuthentication"
dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_unix }}unix" dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_unix }}unix"
state: link state: link
@@ -41,13 +41,13 @@
notify: restart Pure-FTPd notify: restart Pure-FTPd
- name: (pure-ftpd-install.yml) Add UnixAuthentication to Pure-FTPd authentications. - name: (pure-ftpd-install.yml) Add UnixAuthentication to Pure-FTPd authentications.
set_fact: ansible.builtin.set_fact:
pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']" common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']"
when: pureftpd_auth_unix > 0 and pureftpd_config['UnixAuthentication'] is defined when: pureftpd_auth_unix > 0 and pureftpd_config['UnixAuthentication'] is defined
- name: (pure-ftpd-install.yml) Enable PAM authentication. - name: (pure-ftpd-install.yml) Enable PAM authentication.
file: ansible.builtin.file:
src: "{{ pureftpd_config_conf_dir }}/PAMAuthentication" src: "{{ pureftpd_config_conf_dir }}/PAMAuthentication"
dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_pam }}pam" dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_pam }}pam"
state: link state: link
@@ -58,9 +58,9 @@
# Delete unused authentification if exists # Delete unused authentification if exists
- name: (pure-ftpd-install.yml) Delete old authentications. - name: (pure-ftpd-install.yml) Delete old authentications.
file: ansible.builtin.file:
path: "{{ pureftpd_config_auth_dir }}/{{ item }}" path: "{{ pureftpd_config_auth_dir }}/{{ item }}"
state: absent state: absent
when: item not in pureftpd_authentications when: item not in common_pureftpd_authentications
with_items: "{{ pureftpd_current_auth.stdout_lines }}" with_items: "{{ common_pureftpd_current_auth.stdout_lines }}"
notify: restart Pure-FTPd notify: restart Pure-FTPd
roles/common/tasks/pure-ftpd/configure.yml
+8 -8
View File
@@ -16,20 +16,20 @@
notify: restart Pure-FTPd notify: restart Pure-FTPd
- name: (pure-ftpd-install.yml) Compile Pure-FTPd configurations (set fact..). - name: (pure-ftpd-install.yml) Compile Pure-FTPd configurations (set fact..).
set_fact: ansible.builtin.set_fact:
pureftpd_config_compiled: "{{ pureftpd_config }}" common_pureftpd_config_compiled: "{{ pureftpd_config }}"
- name: (pure-ftpd-install.yml) Get current configuration. - name: (pure-ftpd-install.yml) Get current configuration.
command: ls -1 {{ pureftpd_config_conf_dir }} ansible.builtin.command: ls -1 {{ pureftpd_config_conf_dir }}
register: pureftpd_current_config register: common_pureftpd_current_config
changed_when: false changed_when: false
- name: (pure-ftpd-install.yml) Delete old configuration. - name: (pure-ftpd-install.yml) Delete old configuration.
file: ansible.builtin.file:
path: "{{ pureftpd_config_conf_dir }}/{{ item }}" path: "{{ pureftpd_config_conf_dir }}/{{ item }}"
state: absent state: absent
when: pureftpd_config_compiled[item] is not defined when: common_pureftpd_config_compiled[item] is not defined
with_items: "{{ pureftpd_current_config.stdout_lines }}" with_items: "{{ common_pureftpd_current_config.stdout_lines }}"
notify: restart Pure-FTPd notify: restart Pure-FTPd
# write new configuration # write new configuration
@@ -41,5 +41,5 @@
owner: root owner: root
group: root group: root
mode: '0644' mode: '0644'
with_dict: '{{ pureftpd_config_compiled }}' with_dict: '{{ common_pureftpd_config_compiled }}'
notify: restart Pure-FTPd notify: restart Pure-FTPd
roles/common/tasks/pure-ftpd/create-virtual-ftp-user.yml
+47 -19
View File
@@ -4,31 +4,59 @@
# Add virtual ftp users # Add virtual ftp users
# --- # ---
- name: "(create-virtual-ftp-user.yml) Verify if virtual ftp user {{ user.name }} exists" - name: (create-virtual-ftp-user.yml) Verify if virtual ftp user exists for {{ user.name }}
command: pure-pw show {{ user.name }} ansible.builtin.command: pure-pw show {{ user.name }}
register: pureftpd_virtual_user_exists register: common_pureftpd_virtual_user_exists
changed_when: "pureftpd_virtual_user_exists.rc != 0" changed_when: false
failed_when: failed_when:
- "pureftpd_virtual_user_exists.rc != 0" - common_pureftpd_virtual_user_exists.rc != 0
- "pureftpd_virtual_user_exists.rc != 16" - common_pureftpd_virtual_user_exists.rc != 16
ignore_errors: true
loop_control: loop_control:
label: '{{ user.name }}' label: '{{ user.name }}'
- name: "(create-virtual-ftp-user.yml) Create virtual ftp user {{ user.name }} ." - name: (create-virtual-ftp-user.yml) Create virtual ftp user for {{ user.name }}
shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw useradd {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}" ansible.builtin.shell:
#when: pureftpd_virtual_user_exists.failed is defined and pureftpd_virtual_user_exists.failed cmd: >-
when: pureftpd_virtual_user_exists.changed set -o pipefail &&
(echo {{ user.password }}; echo {{ user.password }}) |
pure-pw useradd {{ user.name }}
-u {{ user.uid | default(pureftpd_virtual_users_user) }}
-g {{ user.gid | default(pureftpd_virtual_users_group) }}
-d {{ user.homedir }}
-n {{ user.quota_files | default('""') }}
-N {{ user.quota_size | default('""') }}
-t {{ user.bandwidth_dl | default('""') }}
-T {{ user.bandwidth_ul | default('""') }}
-q {{ user.ratio_ul | default('""') }}
-Q {{ user.ratio_dl | default('""') }}
executable: /bin/bash
when: common_pureftpd_virtual_user_exists.rc == 16
changed_when: true
notify: reload Pure-FTPd users notify: reload Pure-FTPd users
- name: "User {{ user.name }}: Update virtual user" - name: (create-virtual-ftp-user.yml) Update virtual ftp user for {{ user.name }}
command: "pure-pw usermod {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}" ansible.builtin.command: >-
#when: pureftpd_virtual_user_exists.failed is defined and not pureftpd_virtual_user_exists.failed pure-pw usermod {{ user.name }}
when: not pureftpd_virtual_user_exists.changed -u {{ user.uid | default(pureftpd_virtual_users_user) }}
-g {{ user.gid | default(pureftpd_virtual_users_group) }}
-d {{ user.homedir }}
-n {{ user.quota_files | default('""') }}
-N {{ user.quota_size | default('""') }}
-t {{ user.bandwidth_dl | default('""') }}
-T {{ user.bandwidth_ul | default('""') }}
-q {{ user.ratio_ul | default('""') }}
-Q {{ user.ratio_dl | default('""') }}
when: common_pureftpd_virtual_user_exists.rc == 0
changed_when: true
notify: reload Pure-FTPd users notify: reload Pure-FTPd users
- name: "User {{ user.name }}: Update virtual user password" - name: (create-virtual-ftp-user.yml) Update virtual ftp user password for {{ user.name }}
shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw passwd {{ user.name }}" ansible.builtin.shell:
when: not pureftpd_virtual_user_exists.changed cmd: >-
set -o pipefail &&
(echo {{ user.password }}; echo {{ user.password }}) |
pure-pw passwd {{ user.name }}
executable: /bin/bash
when: common_pureftpd_virtual_user_exists.rc == 0
changed_when: true
notify: reload Pure-FTPd users notify: reload Pure-FTPd users
roles/common/tasks/pure-ftpd/remove-virtual-user.yml
+10 -10
View File
@@ -4,16 +4,16 @@
# Remove virtual ftp users # Remove virtual ftp users
# --- # ---
- name: "User {{ user.name }}: Verify if it exists" - name: (remove-virtual-user.yml) Verify virtual ftp user exists for {{ user.name }}
command: pure-pw show {{ user.name }} ansible.builtin.command: pure-pw show {{ user.name }}
register: pureftpd_virtual_user_exists register: common_pureftpd_virtual_user_exists
changed_when: "pureftpd_virtual_user_exists.rc == 0" changed_when: false
failed_when: failed_when:
- "pureftpd_virtual_user_exists.rc != 0" - common_pureftpd_virtual_user_exists.rc != 0
- "pureftpd_virtual_user_exists.rc != 16" - common_pureftpd_virtual_user_exists.rc != 16
ignore_errors: true
- name: "User {{ user.name }}: Remove virtual user" - name: (remove-virtual-user.yml) Remove virtual ftp user for {{ user.name }}
shell: "pure-pw userdel {{ user.name }}" ansible.builtin.command: pure-pw userdel {{ user.name }}
when: pureftpd_virtual_user_exists.changed when: common_pureftpd_virtual_user_exists.rc == 0
changed_when: true
notify: reload Pure-FTPd users notify: reload Pure-FTPd users
roles/common/tasks/pure-ftpd/setup.yml
+2 -2
View File
@@ -5,11 +5,11 @@
# --- # ---
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd is installed. - name: (pure-ftpd-install.yml) Ensure Pure-FTPd is installed.
