Compare commits
9 Commits
7ff25744b5
..
master
| Author | SHA1 | Date | |
|---|---|---|---|
 chris
|
46327da2ac | ||
|
chris
|
81ef678904 | ||
|
chris
|
91e40916c4 | ||
|
chris
|
e47774bc0b | ||
|
chris
|
d87ec89f4f | ||
|
chris
|
855504dfec | ||
|
chris
|
2a50cca686 | ||
|
chris
|
5b66e83dc4 | ||
|
chris
|
960c9222e2 |
@@ -1,121 +0,0 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# deb822 ist das neue Konfigurationsformats für APT-Quellen (Repositories).
|
||||
# Es basiert auf der Debian Control Syntax nach RFC 822 – daher der Name
|
||||
# ---
|
||||
|
||||
- name: Nur APT auf Debian 13 (Trixie) migrieren
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
vars:
|
||||
target_release: trixie
|
||||
debian_mirror: "http://deb.debian.org/debian"
|
||||
security_mirror: "http://security.debian.org/debian-security"
|
||||
components: "main contrib non-free non-free-firmware"
|
||||
enable_backports: true # auf false setzen, wenn du keine Backports willst
|
||||
pin_backports_low: true # Backports nur auf Anfrage
|
||||
# Nur manuelle Installation/Upgrade aus Backports:
|
||||
# backports_pin_priority: 100
|
||||
#
|
||||
# Automatische Updates für bereits installierte Backports-Pakete.
|
||||
# backports_pin_priority: 500 (>= 500)
|
||||
#
|
||||
backports_pin_priority: 100 # 100 = nie automatisch bevorzugen
|
||||
apt_cache_valid_time: 3600
|
||||
# Für offizielle Debian-Repos brauchst es kein Signed-By, weil debian-archive-keyring
|
||||
# ohnehin systemweit vertrauenswürdig ist.
|
||||
#
|
||||
use_signed_by: true # oder false, wenn du Option A willst
|
||||
# Wenn Signed-By explizit gesetzt werden soll, dann nutze den Keyring-Pfad und stelle sicher,
|
||||
# dass das Paket installiert ist.
|
||||
signed_by_keyring: "/usr/share/keyrings/debian-archive-keyring.gpg"
|
||||
|
||||
pre_tasks:
|
||||
- name: Sicherstellen, dass wir Debian sind
|
||||
assert:
|
||||
that:
|
||||
- ansible_facts['os_family'] == "Debian"
|
||||
fail_msg: "Dieses Playbook ist nur für Debian geeignet."
|
||||
|
||||
tasks:
|
||||
|
||||
- name: Keyring für Debian-Archive sicherstellen (falls Signed-By genutzt)
|
||||
ansible.builtin.apt:
|
||||
name: debian-archive-keyring
|
||||
state: present
|
||||
when: use_signed_by
|
||||
|
||||
- name: (Optional) Alte /etc/apt/sources.list sichern
|
||||
ansible.builtin.copy:
|
||||
src: /etc/apt/sources.list
|
||||
dest: /etc/apt/sources.list.before-trixie
|
||||
remote_src: true
|
||||
force: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Alte /etc/apt/sources.list deaktivieren (leere Kommentar-Datei)
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/apt/sources.list
|
||||
content: |
|
||||
# Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
|
||||
# Zielrelease: {{ target_release }}
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Debian-Repo (deb + deb-src) als deb822 anlegen
|
||||
ansible.builtin.template:
|
||||
src: templates/apt-migrate-to-trixie/debian.sources.j2
|
||||
dest: /etc/apt/sources.list.d/debian.sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Security-Repo (deb + deb-src) als deb822 anlegen
|
||||
ansible.builtin.template:
|
||||
src: templates/apt-migrate-to-trixie/security.sources.j2
|
||||
dest: /etc/apt/sources.list.d/security.sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Backports-Repo (optional) als deb822 anlegen/entfernen
|
||||
ansible.builtin.template:
|
||||
src: templates/apt-migrate-to-trixie/backports.sources.j2
|
||||
dest: /etc/apt/sources.list.d/backports.sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: enable_backports
|
||||
- name: Backports-Repo entfernen wenn deaktiviert
|
||||
ansible.builtin.file:
|
||||
path: /etc/apt/sources.list.d/backports.sources
|
||||
state: absent
|
||||
when: not enable_backports
|
||||
|
||||
- name: Optionales Backports-Pinning setzen
|
||||
ansible.builtin.template:
|
||||
src: templates/apt-migrate-to-trixie/99-backports.j2
|
||||
dest: /etc/apt/preferences.d/99-backports