apt: ansible.builtin.apt:
name: "{{ pureftpd_packages }}" name: "{{ pureftpd_packages }}"
state: present state: present
cache_valid_time: 3600 cache_valid_time: 3600
update_cache: yes update_cache: true
- name: (pure-ftpd-install.yml) Upload Pure-FTPd global configuration file. - name: (pure-ftpd-install.yml) Upload Pure-FTPd global configuration file.
ansible.builtin.template: ansible.builtin.template:
roles/common/tasks/pure-ftpd/tls-certificate.yml
+35 -6
View File
@@ -6,8 +6,37 @@
# - method 'generate' # - method 'generate'
- name: Build Pure-FTPd TLS subject.
ansible.builtin.set_fact:
common_pureftpd_tls_subject: >-
/C={{ pureftpd_tls_certificate_openssl.country | default('') }}
/ST={{ pureftpd_tls_certificate_openssl.state | default('') }}
/L={{ pureftpd_tls_certificate_openssl.locality | default('') }}
/O={{ pureftpd_tls_certificate_openssl.organization | default('') }}
/OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}
/CN={{ pureftpd_tls_certificate_openssl.fqdn }}
when:
- pureftpd_tls_certificate_method == 'generate'
- pureftpd_tls_certificate_openssl | length > 0
- name: Generate Pure-FTPd TLS certificate. - name: Generate Pure-FTPd TLS certificate.
command: openssl req -x509 -nodes -newkey rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }} -sha256 -days {{ pureftpd_tls_certificate_openssl.days | default(365) }} -keyout {{ pureftpd_tls_certificate_pem }} -out {{ pureftpd_tls_certificate_pem }} -subj "/C={{ pureftpd_tls_certificate_openssl.country | default('') }}/ST={{ pureftpd_tls_certificate_openssl.state | default('') }}/L={{ pureftpd_tls_certificate_openssl.locality | default('') }}/O={{ pureftpd_tls_certificate_openssl.organization | default('') }}/OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}/CN={{ pureftpd_tls_certificate_openssl.fqdn }}" ansible.builtin.command:
argv:
- openssl
- req
- -x509
- -nodes
- -newkey
- rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }}
- -sha256
- -days
- '{{ pureftpd_tls_certificate_openssl.days | default(365) }}'
- -keyout
- '{{ pureftpd_tls_certificate_pem }}'
- -out
- '{{ pureftpd_tls_certificate_pem }}'
- -subj
- '{{ common_pureftpd_tls_subject }}'
args: args:
creates: "{{ pureftpd_tls_certificate_pem }}" creates: "{{ pureftpd_tls_certificate_pem }}"
when: when:
@@ -16,7 +45,7 @@
notify: restart Pure-FTPd notify: restart Pure-FTPd
- name: Ensure Pure-FTPd TLS certificate permissions. - name: Ensure Pure-FTPd TLS certificate permissions.
file: ansible.builtin.file:
path: "{{ pureftpd_tls_certificate_pem }}" path: "{{ pureftpd_tls_certificate_pem }}"
owner: root owner: root
group: root group: root
@@ -29,12 +58,12 @@
# - final checks # - final checks
- name: (pure-ftpd-install.yml) Verify TLS certificate exists. - name: (pure-ftpd-install.yml) Verify TLS certificate exists.
stat: ansible.builtin.stat:
path: "{{ pureftpd_tls_certificate_pem }}" path: "{{ pureftpd_tls_certificate_pem }}"
register: pureftpd_tls_certificate register: common_pureftpd_tls_certificate
- name: (pure-ftpd-install.yml) Fail when no certificate is found. - name: (pure-ftpd-install.yml) Fail when no certificate is found.
fail: ansible.builtin.fail:
msg: | msg: |
The certificate file was not found at {{ pureftpd_tls_certificate_pem }} The certificate file was not found at {{ pureftpd_tls_certificate_pem }}
when: not pureftpd_tls_certificate.stat.exists | default(False) when: not common_pureftpd_tls_certificate.stat.exists | default(false)
roles/common/tasks/pure-ftpd/virtual-users.yml
+12 -10
View File
@@ -3,44 +3,45 @@
# Default virtual users/group # Default virtual users/group
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd group exists. - name: (pure-ftpd-install.yml) Ensure Pure-FTPd group exists.
group: ansible.builtin.group:
name: "{{ pureftpd_virtual_users_group }}" name: "{{ pureftpd_virtual_users_group }}"
gid: "{{ pureftpd_virtual_users_gid | default(omit) }}" gid: "{{ pureftpd_virtual_users_gid | default(omit) }}"
system: no system: false
state: present state: present
when: pureftpd_virtual_users | length > 0 when: pureftpd_virtual_users | length > 0
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd user exists. - name: (pure-ftpd-install.yml) Ensure Pure-FTPd user exists.
user: ansible.builtin.user:
name: "{{ pureftpd_virtual_users_user }}" name: "{{ pureftpd_virtual_users_user }}"
uid: "{{ pureftpd_virtual_users_uid | default(omit) }}" uid: "{{ pureftpd_virtual_users_uid | default(omit) }}"
group: "{{ pureftpd_virtual_users_group }}" group: "{{ pureftpd_virtual_users_group }}"
home: /dev/null home: /dev/null
shell: /usr/sbin/nologin shell: /usr/sbin/nologin
system: no system: false
state: present state: present
when: pureftpd_virtual_users | length > 0 when: pureftpd_virtual_users | length > 0
# user databas # user databas
- name: (pure-ftpd-install.yml) Verify virtual users database existence. - name: (pure-ftpd-install.yml) Verify virtual users database existence.
stat: ansible.builtin.stat:
path: "{{ pureftpd_config_dir }}/pureftpd.passwd" path: "{{ pureftpd_config_dir }}/pureftpd.passwd"
register: pureftpd_virtual_users_database register: common_pureftpd_virtual_users_database
- name: (pure-ftpd-install.yml) Ensure virtual users database exists. - name: (pure-ftpd-install.yml) Ensure virtual users database exists.
file: ansible.builtin.file:
path: "{{ pureftpd_config_dir }}/pureftpd.passwd" path: "{{ pureftpd_config_dir }}/pureftpd.passwd"
owner: root owner: root
group: root group: root
mode: '0600' mode: '0600'
state: touch state: touch
when: (pureftpd_virtual_users | length > 0) and not pureftpd_virtual_users_database.stat.exists | default(False) when: (pureftpd_virtual_users | length > 0) and not common_pureftpd_virtual_users_database.stat.exists | default(false)
# - Cretate virtual user # - Cretate virtual user
- include_tasks: create-virtual-ftp-user.yml - name: (pure-ftpd-install.yml) Include create virtual ftp user task.
ansible.builtin.include_tasks: create-virtual-ftp-user.yml
vars: vars:
user: "{{ item }}" user: "{{ item }}"
with_items: "{{ pureftpd_virtual_users }}" with_items: "{{ pureftpd_virtual_users }}"
@@ -50,7 +51,8 @@
# Remove virtual user # Remove virtual user
# - # -
- include_tasks: remove-virtual-user.yml - name: (pure-ftpd-install.yml) Include remove virtual ftp user task.
ansible.builtin.include_tasks: remove-virtual-user.yml
vars: vars:
user: "{{ item }}" user: "{{ item }}"
with_items: "{{ pureftpd_virtual_deleted_users }}" with_items: "{{ pureftpd_virtual_deleted_users }}"
roles/common/tasks/root-files-scripts.yml
+19 -13
View File
@@ -1,7 +1,7 @@
--- ---
- name: (root_files_scripts.yml) Ensure directory /root/bin exists - name: (root_files_scripts.yml) Ensure directory /root/bin exists
file: ansible.builtin.file:
path: /root/bin path: /root/bin
owner: root owner: root
group: root group: root
@@ -16,36 +16,42 @@
dest: /root/bin/wakeup_lan.sh dest: /root/bin/wakeup_lan.sh
owner: root owner: root
group: root group: root
mode: 0755 mode: "0755"
when: when:
- groups['file_server'] | string is search(inventory_hostname) - groups['file_server'] | string is search(inventory_hostname)
tags: tags:
- wakeup_lan - wakeup_lan
- name: (root_files_scripts.yml) Check file '/etc/motd.ORIG' exists - name: (root_files_scripts.yml) Check file '/etc/motd.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/motd.ORIG path: /etc/motd.ORIG
register: etc_motd_ORIG register: common_etc_motd_orig
when: when:
- "groups['file_server']|string is search(inventory_hostname)" - groups['file_server'] | string is search(inventory_hostname)
tags: tags:
- etc_motd - etc_motd
- name: (basic.yml) Backup installation version of file '/etc/motd' - name: (basic.yml) Backup installation version of file '/etc/motd'
command: cp -a /etc/motd /etc/motd.ORIG ansible.builtin.copy:
src: /etc/motd
dest: /etc/motd.ORIG
remote_src: true
owner: root
group: root
mode: "0644"
force: false
when: when:
- "groups['file_server']|string is search(inventory_hostname)" - groups['file_server'] | string is search(inventory_hostname)
- etc_motd_ORIG.stat.exists == False - not common_etc_motd_orig.stat.exists
tags: tags:
- etc_motd - etc_motd
- name: (root_files_scripts.yml) Write new '/etc/motd' file.. - name: (root_files_scripts.yml) Write new '/etc/motd' file..
shell: > ansible.builtin.shell: >
figlet '{{ nis_server_name.split(".")[0] }}' > /etc/motd figlet '{{ nis_server_name.split(".")[0] }}' > /etc/motd
changed_when: true
when: when:
- "groups['file_server']|string is search(inventory_hostname)" - groups['file_server'] | string is search(inventory_hostname)
- etc_motd_ORIG.stat.exists == False - not common_etc_motd_orig.stat.exists
tags: tags:
- etc_motd - etc_motd
roles/common/tasks/samba-install.yml
+56 -42
View File
@@ -4,7 +4,7 @@
# --- # ---
- name: (samba-install.yml) Ensure samba packages server (buster) are installed. - name: (samba-install.yml) Ensure samba packages server (buster) are installed.
package: ansible.builtin.package:
pkg: "{{ apt_install_server_samba }}" pkg: "{{ apt_install_server_samba }}"
state: present state: present
when: when:
@@ -13,7 +13,7 @@
- samba-server - samba-server
- name: (samba-install.yml) Ensure quarantine directory exists - name: (samba-install.yml) Ensure quarantine directory exists
file: ansible.builtin.file:
path: /data/samba/QUARANTINE path: /data/samba/QUARANTINE
owner: root owner: root
group: root group: root
@@ -28,13 +28,13 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-install.yml) Ensure samba share directories exists - name: (samba-install.yml) Ensure samba share directories exists
file: ansible.builtin.file:
path: "{{ item.path }}" path: "{{ item.path }}"
owner: "root" owner: "root"
group: "{{ item.group_write_list }}" group: "{{ item.group_write_list }}"
mode: "{{ item.dir_create_mask | default('2770', true) }}" mode: "{{ item.dir_create_mask | default('2770', true) }}"
state: directory state: directory
recurse: no recurse: false
with_items: "{{ samba_shares }}" with_items: "{{ samba_shares }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -48,7 +48,7 @@
# --- # ---
- name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed - name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
package: ansible.builtin.package:
pkg: "{{ apt_install_server_samba_virusfilter }}" pkg: "{{ apt_install_server_samba_virusfilter }}"
state: present state: present
when: when:
@@ -60,12 +60,12 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Check if ClamAV virus databases are present - name: (samba-config-server.yml) Check if ClamAV virus databases are present
find: ansible.builtin.find:
paths: /var/lib/clamav paths: /var/lib/clamav
patterns: patterns:
- "*.cvd" - "*.cvd"
- "*.cld" - "*.cld"
register: clamav_db_files register: common_clamav_db_files
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -74,23 +74,23 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download - name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download
service: ansible.builtin.service:
name: clamav-freshclam name: clamav-freshclam
state: stopped state: stopped
failed_when: false failed_when: false
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
- clamav_db_files.files | length == 0 - common_clamav_db_files.files | length == 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update - name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update
service: ansible.builtin.service:
name: clamav-daemon name: clamav-daemon
state: started state: started
enabled: yes enabled: true
failed_when: false failed_when: false
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
@@ -100,20 +100,21 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam - name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam
command: freshclam ansible.builtin.command: freshclam
changed_when: true
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
- clamav_db_files.files | length == 0 - common_clamav_db_files.files | length == 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started - name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started
service: ansible.builtin.service:
name: clamav-daemon name: clamav-daemon
state: started state: started
enabled: yes enabled: true
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -122,10 +123,10 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started - name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started
service: ansible.builtin.service:
name: clamav-freshclam name: clamav-freshclam
state: started state: started
enabled: yes enabled: true
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -134,10 +135,10 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-install.yml) Ensure clamav user is member of all NIS groups - name: (samba-install.yml) Ensure clamav user is member of all NIS groups
user: ansible.builtin.user:
name: clamav name: clamav
groups: "{{ item.name }}" groups: "{{ item.name }}"
append: yes append: true
loop: "{{ nis_groups }}" loop: "{{ nis_groups }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -151,10 +152,10 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav user is member of all NIS user groups (homes virusfilter) - name: (samba-config-server.yml) Ensure clamav user is member of all NIS user groups (homes virusfilter)
user: ansible.builtin.user:
name: clamav name: clamav
groups: "{{ item.name }}" groups: "{{ item.name }}"
append: yes append: true
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -173,7 +174,7 @@
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
register: samba_user_getent register: common_samba_user_getent
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_homes_virusfilter | default(false) | bool - samba_homes_virusfilter | default(false) | bool
@@ -183,11 +184,11 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter) - name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter)
file: ansible.builtin.file:
path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}" path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}"
mode: "0750" mode: "0750"
state: directory state: directory
loop: "{{ samba_user_getent.results | default([]) }}" loop: "{{ common_samba_user_getent.results | default([]) }}"
loop_control: loop_control:
label: "{{ item.item.name }}" label: "{{ item.item.name }}"
when: when:
@@ -217,7 +218,7 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf - name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
lineinfile: ansible.builtin.lineinfile:
path: /etc/clamav/clamd.conf path: /etc/clamav/clamd.conf
regexp: "^#?\\s*AllowAllMatchScan\\s" regexp: "^#?\\s*AllowAllMatchScan\\s"
line: "AllowAllMatchScan true" line: "AllowAllMatchScan true"
@@ -236,19 +237,26 @@
# --- # ---
- name: (samba-install.yml) Check if file '/etc/samba/smb.conf.ORIG exists' - name: (samba-install.yml) Check if file '/etc/samba/smb.conf.ORIG exists'
stat: ansible.builtin.stat:
path: /etc/samba/smb.conf.ORIG path: /etc/samba/smb.conf.ORIG
register: smb_conf_exists register: common_smb_conf_exists
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
tags: tags:
- samba-server - samba-server
- name: (samba-install.yml) Backup existing file /etc/samba/smb.conf - name: (samba-install.yml) Backup existing file /etc/samba/smb.conf
command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG ansible.builtin.copy:
src: /etc/samba/smb.conf
dest: /etc/samba/smb.conf.ORIG
remote_src: true
owner: root
group: root
mode: "0644"
force: false
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- smb_conf_exists.stat.exists == False - not common_smb_conf_exists.stat.exists
tags: tags:
- samba-server - samba-server
@@ -258,7 +266,7 @@
src: etc/samba/smb.conf.j2 src: etc/samba/smb.conf.j2
owner: root owner: root
group: root group: root
mode: 644 mode: "0644"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
notify: notify:
@@ -268,12 +276,12 @@
- samba-server - samba-server
- name: (samba-install.yml) Ensure file /etc/samba/users.map exists - name: (samba-install.yml) Ensure file /etc/samba/users.map exists
copy: ansible.builtin.copy:
src: "{{ role_path + '/files/etc/samba/users.map' }}" src: "{{ role_path + '/files/etc/samba/users.map' }}"
dest: /etc/samba/users.map dest: /etc/samba/users.map
owner: root owner: root
group: root group: root
mode: 644 mode: "0644"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
notify: notify:
@@ -287,9 +295,9 @@
# --- # ---
- name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists - name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists
stat: ansible.builtin.stat:
path: /root/bin/samba/clean_samba_trash.sh path: /root/bin/samba/clean_samba_trash.sh
register: clean_samba_trash_exists register: common_clean_samba_trash_exists
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
tags: tags:
@@ -300,9 +308,12 @@
ansible.builtin.template: ansible.builtin.template:
dest: /root/bin/samba/conf/clean_samba_trash.conf dest: /root/bin/samba/conf/clean_samba_trash.conf
src: root/bin/samba/conf/clean_samba_trash.conf.j2 src: root/bin/samba/conf/clean_samba_trash.conf.j2
owner: root
group: root
mode: "0644"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- clean_samba_trash_exists.stat.exists|bool - common_clean_samba_trash_exists.stat.exists | bool
tags: tags:
- samba-server - samba-server
- samba-cron - samba-cron
@@ -314,7 +325,7 @@
state: absent state: absent
check_mode: true check_mode: true
changed_when: false changed_when: false
register: clean_samba_trash_dirs register: common_clean_samba_trash_dirs
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
tags: [samba-server, samba-cron] tags: [samba-server, samba-cron]
@@ -331,8 +342,8 @@
job: "{{ samba_cronjob_trash_dirs.job }}" job: "{{ samba_cronjob_trash_dirs.job }}"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- clean_samba_trash_exists.stat.exists | bool - common_clean_samba_trash_exists.stat.exists | bool
- (clean_samba_trash_dirs.found | int) > 0 - (common_clean_samba_trash_dirs.found | int) > 0
tags: [samba-server, samba-cron] tags: [samba-server, samba-cron]
# --- # ---
@@ -342,7 +353,7 @@
- name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists - name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists
ansible.builtin.stat: ansible.builtin.stat:
path: /root/bin/samba/set_permissions_samba_shares.sh path: /root/bin/samba/set_permissions_samba_shares.sh
register: set_permissions_on_samba_shares_exists register: common_set_permissions_on_samba_shares_exists
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
tags: [samba-server, samba-cron] tags: [samba-server, samba-cron]
@@ -351,9 +362,12 @@
ansible.builtin.template: ansible.builtin.template:
dest: /root/bin/samba/conf/set_permissions_samba_shares.conf dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2 src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2
owner: root
group: root
mode: "0644"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- set_permissions_on_samba_shares_exists.stat.exists | bool - common_set_permissions_on_samba_shares_exists.stat.exists | bool
tags: [samba-server, samba-cron] tags: [samba-server, samba-cron]
- name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs - name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs
@@ -368,7 +382,7 @@
job: "{{ samba_cronjob_permissions.job }}" job: "{{ samba_cronjob_permissions.job }}"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- (clean_samba_trash_dirs.found | int) > 0 # << int -> bool - (common_clean_samba_trash_dirs.found | int) > 0 # << int -> bool
tags: [samba-server, samba-cron] tags: [samba-server, samba-cron]
# --- # ---
@@ -376,7 +390,7 @@
# --- # ---
- name: (samba-install.yml) Ensure samba packages clients are installed. - name: (samba-install.yml) Ensure samba packages clients are installed.