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: enable_backports and pin_backports_low
|
||||
|
||||
- name: APT-Cache aktualisieren
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: "{{ apt_cache_valid_time }}"
|
||||
|
||||
- name: Verifikation - zeigen, ob Suites auf trixie stehen
|
||||
ansible.builtin.command: apt-cache policy
|
||||
register: apt_policy
|
||||
changed_when: false
|
||||
|
||||
- name: Ausgabe anzeigen (nur Info)
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ apt_policy.stdout.split('\n') | select('search', 'trixie') | list | join('\n') }}"
|
||||
|
||||
+6
-7
@@ -158,7 +158,7 @@ pureftpd_virtual_users:
|
||||
uid: jibran
|
||||
gid: users
|
||||
|
||||
#pureftpd_virtual_deleted_users:
|
||||
# pureftpd_virtual_deleted_users:
|
||||
#
|
||||
# Available properties
|
||||
# - name: vuser2
|
||||
@@ -179,7 +179,7 @@ pureftpd_tls_certificate_method: 'generate'
|
||||
#
|
||||
# Available properties
|
||||
#
|
||||
#pureftpd_tls_certificate_openssl:
|
||||
# pureftpd_tls_certificate_openssl:
|
||||
# size: 4096
|
||||
# days: 365
|
||||
# fqdn: ftp.example.com
|
||||
@@ -211,15 +211,15 @@ pureftpd_tls_certificate_openssl:
|
||||
# ! Notice !
|
||||
|
||||
remove_system_users: []
|
||||
#remove_system_users:
|
||||
# remove_system_users:
|
||||
# - name: test
|
||||
|
||||
system_users: []
|
||||
#system_users:
|
||||
# system_users:
|
||||
# - name: test
|
||||
# password: 'test100'
|
||||
|
||||
#system_users:
|
||||
# system_users:
|
||||
#
|
||||
# - name: sysadm
|
||||
# password: '9xFXkdPR_2'
|
||||
@@ -259,7 +259,7 @@ nis_groups:
|
||||
group_id: 1130
|
||||
|
||||
remove_nis_users: []
|
||||
#remove_nis_users:
|
||||
# remove_nis_users:
|
||||
# - name: anna
|
||||
# - name: birgit
|
||||
# - name: jonas
|
||||
@@ -689,4 +689,3 @@ sudo_pc_users:
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/luks.yml
|
||||
# ==========
|
||||
|
||||
|
||||
+5
-10
@@ -121,7 +121,7 @@ resolved_nameserver:
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
#resolved_domains: []
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- flr.netz
|
||||
@@ -133,14 +133,10 @@ resolved_dnssec: false
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.102.254
|
||||
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ==========
|
||||
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/ntp.yml
|
||||
# ==========
|
||||
@@ -206,7 +202,7 @@ nfs_exports:
|
||||
remove_system_users: []
|
||||
|
||||
system_users: []
|
||||
#system_users:
|
||||
# system_users:
|
||||
# - name: sysadm
|
||||
# password: '9xFXkdPR_2'
|
||||
|
||||
@@ -253,7 +249,7 @@ nis_groups:
|
||||
group_id: 1038
|
||||
|
||||
remove_nis_users: []
|
||||
#remove_nis_users:
|
||||
# remove_nis_users:
|
||||
# - name: test
|
||||
# - name: ivana
|
||||
|
||||
@@ -484,7 +480,7 @@ samba_server_cidr_prefix: 24
|
||||
samba_workgroup: FLR
|
||||
samba_netbios_name: FILE-FLR
|
||||
|
||||
#samba_allow_insecure_wide_links: !!str yes
|
||||
# samba_allow_insecure_wide_links: !!str yes
|
||||
|
||||
samba_shares:
|
||||
- name: Team
|
||||
@@ -583,7 +579,7 @@ samba_shares:
|
||||
group_write_list: team
|
||||
file_create_mask: '0660'
|
||||
dir_create_mask: '2770'
|
||||
#wide_links: !!str yes
|
||||
# wide_links: !!str yes
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle.Bin'
|
||||
@@ -634,4 +630,3 @@ sudo_pc_users:
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/luks.yml
|
||||
# ==========
|
||||
|
||||
|
||||
+5
-13
@@ -33,7 +33,7 @@ sshd_permit_root_login: !!str "prohibit-password"
|
||||
|
||||
# name or ip-adress from the (local) ntp server, mostly the gateway
|
||||
#
|
||||
#ntp_server: gw-kb.anw-kb.netz
|
||||
# ntp_server: gw-kb.anw-kb.netz
|
||||
|
||||
|
||||
# ==========
|
||||
@@ -149,8 +149,6 @@ nfs_exports:
|
||||
use_fsid_option: true
|
||||
|
||||
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/system-user.yml
|
||||
# ==========
|
||||
@@ -163,12 +161,12 @@ nfs_exports:
|
||||
# ! Notice !
|
||||
|
||||
remove_system_users: []
|
||||
#remove_system_users:
|
||||
# remove_system_users:
|
||||
# - name: test
|
||||
# - name: jennifer.prost
|
||||
|
||||
system_users: []
|
||||
#system_users:
|
||||
# system_users:
|
||||
# - name: sysadm
|
||||
# password: '9xFXkdPR_2'
|
||||
|
||||
@@ -204,15 +202,14 @@ nis_groups:
|
||||
group_id: 1200
|
||||
|
||||
|
||||
|
||||
#nis_groups:
|
||||
# nis_groups:
|
||||
# - name: mbr-finanzen (wird zu vdk)
|
||||
# group_id: 1210
|
||||
# - name: mbr-personal (wird zu mbr-finanzen-personal)
|
||||
# group_id: 1220
|
||||
|
||||
remove_nis_users: []
|
||||
#remove_nis_users:
|
||||
# remove_nis_users:
|
||||
# - name: test
|
||||
# - name: jennifer.prost
|
||||
|
||||
@@ -309,7 +306,6 @@ nis_user:
|
||||
password: ''
|
||||
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/samba-install.yml
|
||||
# ==========
|
||||
@@ -348,7 +344,6 @@ samba_netbios_name: FILE-KB
|
||||
samba_server_min_protocol: !!str "NT1"
|
||||
|
||||
|
||||
|
||||
samba_shares:
|
||||
|
||||
# ---
|
||||
@@ -428,8 +423,6 @@ samba_shares:
|
||||
recycle_path: '@Recycle.Bin'
|
||||
|
||||
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/system-user-systemfiles.yml
|
||||
# ==========
|
||||
@@ -477,4 +470,3 @@ sudo_pc_users:
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/luks.yml
|
||||
# ==========
|
||||
|
||||
|
||||
+157
-171
File diff suppressed because it is too large
Load Diff
@@ -81,12 +81,12 @@ nfs_exports:
|
||||
# ! Notice !
|
||||
|
||||
remove_system_users: []
|
||||
#remove_system_users:
|
||||
# remove_system_users:
|
||||
# - name: test
|
||||
# - name: jennifer.prost
|
||||
|
||||
system_users: []
|
||||
#system_users:
|
||||
# system_users:
|
||||
# - name: sysadm
|
||||
# password: '9xFXkdPR_2'
|
||||
|
||||
@@ -122,10 +122,10 @@ nis_groups:
|
||||
- name: no-backup
|
||||
group_id: 1120
|
||||
|
||||
#remove_nis_users:
|
||||
# remove_nis_users:
|
||||
# - name: lea
|
||||
# - name: alina
|
||||
#remove_nis_users:
|
||||
# remove_nis_users:
|
||||
# - name: daniel
|
||||
# - name: andrea
|
||||
# - name: tali
|
||||
@@ -134,7 +134,6 @@ nis_groups:
|
||||
# - name: simone
|
||||
|
||||
nis_user:
|
||||
|
||||
- name: chris
|
||||
groups:
|
||||
- intern
|
||||
@@ -451,19 +450,13 @@ sudo_pc_users:
|
||||
- sysadm
|
||||
- localadmin
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/sudoers-server.yml
|
||||
# ==========
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml
|
||||
# vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml
|
||||
# ==========
|
||||
|
||||
|
||||
# ==========
|
||||
# vars used by roles/common/tasks/luks.yml
|
||||
# ==========
|
||||
|
||||
|
||||
@@ -4,12 +4,11 @@
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: True
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: False
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
@@ -19,7 +18,6 @@ network_interface_required_packages:
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eno1
|
||||
@@ -48,19 +46,17 @@ network_interfaces:
|
||||
- 192.168.82.1
|
||||
search: akb.netz
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
set_default_limit_nofile: true
|
||||
|
||||
|
||||
# ---
|
||||
# roles/common/tasks/default-users.yml
|
||||
# ---
|
||||
|
||||
#extra_user:
|
||||
# extra_user:
|
||||
#
|
||||
# - name: borg
|
||||
# user_id: 1065
|
||||
@@ -75,14 +71,12 @@ set_default_limit_nofile: true
|
||||
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhbQo8gm3zNCkNTSHrLE1np0IDiSUHgfyy8469guHFz root@file-akb'
|
||||
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlm5VPClcXv5O8GaL9H5EVgXaP3/FY7aafB0Jes3BvH root@gw-akb'
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
@@ -131,7 +125,7 @@ resolved_nameserver:
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
#resolved_domains: []
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- akb.netz
|
||||
@@ -143,7 +137,6 @@ resolved_dnssec: false
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.82.254
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
@@ -154,8 +147,7 @@ sshd_permit_root_login: !!str "yes"
|
||||
|
||||
sshd_password_authentication: !!str "yes"
|
||||
|
||||
#sshd_use_pam: !!str "no"
|
||||
|
||||
# sshd_use_pam: !!str "no"
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
@@ -191,7 +183,6 @@ cron_user_entries:
|
||||
hour: "23"
|
||||
job: /root/bin/admin-stuff/cleanup_from_old_files.sh
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
|
||||
@@ -4,12 +4,11 @@
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: True
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: False
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
@@ -19,7 +18,6 @@ network_interface_required_packages:
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eno1
|
||||
@@ -48,19 +46,17 @@ network_interfaces:
|
||||
- 192.168.102.1
|
||||
search: flr.netz
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
set_default_limit_nofile: true
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/default-users.yml
|
||||
# ---
|
||||
|
||||
#extra_user:
|
||||
# extra_user:
|
||||
#
|
||||
# - name: borg
|
||||
# user_id: 1065
|
||||
@@ -75,14 +71,12 @@ set_default_limit_nofile: true
|
||||
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTvxBfneJxBjMdpO9JCSkDyXQZUFXjYa/rqA6gQ0TL2 root@file-flr'
|
||||
# - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSvVJ6MbYdXhIeS6FWFx2M/p7Gb6aG3oy25ZJRctXYd root@gw-flr'
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
@@ -131,7 +125,7 @@ resolved_nameserver:
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
#resolved_domains: []
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- flr.netz
|
||||
|
||||
@@ -142,7 +136,6 @@ resolved_dnssec: false
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.102.254
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
@@ -153,8 +146,7 @@ sshd_permit_root_login: !!str "yes"
|
||||
|
||||
sshd_password_authentication: !!str "yes"
|
||||
|
||||
#sshd_use_pam: !!str "no"
|
||||
|
||||
# sshd_use_pam: !!str "no"
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
@@ -181,11 +173,9 @@ cron_user_entries:
|
||||
hour: "7-22"
|
||||
job: /root/bin/monitoring/check_cups-browsed.sh
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
@@ -4,14 +4,11 @@
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: False
|
||||
network_manage_devices: false
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: False
|
||||
|
||||
|
||||
network_interface_reload: false
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
@@ -19,15 +16,12 @@ network_interface_reload: False
|
||||
|
||||
set_default_limit_nofile: true
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
@@ -76,7 +70,7 @@ resolved_nameserver:
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
#resolved_domains: []
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- anw-kb.netz
|
||||
|
||||
@@ -87,7 +81,6 @@ resolved_dnssec: false
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.32.254
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
@@ -98,8 +91,7 @@ sshd_permit_root_login: !!str "yes"
|
||||
|
||||
sshd_password_authentication: !!str "yes"
|
||||
|
||||
#sshd_use_pam: !!str "no"
|
||||
|
||||
# sshd_use_pam: !!str "no"
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
@@ -111,12 +103,9 @@ cron_user_entries:
|
||||
minute: "*/15"
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
|
||||
@@ -4,12 +4,11 @@
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: True
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: False
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
@@ -19,7 +18,6 @@ network_interface_required_packages:
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: br0
|
||||
@@ -66,7 +64,7 @@ network_interfaces:
|
||||
# inline hook scripts
|
||||
pre-up:
|
||||
- !!str "ip link set dev eno1 up" # pre-up script lines
|
||||
up: [] #up script lines
|
||||
up: [] # up script lines
|
||||
post-up: [] # post-up script lines (alias for up)
|
||||
pre-down: [] # pre-down script lines (alias for down)
|
||||
down: [] # down script lines
|
||||
@@ -80,22 +78,18 @@ network_interfaces:
|
||||
address: 192.168.112.211
|
||||
netmask: 32
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
set_default_limit_nofile: true
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
@@ -144,7 +138,7 @@ resolved_nameserver:
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
#resolved_domains: []
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- oopen.de
|
||||
|
||||
@@ -155,7 +149,6 @@ resolved_dnssec: false
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.112.254
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