package: ansible.builtin.package:
pkg: "{{ apt_install_client_samba }}" pkg: "{{ apt_install_client_samba }}"
state: present state: present
when: when:
roles/common/tasks/samba-remove-user.yml
+24 -16
View File
@@ -6,10 +6,14 @@
- name: (samba-remove-user.yml) Check if samba user exists for removable system user - name: (samba-remove-user.yml) Check if samba user exists for removable system user
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}' ansible.builtin.shell:
register: samba_remove_system_users_present cmd: >-
changed_when: "samba_remove_system_users_present.rc == 0" set -o pipefail &&
failed_when: "samba_remove_system_users_present.rc > 1" pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
executable: /bin/bash
register: common_samba_remove_system_users_present
changed_when: false
failed_when: common_samba_remove_system_users_present.rc > 1
with_items: with_items:
- "{{ remove_system_users }}" - "{{ remove_system_users }}"
loop_control: loop_control:
@@ -19,23 +23,27 @@
- name: (samba-remove-user.yml) Remove (old) system users from samba - name: (samba-remove-user.yml) Remove (old) system users from samba
shell: > ansible.builtin.command: smbpasswd -s -x {{ item.item.name }}
smbpasswd -s -x {{ item.item.name }} changed_when: true
with_items: with_items:
- "{{ samba_remove_system_users_present.results }}" - "{{ common_samba_remove_system_users_present.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: when:
- item.changed - item.rc == 0
tags: tags:
- samba-user - samba-user
- name: (samba-remove-user.yml) Check if samba user exists for removable nis user - name: (samba-remove-user.yml) Check if samba user exists for removable nis user
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}' ansible.builtin.shell:
register: samba_remove_nis_users_present cmd: >-
changed_when: "samba_remove_nis_users_present.rc == 0" set -o pipefail &&
failed_when: "samba_remove_nis_users_present.rc > 1" pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
executable: /bin/bash
register: common_samba_remove_nis_users_present
changed_when: false
failed_when: common_samba_remove_nis_users_present.rc > 1
with_items: with_items:
- "{{ remove_nis_users }}" - "{{ remove_nis_users }}"
loop_control: loop_control:
@@ -45,13 +53,13 @@
- name: (samba-remove-user.yml) Remove (old) nis users from samba - name: (samba-remove-user.yml) Remove (old) nis users from samba
shell: > ansible.builtin.command: smbpasswd -s -x {{ item.item.name }}
smbpasswd -s -x {{ item.item.name }} changed_when: true
with_items: with_items:
- "{{ samba_remove_nis_users_present.results }}" - "{{ common_samba_remove_nis_users_present.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: when:
- item.changed - item.rc == 0
tags: tags:
- samba-user - samba-user
roles/common/tasks/samba-user.yml
+17 -10
View File
@@ -5,10 +5,14 @@
# --- # ---
- name: (samba-user.yml) Check if samba user exists for nis user - name: (samba-user.yml) Check if samba user exists for nis user
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}" ansible.builtin.shell:
register: samba_nis_user_present cmd: >-
changed_when: "samba_nis_user_present.rc == 1" set -o pipefail &&
failed_when: "samba_nis_user_present.rc > 1" pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
executable: /bin/bash
register: common_samba_nis_user_present
changed_when: false
failed_when: common_samba_nis_user_present.rc > 1
loop: "{{ nis_user }}" loop: "{{ nis_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -18,13 +22,16 @@
- samba-user - samba-user
- name: (samba-user.yml) Add nis user to samba (with nis users password) - name: (samba-user.yml) Add nis user to samba (with nis users password)
shell: > ansible.builtin.shell:
(echo '{{ item.item.password }}'; echo '{{ item.item.password }}') cmd: >-
| smbpasswd -s -a {{ item.item.name }} set -o pipefail &&
loop: "{{ samba_nis_user_present.results }}" (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') |
when: item.changed smbpasswd -s -a {{ item.item.name }}
executable: /bin/bash
changed_when: true
loop: "{{ common_samba_nis_user_present.results }}"
when: item.rc == 1
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
tags: tags:
- samba-user - samba-user
roles/common/tasks/sshd.yml
+29 -22
View File
@@ -6,40 +6,40 @@
# --- # ---
- name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list) - name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}" common_fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}"
when: when:
- sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0 - sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_ciphers (comma separated list) - name: (sshd.yml) Set fact_sshd_ciphers (comma separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}" common_fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}"
when: when:
- sshd_ciphers is defined and sshd_ciphers | length > 0 - sshd_ciphers is defined and sshd_ciphers | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_macs - name: (sshd.yml) Set fact_sshd_macs
set_fact: ansible.builtin.set_fact:
fact_sshd_macs: "{{ sshd_macs | join (',') }}" common_fact_sshd_macs: "{{ sshd_macs | join(',') }}"
when: when:
- sshd_macs is defined and sshd_macs | length > 0 - sshd_macs is defined and sshd_macs | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list) - name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}" common_fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}"
when: when:
- sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0 - sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list) - name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}" common_fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}"
when: when:
- sshd_allowed_users is defined and sshd_allowed_users | length > 0 - sshd_allowed_users is defined and sshd_allowed_users | length > 0
tags: tags:
@@ -50,15 +50,22 @@
# --- # ---
- name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists - name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/ssh/sshd_config.ORIG path: /etc/ssh/sshd_config.ORIG
register: etc_sshd_sshd_config_ORIG register: common_etc_sshd_sshd_config_orig
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config' - name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG ansible.builtin.copy:
when: etc_sshd_sshd_config_ORIG.stat.exists == False src: /etc/ssh/sshd_config
dest: /etc/ssh/sshd_config.ORIG
remote_src: true
owner: root
group: root
mode: "0644"
force: false
when: not common_etc_sshd_sshd_config_orig.stat.exists
tags: tags:
- sshd-config - sshd-config
@@ -69,7 +76,7 @@
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
validate: 'sshd -f %s -T' validate: 'sshd -f %s -T'
# backup: yes # backup: yes
notify: "Restart ssh" notify: "Restart ssh"
@@ -85,7 +92,7 @@
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
validate: 'sshd -f %s -T' validate: 'sshd -f %s -T'
notify: "Restart ssh" notify: "Restart ssh"
when: when:
@@ -101,7 +108,7 @@
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
validate: 'sshd -f %s -T -C user=sftp_users' validate: 'sshd -f %s -T -C user=sftp_users'
notify: "Restart ssh" notify: "Restart ssh"
when: when:
@@ -113,21 +120,21 @@
- name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'.. - name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
lineinfile: ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^Subsystem\s+sftp(.+)$' regexp: '^Subsystem\s+sftp(.+)$'
state: absent state: absent
check_mode: yes check_mode: true
changed_when: false changed_when: false
register: sshd_config_sftp register: sshd_config_sftp
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists - name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
file: ansible.builtin.file:
path: /etc/ssh/sshd_config.d path: /etc/ssh/sshd_config.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -142,7 +149,7 @@
dest: /etc/ssh/sshd_config.d/50-sshd-local.conf dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: "Restart ssh" notify: "Restart ssh"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
roles/common/tasks/sudoers-pc.yml
+6 -3
View File
@@ -7,7 +7,7 @@
validate: visudo -cf %s validate: visudo -cf %s
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
tags: tags:
- sudoers-file-configuration - sudoers-file-configuration
@@ -17,7 +17,7 @@
dest: /etc/sudoers dest: /etc/sudoers
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
validate: visudo -cf %s validate: visudo -cf %s
tags: tags:
- sudoers-global-configuration - sudoers-global-configuration
@@ -32,7 +32,10 @@
# - sudo-users # - sudo-users
- name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group - name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
shell: usermod -a -G sudo "{{ item }}" ansible.builtin.user:
name: "{{ item }}"
groups: sudo
append: true
with_items: "{{ sudo_pc_users }}" with_items: "{{ sudo_pc_users }}"
tags: tags:
- sudo-users - sudo-users
roles/common/tasks/sudoers-server.yml
+6 -6
View File
@@ -13,13 +13,13 @@
# - sudoers-global-configuration # - sudoers-global-configuration
- name: (sudoers-server.yml) Remove user entries in file /etc/sudoers - name: (sudoers-server.yml) Remove user entries in file /etc/sudoers
lineinfile: ansible.builtin.lineinfile:
dest: /etc/sudoers dest: /etc/sudoers
state: absent state: absent
regexp: '^{{ item }}' regexp: '^{{ item }}'
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
validate: visudo -cf %s validate: visudo -cf %s
with_items: '{{ sudoers_server_remove_user }}' with_items: '{{ sudoers_server_remove_user }}'
tags: tags:
@@ -32,7 +32,7 @@
# validate: visudo -cf %s # validate: visudo -cf %s
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
tags: tags:
- sudoers-file-configuration - sudoers-file-configuration
@@ -42,16 +42,16 @@
dest: /etc/sudoers dest: /etc/sudoers
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
# validate: visudo -cf %s # validate: visudo -cf %s
tags: tags:
- sudoers-global-configuration - sudoers-global-configuration
- name: (sudoers-server.yml) Ensure all sudo_users are in sudo group - name: (sudoers-server.yml) Ensure all sudo_users are in sudo group
user: ansible.builtin.user:
name: "{{ item }}" name: "{{ item }}"
groups: sudo groups: sudo
append: yes append: true
with_items: "{{ sudo_server_users }}" with_items: "{{ sudo_server_users }}"
tags: tags:
- sudo-users - sudo-users
roles/common/tasks/system-remove-user.yml
+2 -2
View File
@@ -5,7 +5,7 @@
# --- # ---
- name: (system-remove-user.yml) Remove (old) users from system - name: (system-remove-user.yml) Remove (old) users from system
user: ansible.builtin.user:
name: '{{ item.name }}' name: '{{ item.name }}'
state: absent state: absent
with_items: with_items:
@@ -17,7 +17,7 @@
- system-user - system-user
- name: (system-remove-user.yml) Remove home directory from deleted users - name: (system-remove-user.yml) Remove home directory from deleted users
file: ansible.builtin.file:
path: '{{ nis_base_home }}/{{ item.name }}' path: '{{ nis_base_home }}/{{ item.name }}'
state: absent state: absent
with_items: with_items:
roles/common/tasks/system-user-systemfiles.yml
+88 -54
View File
@@ -6,16 +6,22 @@
# system_user # system_user
- name: (system-user-systemfiles.yml) Check if local template directory exists for default users - name: (system-user-systemfiles.yml) Check if local template directory exists for default users
local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }} ansible.builtin.stat:
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
delegate_to: localhost
become: false
with_items: "{{ system_users }}" with_items: "{{ system_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
register: local_template_dir_system_users register: common_local_template_dir_system_users
# root # root
- name: (system-user-systemfiles.yml) Check if local template directory exists for root - name: (system-user-systemfiles.yml) Check if local template directory exists for root
local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root ansible.builtin.stat:
register: local_template_dir_root path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root"
delegate_to: localhost
become: false
register: common_local_template_dir_root
# -- # --
@@ -23,9 +29,9 @@
# --- # ---
- name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists - name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.profile.ORIG" path: "~{{ item.name }}/.profile.ORIG"
register: profile_user_orig_exists register: common_profile_user_orig_exists
loop: "{{ system_users }}" loop: "{{ system_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -33,12 +39,19 @@
- profile - profile
- name: (user-systemfiles.yml) Backup existing users .profile file - name: (user-systemfiles.yml) Backup existing users .profile file
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG ansible.builtin.copy:
loop: "{{ profile_user_orig_exists.results }}" src: "~{{ item.item.name }}/.profile"
dest: "~{{ item.item.name }}/.profile.ORIG"
remote_src: true
owner: "{{ item.item.name }}"
group: "{{ item.item.name }}"
mode: "0644"
force: false
loop: "{{ common_profile_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: when:
- item.stat.exists == False - not item.stat.exists
tags: tags:
- profile - profile
@@ -49,17 +62,17 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: profile_stats register: common_profile_stats
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
# 2) Prüfe ob eine lokale default _baschrc existiert # 2) Prüfe ob eine lokale default _baschrc existiert
- name: stat DEFAULT _profile - name: Stat DEFAULT _profile
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile"
delegate_to: localhost delegate_to: localhost
become: false become: false
register: default_profile_stat register: common_default_profile_stat
# 2) Falls User _profile vorhanden, kopieren # 2) Falls User _profile vorhanden, kopieren
- name: (system-user-systemfiles.yml) copy .profile if it exists - name: (system-user-systemfiles.yml) copy .profile if it exists
@@ -70,7 +83,7 @@
group: "{{ user.name }}" group: "{{ user.name }}"
mode: "0644" mode: "0644"
become: true become: true
loop: "{{ default_user | zip(profile_stats.results) | list }}" loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -89,12 +102,12 @@
group: "{{ user.name }}" group: "{{ user.name }}"
mode: "0644" mode: "0644"
become: true become: true
loop: "{{ default_user | zip(profile_stats.results) | list }}" loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
- not stat_result.stat.exists - not stat_result.stat.exists
- default_profile_stat.stat.exists | bool - common_default_profile_stat.stat.exists | bool
vars: vars:
user: "{{ item.0 }}" user: "{{ item.0 }}"
stat_result: "{{ item.1 }}" stat_result: "{{ item.1 }}"
@@ -105,15 +118,22 @@
# --- # ---
- name: (system-user-systemfiles.yml) Check if file '/root/.profile.ORIG' exists - name: (system-user-systemfiles.yml) Check if file '/root/.profile.ORIG' exists
stat: ansible.builtin.stat:
path: /root/.profile.ORIG path: /root/.profile.ORIG
register: profile_root_orig_exists register: common_profile_root_orig_exists
tags: tags:
- bash - bash
- name: (system-user-systemfiles.yml) Backup /root/.profile file - name: (system-user-systemfiles.yml) Backup /root/.profile file
command: cp /root/.profile /root/.profile.ORIG ansible.builtin.copy:
when: profile_root_orig_exists.stat.exists == False src: /root/.profile
dest: /root/.profile.ORIG
remote_src: true
owner: root
group: root
mode: "0644"
force: false
when: not common_profile_root_orig_exists.stat.exists
tags: tags:
- bash - bash
@@ -123,10 +143,10 @@
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile"
delegate_to: localhost delegate_to: localhost
become: false become: false
register: profile_root_stat register: common_profile_root_stat
# 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost
- name: copy root .profile if it exists - name: Copy root .profile if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile" src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile"
dest: /root/.profile dest: /root/.profile
@@ -134,7 +154,7 @@
group: root group: root
mode: '0644' mode: '0644'
become: true become: true
when: profile_root_stat.stat.exists when: common_profile_root_stat.stat.exists
tags: tags:
- bash - bash
@@ -144,9 +164,9 @@
# --- # ---
- name: (system-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists - name: (system-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.bashrc.ORIG" path: "~{{ item.name }}/.bashrc.ORIG"
register: bashrc_user_orig_exists register: common_bashrc_user_orig_exists
loop: "{{ system_users }}" loop: "{{ system_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -154,11 +174,18 @@
- bashrc - bashrc
- name: (system-user-systemfiles.yml) Backup existing users .bashrc file - name: (system-user-systemfiles.yml) Backup existing users .bashrc file
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG ansible.builtin.copy:
loop: "{{ bashrc_user_orig_exists.results }}" src: "~{{ item.item.name }}/.bashrc"
dest: "~{{ item.item.name }}/.bashrc.ORIG"
remote_src: true
owner: "{{ item.item.name }}"
group: "{{ item.item.name }}"
mode: "0644"
force: false
loop: "{{ common_bashrc_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: '{{ item.item.name }}'
when: item.stat.exists == False when: not item.stat.exists
tags: tags:
- bashrc - bashrc
@@ -169,17 +196,17 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: bashrc_stats register: common_bashrc_stats
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
# 2) Prüfe ob eine lokale default _baschrc existiert # 2) Prüfe ob eine lokale default _baschrc existiert
- name: stat DEFAULT _bashrc - name: Stat DEFAULT _bashrc
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_bashrc" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_bashrc"
delegate_to: localhost delegate_to: localhost
become: false become: false
register: default_bashrc_stat register: common_default_bashrc_stat
# 2) Falls User _bashrc vorhanden, kopieren # 2) Falls User _bashrc vorhanden, kopieren
- name: (system-user-systemfiles.yml) copy .bashrc if it exists - name: (system-user-systemfiles.yml) copy .bashrc if it exists
@@ -190,7 +217,7 @@
group: "{{ user.name }}" group: "{{ user.name }}"
mode: "0644" mode: "0644"
become: true become: true
loop: "{{ default_user | zip(bashrc_stats.results) | list }}" loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -209,12 +236,12 @@
group: "{{ user.name }}" group: "{{ user.name }}"
mode: "0644" mode: "0644"
become: true become: true
loop: "{{ default_user | zip(bashrc_stats.results) | list }}" loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
- not stat_result.stat.exists - not stat_result.stat.exists
- default_bashrc_stat.stat.exists | bool - common_default_bashrc_stat.stat.exists | bool
vars: vars:
user: "{{ item.0 }}" user: "{{ item.0 }}"
stat_result: "{{ item.1 }}" stat_result: "{{ item.1 }}"
@@ -225,28 +252,35 @@
# --- # ---
- name: (system-user-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists - name: (system-user-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists
stat: ansible.builtin.stat:
path: /root/.bashrc.ORIG path: /root/.bashrc.ORIG
register: bashrc_root_orig_exists register: common_bashrc_root_orig_exists
tags: tags:
- bash - bash
- name: (system-user-systemfiles.yml) Backup /root/.bashrc file - name: (system-user-systemfiles.yml) Backup /root/.bashrc file
command: cp /root/.bashrc /root/.bashrc.ORIG ansible.builtin.copy:
when: bashrc_root_orig_exists.stat.exists == False src: /root/.bashrc
dest: /root/.bashrc.ORIG
remote_src: true
owner: root
group: root
mode: "0644"
force: false
when: not common_bashrc_root_orig_exists.stat.exists