@@ -166,8 +159,7 @@ sshd_permit_root_login: !!str "yes"
|
||||
|
||||
sshd_password_authentication: !!str "yes"
|
||||
|
||||
#sshd_use_pam: !!str "no"
|
||||
|
||||
# sshd_use_pam: !!str "no"
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
@@ -199,12 +191,9 @@ cron_user_entries:
|
||||
hour: "23"
|
||||
job: /root/bin/admin-stuff/cleanup_from_old_files.sh
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
|
||||
@@ -4,12 +4,11 @@
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: True
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: False
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
@@ -19,7 +18,6 @@ network_interface_required_packages:
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eno1
|
||||
@@ -48,21 +46,18 @@ network_interfaces:
|
||||
- 192.168.92.1
|
||||
search: sprachenatelier.netz
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
set_default_limit_nofile: true
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
@@ -111,7 +106,7 @@ resolved_nameserver:
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
#resolved_domains: []
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- oopen.de
|
||||
|
||||
@@ -122,7 +117,6 @@ resolved_dnssec: false
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.92.254
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
@@ -133,8 +127,7 @@ sshd_permit_root_login: !!str "yes"
|
||||
|
||||
sshd_password_authentication: !!str "yes"
|
||||
|
||||
#sshd_use_pam: !!str "no"
|
||||
|
||||
# sshd_use_pam: !!str "no"
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
@@ -161,7 +154,6 @@ cron_user_entries:
|
||||
hour: "7-22"
|
||||
job: /root/bin/monitoring/check_cups-browsed.sh
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
|
||||
+183
-64
@@ -1,25 +1,165 @@
|
||||
---
|
||||
- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/apt/sources.list.d/hetzner-mirror.list
|
||||
- /etc/apt/sources.list.d/hetzner-security-updates.list
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) update configuration file - /etc/apt/sources.list
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2"
|
||||
dest: /etc/apt/sources.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
register: apt_config_updated
|
||||
mode: "0644"
|
||||
register: common_apt_config_updated
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) < 13
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
|
||||
ansible.builtin.apt:
|
||||
name: debian-archive-keyring
|
||||
state: present
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
- apt_deb822_use_signed_by | default(true) | bool
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
|
||||
ansible.builtin.copy:
|
||||
src: /etc/apt/sources.list
|
||||
dest: /etc/apt/sources.list.before-deb822
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
failed_when:
|
||||
- common_apt_sources_list_backup.failed
|
||||
- "'No such file or directory' not in (common_apt_sources_list_backup.msg | default(''))"
|
||||
register: common_apt_sources_list_backup
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/apt/sources.list
|
||||
content: |
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
# Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
|
||||
# Zielrelease: {{ ansible_facts['distribution_release'] }}
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: common_apt_config_updated_sources_list
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
|
||||
ansible.builtin.template:
|
||||
src: "etc/apt/deb822/debian.sources.j2"
|
||||
dest: /etc/apt/sources.list.d/debian.sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: common_apt_config_updated_debian_sources
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) configure deb822 security repository (Debian >= 13)
|
||||
ansible.builtin.template:
|
||||
src: "etc/apt/deb822/security.sources.j2"
|
||||
dest: /etc/apt/sources.list.d/security.sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: common_apt_config_updated_security_sources
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) configure deb822 backports repository (Debian >= 13)
|
||||
ansible.builtin.template:
|
||||
src: "etc/apt/deb822/backports.sources.j2"
|
||||
dest: /etc/apt/sources.list.d/backports.sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: common_apt_config_updated_backports_sources
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
- apt_backports_enable | default(false) | bool
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
# If 'backports' was enabled in a previous run but is now disabled.
|
||||
#
|
||||
- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
|
||||
ansible.builtin.file:
|
||||
path: /etc/apt/sources.list.d/backports.sources
|
||||
state: absent
|
||||
register: common_apt_config_removed_backports_sources
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
- not (apt_backports_enable | default(false) | bool)
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
# Collect change states from all Debian >=13 deb822 source tasks so apt update
|
||||
# can force a fresh cache refresh when repository files changed.
|
||||
- name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
|
||||
ansible.builtin.set_fact:
|
||||
common_apt_config_updated:
|
||||
changed: >-
|
||||
{{
|
||||
(common_apt_config_updated_sources_list.changed | default(false))
|
||||
or (common_apt_config_updated_debian_sources.changed | default(false))
|
||||
or (common_apt_config_updated_security_sources.changed | default(false))
|
||||
or (common_apt_config_updated_backports_sources.changed | default(false))
|
||||
or (common_apt_config_removed_backports_sources.changed | default(false))
|
||||
}}
|
||||
when:
|
||||
- apt_manage_sources_list|bool
|
||||
- ansible_facts['distribution'] == 'Debian'
|
||||
- (ansible_facts['distribution_major_version'] | int) >= 13
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) apt update
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
|
||||
cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
|
||||
when: apt_update|bool
|
||||
tags:
|
||||
- apt-update
|
||||
@@ -30,12 +170,11 @@
|
||||
- apt-compiler-pkgs
|
||||
- apt-webserver-pkgs
|
||||
|
||||
|
||||
- name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
|
||||
ansible.builtin.command: dpkg --configure -a
|
||||
register: _dpkg_configure
|
||||
changed_when: (_dpkg_configure.stdout | default('')) | length > 0
|
||||
failed_when: _dpkg_configure.rc != 0
|
||||
register: common_dpkg_configure
|
||||
changed_when: (common_dpkg_configure.stdout | default('')) | length > 0
|
||||
failed_when: common_dpkg_configure.rc != 0
|
||||
when: apt_dpkg_configure|bool
|
||||
tags:
|
||||
- apt-dpkg-configure
|
||||
@@ -44,9 +183,8 @@
|
||||
- apt-compiler-pkgs
|
||||
- apt-webserver-pkgs
|
||||
|
||||
|
||||
- name: (apt.yml) apt upgrade
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
upgrade: "{{ apt_upgrade_type }}"
|
||||
update_cache: true
|
||||
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
||||
@@ -58,9 +196,8 @@
|
||||
- apt-compiler-pkgs
|
||||
- apt-webserver-pkgs
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (stretch)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_stretch }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -70,9 +207,8 @@
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (buster)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_buster }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -82,9 +218,8 @@
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (bullseye)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_bullseye }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -94,9 +229,8 @@
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (bookworm)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_bookworm }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -106,9 +240,8 @@
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (trixie)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_trixie }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -118,9 +251,8 @@
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install ubuntu packages (bionic)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_bionic }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -130,7 +262,7 @@
|
||||
- apt-initial-install
|
||||
|
||||
- name: (apt.yml) Initial install ubuntu packages (xenial)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_xenial }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -140,7 +272,7 @@
|
||||
- apt-initial-install
|
||||
|
||||
- name: (apt.yml) Initial install ubuntu packages (jammy)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_jammy }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -150,7 +282,7 @@
|
||||
- apt-initial-install
|
||||
|
||||
- name: (apt.yml) Initial install ubuntu packages (noble)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_initial_install_noble }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
@@ -159,13 +291,12 @@
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
# ---
|
||||
# Microcode
|
||||
# ---
|
||||
|
||||
- name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}-backports"
|
||||
@@ -178,24 +309,23 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
when:
|
||||
- apt_debian_contrib_nonfree_enable
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11"or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
|
||||
- ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or
|
||||
ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