tags: tags:
- bash - bash
# 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert # 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert
- name: stat root _bashrc on control node - name: Stat root _bashrc on control node
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc"
delegate_to: localhost delegate_to: localhost
become: false become: false
register: bashrc_root_stat register: common_bashrc_root_stat
# 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost
- name: copy root .bashrc if it exists - name: Copy root .bashrc if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc" src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc"
dest: /root/.bashrc dest: /root/.bashrc
@@ -254,7 +288,7 @@
group: root group: root
mode: '0644' mode: '0644'
become: true become: true
when: bashrc_root_stat.stat.exists when: common_bashrc_root_stat.stat.exists
tags: tags:
- bash - bash
@@ -269,19 +303,19 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: vimrc_stats register: common_vimrc_stats
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
# 2. Falls vorhanden, Datei kopieren # 2. Falls vorhanden, Datei kopieren
- name: (system-user-systemfiles.yml) copy .vimrc if it exists - name: (system-user-systemfiles.yml) Copy .vimrc if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_vimrc" src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_vimrc"
dest: "~{{ user.name }}/.vimrc" dest: "~{{ user.name }}/.vimrc"
owner: "{{ user.name }}" owner: "{{ user.name }}"
group: "{{ user.name }}" group: "{{ user.name }}"
mode: '0644' mode: '0644'
loop: "{{ default_user | zip(vimrc_stats.results) | list }}" loop: "{{ default_user | zip(common_vimrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -300,7 +334,7 @@
delegate_to: localhost delegate_to: localhost
become: false become: false
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: dotvim_stats register: common_dotvim_stats
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -312,7 +346,7 @@
dest: "~{{ user.name }}/" dest: "~{{ user.name }}/"
mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch
become: true become: true
loop: "{{ default_user | zip(dotvim_stats.results) | list }}" loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -332,7 +366,7 @@
recurse: true recurse: true
state: directory state: directory
become: true become: true
loop: "{{ default_user | zip(dotvim_stats.results) | list }}" loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
when: when:
@@ -353,10 +387,10 @@
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc"
delegate_to: localhost delegate_to: localhost
become: false become: false
register: vimrc_root_stat register: common_vimrc_root_stat
# 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost
- name: (system-user-systemfiles.yml)copy root .vimrc if it exists - name: (system-user-systemfiles.yml) Copy root .vimrc if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc" src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc"
dest: /root/.vimrc dest: /root/.vimrc
@@ -365,7 +399,7 @@
mode: '0644' mode: '0644'
become: true become: true
when: when:
- vimrc_root_stat.stat.exists - common_vimrc_root_stat.stat.exists
tags: tags:
- bash - bash
@@ -375,7 +409,7 @@
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim" path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim"
delegate_to: localhost delegate_to: localhost
become: false become: false
register: root_dotvim_stat register: common_root_dotvim_stat
tags: [vim] tags: [vim]
@@ -387,7 +421,7 @@
mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen
become: true become: true
when: when:
- root_dotvim_stat.stat.exists | bool - common_root_dotvim_stat.stat.exists | bool
tags: [vim] tags: [vim]
# 2) Wenn vorhanden, nach /root/ kopieren # 2) Wenn vorhanden, nach /root/ kopieren
@@ -400,7 +434,7 @@
# rsync_path: "sudo -n rsync" # -n = kein Passwort-Prompt; erfordert NOPASSWD # rsync_path: "sudo -n rsync" # -n = kein Passwort-Prompt; erfordert NOPASSWD
# delegate_to: localhost # delegate_to: localhost
# when: # when:
# - root_dotvim_stat.stat.exists | bool # - common_root_dotvim_stat.stat.exists | bool
# tags: [vim] # tags: [vim]
# 3) Ownership sicherstellen (rekursiv) # 3) Ownership sicherstellen (rekursiv)
@@ -413,5 +447,5 @@
state: directory state: directory
become: true become: true
when: when:
- root_dotvim_stat.stat.exists | bool - common_root_dotvim_stat.stat.exists | bool
tags: [vim] tags: [vim]
roles/common/tasks/system-user.yml
+6 -7
View File
@@ -5,7 +5,7 @@
# --- # ---
- name: (user.yml) Remove (old) users from system - name: (user.yml) Remove (old) users from system
user: ansible.builtin.user:
name: '{{ item.name }}' name: '{{ item.name }}'
state: absent state: absent
with_items: with_items:
@@ -16,7 +16,7 @@
- system-user - system-user
- name: (user.yml) Remove home directory from deleted users - name: (user.yml) Remove home directory from deleted users
file: ansible.builtin.file:
path: '{{ base_home }}/{{ item.name }}' path: '{{ base_home }}/{{ item.name }}'
state: absent state: absent
with_items: with_items:
@@ -31,7 +31,7 @@
# --- # ---
- name: (user.yml) Ensure system groups exists - name: (user.yml) Ensure system groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: '{{ item.name }}'
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: '{{ item.group_id | default(omit) }}'
@@ -46,13 +46,13 @@
# - meta: end_host # - meta: end_host
- name: (system-user.yml) Get database of nis (system) users - name: (system-user.yml) Get database of nis (system) users
getent: ansible.builtin.getent:
database: passwd database: passwd
tags: tags:
- system-user - system-user
- name: (system-user.yml) Add (system) users if not yet exists.. - name: (system-user.yml) Add (system) users if not yet exists..
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
changed_when: true
loop: "{{ system_users }}" loop: "{{ system_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: '{{ item.name }}'
@@ -62,4 +62,3 @@
notify: Renew nis databases notify: Renew nis databases
tags: tags:
- system-user - system-user
roles/common/tasks/systemd-resolved.yml
+17 -23
View File
@@ -4,38 +4,36 @@
# Set some facts # Set some facts
# --- # ---
- name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list) - name: (systemd-resolved.yml) Set common_fact_resolved_nameserver (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_resolved_nameserver: "{{ resolved_nameserver | join (' ') }}" common_fact_resolved_nameserver: "{{ resolved_nameserver | join(' ') }}"
when: when:
- resolved_nameserver is defined and resolved_nameserver | length > 0 - resolved_nameserver is defined and resolved_nameserver | length > 0
tags: tags:
- systemd-resolved - systemd-resolved
- name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list) - name: (systemd-resolved.yml) Set common_fact_resolved_fallback_nameserver (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join (' ') }}" common_fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join(' ') }}"
when: when:
- resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0 - resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0
tags: tags:
- systemd-resolved - systemd-resolved
- name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list) - name: (systemd-resolved.yml) Set common_fact_resolved_domains (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_resolved_domains: "{{ resolved_domains | join (' ') }}" common_fact_resolved_domains: "{{ resolved_domains | join(' ') }}"
when: when:
- resolved_domains is defined and resolved_domains | length > 0 - resolved_domains is defined and resolved_domains | length > 0
tags: tags:
- systemd-resolved - systemd-resolved
# --- # ---
# Install/Enable systemd-resolved package # Install/Enable systemd-resolved package
# --- # ---
- name: (systemd-resolved.yml) Ensure systemd-resolved package is installed. - name: (systemd-resolved.yml) Ensure systemd-resolved package is installed.
package: ansible.builtin.package:
pkg: systemd-resolved pkg: systemd-resolved
state: present state: present
when: when:
@@ -43,8 +41,8 @@
tags: tags:
- systemd-resolved - systemd-resolved
- name: (systemd-services.yml) Enable service - name: (systemd-services.yml) Enable systemd-resolved service
systemd: ansible.builtin.systemd:
name: systemd-resolved name: systemd-resolved
enabled: true enabled: true
when: when:
@@ -52,31 +50,27 @@
tags: tags:
- systemd-resolved - systemd-resolved
# --- # ---
# Create configuration for systemd-resolved # Create configuration for systemd-resolved
# --- # ---
- name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists - name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists
file: ansible.builtin.file:
path: /etc/systemd/resolved.conf.d path: /etc/systemd/resolved.conf.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
- name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2 - name: (systemd-resolved.yml) Create/update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf'
ansible.builtin.template: ansible.builtin.template:
src: etc/systemd/resolved.conf.d/50-resolved-local.conf src: etc/systemd/resolved.conf.d/50-resolved-local.conf
dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
- name: Restart systemd-resolved service - name: (systemd-resolved.yml) Restart systemd-resolved service
ansible.builtin.service: ansible.builtin.service:
name: systemd-resolved name: systemd-resolved
state: restarted state: restarted
roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml
+20 -14
View File
@@ -11,44 +11,51 @@
# Source: # Source:
# - http://c-nergy.be/blog/?p=8984 # - http://c-nergy.be/blog/?p=8984
- name: "(ubuntu-x11vnc-1604-amd64.yml) check if x11vnc is already installed, if not found skipping...." - name: "(ubuntu-x11vnc-1604-amd64.yml) Check if x11vnc is already installed, if not found skipping...."
stat: ansible.builtin.stat:
path: /usr/bin/x11vnc path: /usr/bin/x11vnc
register: x11vnc_active register: common_x11vnc_active
- name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages" - name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages"
apt: ansible.builtin.apt:
name: ['x11vnc'] name: ['x11vnc']
update_cache: yes update_cache: true
state: present state: present
when: x11vnc_active.stat.exists == False when: not common_x11vnc_active.stat.exists
- name: "(ubuntu-x11vnc-1604-amd64.yml) Store password" - name: "(ubuntu-x11vnc-1604-amd64.yml) Store password"
shell: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
changed_when: true
- name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass" - name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass"
file: ansible.builtin.file:
path: /etc/x11vnc.pass path: /etc/x11vnc.pass
mode: 0644 owner: root
group: root
mode: "0644"
state: file
- name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
ansible.builtin.template: ansible.builtin.template:
src: lib/systemd/system/x11vnc.service.j2 src: lib/systemd/system/x11vnc.service.j2
dest: /lib/systemd/system/x11vnc.service dest: /lib/systemd/system/x11vnc.service
owner: root
group: root
mode: "0644"
# - name: "(ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service" # - name: "(ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service"
# shell: service x11vnc start # shell: service x11vnc start
- name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service - name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service
service: ansible.builtin.service:
name: x11vnc name: x11vnc
state: started state: started
- name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot" - name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot"
systemd: ansible.builtin.systemd:
name: x11vnc.service name: x11vnc.service
daemon_reload: yes daemon_reload: true
enabled: yes enabled: true
state: started state: started
# - name: "(ubuntu-x11vnc-1604-amd64.yml) Blocks x11vnc in GreenOS Desktop Environment for enduser " # - name: "(ubuntu-x11vnc-1604-amd64.yml) Blocks x11vnc in GreenOS Desktop Environment for enduser "
@@ -57,4 +64,3 @@
# mode: 0740 # mode: 0740
# owner: root # owner: root
# group: administrator # group: administrator
roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml
+24 -17
View File
@@ -12,50 +12,57 @@
# - http://c-nergy.be/blog/?p=8984 # - http://c-nergy.be/blog/?p=8984
- name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages" - name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages"
apt: ansible.builtin.apt:
name: "{{ packages }}" name: "{{ packages }}"
update_cache: yes update_cache: true
state: present state: present
vars: vars:
packages: packages:
- x11vnc - x11vnc
- name: "(ubuntu-x11vnc-1804-amd64.yml) get numeric id for group 'gdm'" - name: "(ubuntu-x11vnc-1804-amd64.yml) Get numeric id for group 'gdm'"
shell: echo "$(id -u gdm)" ansible.builtin.command: id -u gdm
register: grp_id_gdm register: common_grp_id_gdm
changed_when: false
- name: Check if file '/etc/gdm3/custom.conf' exists - name: Check if file '/etc/gdm3/custom.conf' exists
stat: ansible.builtin.stat:
path: /etc/gdm3/custom.conf path: /etc/gdm3/custom.conf
register: etc_gdm_custom_conf_exists register: common_etc_gdm_custom_conf_exists
- name: Adjust file '/etc/gdm3/custom.conf' - name: Adjust file '/etc/gdm3/custom.conf'
lineinfile: ansible.builtin.lineinfile:
dest: /etc/gdm3/custom.conf dest: /etc/gdm3/custom.conf
state: present state: present
regexp: '^WaylandEnable' regexp: '^WaylandEnable'
line: 'WaylandEnable=false' line: 'WaylandEnable=false'
insertafter: '^#?\s*WaylandEnable' insertafter: '^#?\s*WaylandEnable'
when: when:
- etc_gdm_custom_conf_exists.stat.exists - common_etc_gdm_custom_conf_exists.stat.exists
- name: "(ubuntu-x11vnc-1804-amd64.yml) Store password" - name: "(ubuntu-x11vnc-1804-amd64.yml) Store password"
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
changed_when: true
- name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass" - name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass"
file: ansible.builtin.file:
path: "/etc/x11vnc.pass" path: /etc/x11vnc.pass
mode: 0644 owner: root
group: root
mode: "0644"
state: file
- name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
ansible.builtin.template: ansible.builtin.template:
src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2 src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2
dest: /lib/systemd/system/x11vnc.service dest: /lib/systemd/system/x11vnc.service
owner: root
group: root
mode: "0644"
- name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service" - name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service"
systemd: ansible.builtin.systemd:
name: x11vnc.service name: x11vnc.service
daemon_reload: yes daemon_reload: true
enabled: yes enabled: true
state: restarted state: restarted
roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml
+21 -17
View File
@@ -12,54 +12,59 @@
# - http://c-nergy.be/blog/?p=8984 # - http://c-nergy.be/blog/?p=8984
- name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages" - name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages"
apt: ansible.builtin.apt:
name: "{{ packages }}" name: "{{ packages }}"
update_cache: yes update_cache: true
state: present state: present
vars: vars:
packages: packages:
- x11vnc - x11vnc
- name: "(ubuntu-x11vnc-2004-amd64.yml) get numeric id for group 'gdm'" - name: "(ubuntu-x11vnc-2004-amd64.yml) Get numeric id for group 'gdm'"
shell: echo "$(id -u gdm)" ansible.builtin.command: id -u gdm
register: grp_id_gdm register: common_grp_id_gdm
changed_when: false
- name: "(ubuntu-x11vnc-2004-amd64.yml) Store password" - name: "(ubuntu-x11vnc-2004-amd64.yml) Store password"
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
changed_when: true
- name: Check if file '/etc/gdm3/custom.conf' exists - name: Check if file '/etc/gdm3/custom.conf' exists
stat: ansible.builtin.stat:
path: /etc/gdm3/custom.conf path: /etc/gdm3/custom.conf
register: etc_gdm_custom_conf_exists register: common_etc_gdm_custom_conf_exists
- name: Adjust file '/etc/gdm3/custom.conf' - name: Adjust file '/etc/gdm3/custom.conf'
lineinfile: ansible.builtin.lineinfile:
dest: /etc/gdm3/custom.conf dest: /etc/gdm3/custom.conf
state: present state: present
regexp: '^WaylandEnable' regexp: '^WaylandEnable'
line: 'WaylandEnable=false' line: 'WaylandEnable=false'
insertafter: '^#?\s*WaylandEnable' insertafter: '^#?\s*WaylandEnable'
when: when:
- etc_gdm_custom_conf_exists.stat.exists - common_etc_gdm_custom_conf_exists.stat.exists
- name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass" - name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass"
file: ansible.builtin.file:
path: /etc/x11vnc.pass path: /etc/x11vnc.pass
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
state: file
- name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
ansible.builtin.template: ansible.builtin.template:
src: lib/systemd/system/x11vnc-gdm3.service.j2 src: lib/systemd/system/x11vnc-gdm3.service.j2
dest: /lib/systemd/system/x11vnc.service dest: /lib/systemd/system/x11vnc.service
owner: root
group: root
mode: "0644"
- name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service" - name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service"
systemd: ansible.builtin.systemd:
name: x11vnc.service name: x11vnc.service
daemon_reload: yes daemon_reload: true
enabled: yes enabled: true
state: restarted state: restarted
# - name: "(ubuntu-x11vnc-2004-amd64.yml) Remove whisker menu entry for allusers (except owner and group)" # - name: "(ubuntu-x11vnc-2004-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
@@ -68,4 +73,3 @@
# mode: 0750 # mode: 0750
# owner: root # owner: root
# group: root # group: root
roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml
+21 -17
View File
@@ -12,54 +12,59 @@
# - http://c-nergy.be/blog/?p=8984 # - http://c-nergy.be/blog/?p=8984
- name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages" - name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages"
apt: ansible.builtin.apt:
name: "{{ packages }}" name: "{{ packages }}"
update_cache: yes update_cache: true
state: present state: present
vars: vars:
packages: packages:
- x11vnc - x11vnc
- name: "(ubuntu-x11vnc-2204-amd64.yml) get numeric id for group 'gdm'" - name: "(ubuntu-x11vnc-2204-amd64.yml) Get numeric id for group 'gdm'"
shell: echo "$(id -u gdm)" ansible.builtin.command: id -u gdm
register: grp_id_gdm register: common_grp_id_gdm
changed_when: false
- name: "(ubuntu-x11vnc-2204-amd64.yml) Store password" - name: "(ubuntu-x11vnc-2204-amd64.yml) Store password"
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
changed_when: true
- name: Check if file '/etc/gdm3/custom.conf' exists - name: Check if file '/etc/gdm3/custom.conf' exists
stat: ansible.builtin.stat:
path: /etc/gdm3/custom.conf path: /etc/gdm3/custom.conf
register: etc_gdm_custom_conf_exists register: common_etc_gdm_custom_conf_exists
- name: Adjust file '/etc/gdm3/custom.conf' - name: Adjust file '/etc/gdm3/custom.conf'
lineinfile: ansible.builtin.lineinfile:
dest: /etc/gdm3/custom.conf dest: /etc/gdm3/custom.conf
state: present state: present
regexp: '^WaylandEnable' regexp: '^WaylandEnable'
line: 'WaylandEnable=false' line: 'WaylandEnable=false'
insertafter: '^#?\s*WaylandEnable' insertafter: '^#?\s*WaylandEnable'
when: when:
- etc_gdm_custom_conf_exists.stat.exists - common_etc_gdm_custom_conf_exists.stat.exists
- name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass" - name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass"
file: ansible.builtin.file:
path: /etc/x11vnc.pass path: /etc/x11vnc.pass
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
state: file
- name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
ansible.builtin.template: ansible.builtin.template:
src: lib/systemd/system/x11vnc-gdm3.service.j2 src: lib/systemd/system/x11vnc-gdm3.service.j2
dest: /lib/systemd/system/x11vnc.service dest: /lib/systemd/system/x11vnc.service
owner: root
group: root
mode: "0644"
- name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service" - name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service"
systemd: ansible.builtin.systemd:
name: x11vnc.service name: x11vnc.service
daemon_reload: yes daemon_reload: true
enabled: yes enabled: true
state: restarted state: restarted
# - name: "(ubuntu-x11vnc-2204-amd64.yml) Remove whisker menu entry for allusers (except owner and group)" # - name: "(ubuntu-x11vnc-2204-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
@@ -68,4 +73,3 @@
# mode: 0750 # mode: 0750
# owner: root # owner: root
# group: root # group: root
roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml
+21 -17
View File
@@ -12,54 +12,59 @@
# - http://c-nergy.be/blog/?p=8984 # - http://c-nergy.be/blog/?p=8984
- name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages" - name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages"
apt: ansible.builtin.apt:
name: "{{ packages }}" name: "{{ packages }}"
update_cache: yes update_cache: true
state: present state: present
vars: vars:
packages: packages:
- x11vnc - x11vnc
- name: "(ubuntu-x11vnc-2404-amd64.yml) get numeric id for group 'gdm'" - name: "(ubuntu-x11vnc-2404-amd64.yml) Get numeric id for group 'gdm'"
shell: echo "$(id -u gdm)" ansible.builtin.command: id -u gdm
register: grp_id_gdm register: common_grp_id_gdm
changed_when: false
- name: "(ubuntu-x11vnc-2404-amd64.yml) Store password" - name: "(ubuntu-x11vnc-2404-amd64.yml) Store password"
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass" ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
changed_when: true
- name: Check if file '/etc/gdm3/custom.conf' exists - name: Check if file '/etc/gdm3/custom.conf' exists
stat: ansible.builtin.stat:
path: /etc/gdm3/custom.conf path: /etc/gdm3/custom.conf
register: etc_gdm_custom_conf_exists register: common_etc_gdm_custom_conf_exists
- name: Adjust file '/etc/gdm3/custom.conf' - name: Adjust file '/etc/gdm3/custom.conf'
lineinfile: ansible.builtin.lineinfile:
dest: /etc/gdm3/custom.conf dest: /etc/gdm3/custom.conf
state: present state: present
regexp: '^WaylandEnable' regexp: '^WaylandEnable'
line: 'WaylandEnable=false' line: 'WaylandEnable=false'
insertafter: '^#?\s*WaylandEnable' insertafter: '^#?\s*WaylandEnable'
when: when:
- etc_gdm_custom_conf_exists.stat.exists - common_etc_gdm_custom_conf_exists.stat.exists
- name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass" - name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass"
file: ansible.builtin.file:
path: /etc/x11vnc.pass path: /etc/x11vnc.pass
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
state: file
- name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service" - name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
ansible.builtin.template: ansible.builtin.template:
src: lib/systemd/system/x11vnc-gdm3.service.j2 src: lib/systemd/system/x11vnc-gdm3.service.j2
dest: /lib/systemd/system/x11vnc.service dest: /lib/systemd/system/x11vnc.service
owner: root
group: root
mode: "0644"
- name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service" - name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service"
systemd: ansible.builtin.systemd:
name: x11vnc.service name: x11vnc.service
daemon_reload: yes daemon_reload: true
enabled: yes enabled: true
state: restarted state: restarted
# - name: "(ubuntu-x11vnc-2404-amd64.yml) Remove whisker menu entry for allusers (except owner and group)" # - name: "(ubuntu-x11vnc-2404-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
@@ -68,4 +73,3 @@
# mode: 0750 # mode: 0750
# owner: root # owner: root
# group: root # group: root
roles/common/templates/etc/ssh/sshd_config.j2
+10 -10
View File
@@ -177,8 +177,8 @@ HostbasedAuthentication no
# The allow/deny directives are processed in the following order: DenyUsers, # The allow/deny directives are processed in the following order: DenyUsers,
# AllowUsers, DenyGroups, and finally AllowGroups. # AllowUsers, DenyGroups, and finally AllowGroups.
# By default, login is allowed for all users. # By default, login is allowed for all users.
{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %} {% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %}
AllowUsers {{ fact_sshd_allowed_users }} AllowUsers {{ common_fact_sshd_allowed_users }}
{% else %} {% else %}
#AllowUsers back chris sysadm cityslang christoph #AllowUsers back chris sysadm cityslang christoph
{% endif %} {% endif %}
@@ -239,8 +239,8 @@ UsePAM {{ sshd_use_pam }}
# #
# The list of available key exchange algorithms may also be obtained using "ssh -Q kex". # The list of available key exchange algorithms may also be obtained using "ssh -Q kex".
# #
{% if (fact_sshd_kexalgorithms is defined) and fact_sshd_kexalgorithms %} {% if (common_fact_sshd_kexalgorithms is defined) and common_fact_sshd_kexalgorithms %}
KexAlgorithms {{ fact_sshd_kexalgorithms }} KexAlgorithms {{ common_fact_sshd_kexalgorithms }}
{% else %} {% else %}
#KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1 #KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
{% endif %} {% endif %}
@@ -273,8 +273,8 @@ KexAlgorithms {{ fact_sshd_kexalgorithms }}
# #
# The list of available ciphers may also be obtained using "ssh -Q cipher". # The list of available ciphers may also be obtained using "ssh -Q cipher".
# #
{% if (fact_sshd_ciphers is defined) and fact_sshd_ciphers %} {% if (common_fact_sshd_ciphers is defined) and common_fact_sshd_ciphers %}
Ciphers {{ fact_sshd_ciphers }} Ciphers {{ common_fact_sshd_ciphers }}
{% else %} {% else %}
#Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr #Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
{% endif %} {% endif %}
@@ -317,8 +317,8 @@ Ciphers {{ fact_sshd_ciphers }}
# #
# The list of available MAC algorithms may also be obtained using "ssh -Q mac". # The list of available MAC algorithms may also be obtained using "ssh -Q mac".
# #
{% if (fact_sshd_macs is defined) and fact_sshd_macs %} {% if (common_fact_sshd_macs is defined) and common_fact_sshd_macs %}
MACs {{ fact_sshd_macs }} MACs {{ common_fact_sshd_macs }}
{% else %} {% else %}
#MACs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,mac-sha2-256,hmac-sha2-512,hmac-sha1 #MACs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,mac-sha2-256,hmac-sha2-512,hmac-sha1
{% endif %} {% endif %}
@@ -337,8 +337,8 @@ MACs {{ fact_sshd_macs }}
# ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa # ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
# #
# The list of available key types may also be obtained using "ssh -Q key". # The list of available key types may also be obtained using "ssh -Q key".
{% if (fact_sshd_hostkeyalgorithms is defined) and fact_sshd_hostkeyalgorithms %} {% if (common_fact_sshd_hostkeyalgorithms is defined) and common_fact_sshd_hostkeyalgorithms %}
HostKeyAlgorithms {{ fact_sshd_hostkeyalgorithms }} HostKeyAlgorithms {{ common_fact_sshd_hostkeyalgorithms }}
{% endif %} {% endif %}
roles/common/templates/etc/ssh/sshd_config.ubuntu.j2
+2 -2
View File
@@ -171,8 +171,8 @@ HostbasedAuthentication no
# The allow/deny directives are processed in the following order: DenyUsers, # The allow/deny directives are processed in the following order: DenyUsers,
# AllowUsers, DenyGroups, and finally AllowGroups. # AllowUsers, DenyGroups, and finally AllowGroups.
# By default, login is allowed for all users. # By default, login is allowed for all users.
{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %} {% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %}
AllowUsers {{ fact_sshd_allowed_users }} AllowUsers {{ common_fact_sshd_allowed_users }}
{% else %} {% else %}
#AllowUsers back chris sysadm cityslang christoph #AllowUsers back chris sysadm cityslang christoph
{% endif %} {% endif %}
roles/common/templates/etc/systemd/resolved.conf.d/50-resolved-local.conf
+6 -6
View File
@@ -5,20 +5,20 @@
# *** ---------------------------------------------- *** # *** ---------------------------------------------- ***
[Resolve] [Resolve]
{% if (fact_resolved_nameserver is defined) and fact_resolved_nameserver %} {% if (common_fact_resolved_nameserver is defined) and common_fact_resolved_nameserver %}
DNS={{ fact_resolved_nameserver}} DNS={{ common_fact_resolved_nameserver }}
{% else %} {% else %}
#DNS= #DNS=
{% endif -%} {% endif -%}
{% if (fact_resolved_fallback_nameserver is defined) and fact_resolved_fallback_nameserver %} {% if (common_fact_resolved_fallback_nameserver is defined) and common_fact_resolved_fallback_nameserver %}
FallbackDNS={{ fact_resolved_fallback_nameserver }} FallbackDNS={{ common_fact_resolved_fallback_nameserver }}
{% else %} {% else %}
#FallbackDNS= #FallbackDNS=
{% endif -%} {% endif -%}
{% if (fact_resolved_domains is defined) and fact_resolved_domains %} {% if (common_fact_resolved_domains is defined) and common_fact_resolved_domains %}
Domains={{ fact_resolved_domains }} Domains={{ common_fact_resolved_domains }}
{% else %} {% else %}
#Domains= #Domains=
{% endif -%} {% endif -%}