|
||||
- ansible_facts['processor']|string is search("Intel")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -208,9 +338,8 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -222,9 +351,8 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -237,9 +365,8 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -251,9 +378,8 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -266,9 +392,8 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -280,9 +405,8 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -300,7 +424,7 @@
|
||||
# ---
|
||||
|
||||
- name: (apt.yml) Install Firmware packages (Ubuntu)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ firmware_packages_ubuntu }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -310,9 +434,8 @@
|
||||
- apt-initial-install
|
||||
- apt-firmware
|
||||
|
||||
|
||||
- name: (apt.yml) Install Firmware packages (Debian)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ firmware_packages_debian }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -322,9 +445,8 @@
|
||||
- apt-initial-install
|
||||
- apt-firmware
|
||||
|
||||
|
||||
- name: (apt.yml) Install non-free Firmware packages (Debian)
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ firmware_non_free_packages_debian }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_facts['distribution_release'] }}"
|
||||
@@ -335,13 +457,12 @@
|
||||
- apt-initial-install
|
||||
- apt-firmware
|
||||
|
||||
|
||||
# ---
|
||||
# unwanted packages
|
||||
# ---
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_remove }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
@@ -349,7 +470,7 @@
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages Ubuntu bionic
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_remove_bionic }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
@@ -360,7 +481,7 @@
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages Ubuntu xenial
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_remove_xenial }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
@@ -371,7 +492,7 @@
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages Ubuntu jammy
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_remove_jammy }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
@@ -382,7 +503,7 @@
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages Ubuntu noble
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ apt_remove_noble }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
@@ -393,7 +514,7 @@
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) autoremove
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
autoremove: true
|
||||
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
||||
when: apt_autoremove|bool
|
||||
@@ -402,12 +523,10 @@
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
- name: (apt.yml) clean
|
||||
command: apt-get -y clean
|
||||
#args:
|
||||
# warn: false
|
||||
changed_when: false
|
||||
when: apt_clean|bool
|
||||
- name: (apt.yml) autoclean cache
|
||||
ansible.builtin.apt:
|
||||
autoclean: true
|
||||
when: apt_clean | bool
|
||||
tags:
|
||||
- apt-clean
|
||||
- apt-initial-install
|
||||
|
||||
@@ -1,22 +1,21 @@
|
||||
---
|
||||
|
||||
- name: (basic.yml) Ensure timezone is is correct
|
||||
timezone: name={{ time_zone }}
|
||||
community.general.timezone:
|
||||
name: "{{ time_zone }}"
|
||||
tags:
|
||||
- timezone
|
||||
|
||||
|
||||
- name: (basic.yml) Ensure locales are present
|
||||
locale_gen:
|
||||
community.general.locale_gen:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ locales }}"
|
||||
tags:
|
||||
- locales
|
||||
|
||||
|
||||
- name: (basic.yml) Create a symbolic link /bin/sh -> bash
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
src: bash
|
||||
dest: /bin/sh
|
||||
owner: root
|
||||
@@ -27,16 +26,15 @@
|
||||
tags:
|
||||
- symlink-sh
|
||||
|
||||
|
||||
# ----------
|
||||
# security limit (maybe DEPRECATED see systemd settings)
|
||||
# ----------
|
||||
|
||||
- name: (basic.yml) Ensure directory '/etc/security/limits.d' exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/security/limits.d
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
group: root
|
||||
owner: root
|
||||
when:
|
||||
@@ -47,7 +45,7 @@
|
||||
- systemd-config
|
||||
|
||||
- name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.src_path }}'
|
||||
dest: '{{ item.dest_path }}'
|
||||
owner: root
|
||||
@@ -63,16 +61,15 @@
|
||||
tags:
|
||||
- systemd-config
|
||||
|
||||
|
||||
# ----------
|
||||
# systemd stuff
|
||||
# ----------
|
||||
|
||||
- name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system.conf.d
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
group: root
|
||||
owner: root
|
||||
when:
|
||||
@@ -83,7 +80,7 @@
|
||||
- systemd-config
|
||||
|
||||
- name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.src_path }}'
|
||||
dest: '{{ item.dest_path }}'
|
||||
owner: root
|
||||
@@ -100,10 +97,10 @@
|
||||
- systemd-config
|
||||
|
||||
- name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/journald.conf.d
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
group: root
|
||||
owner: root
|
||||
when:
|
||||
@@ -113,7 +110,7 @@
|
||||
- systemd-config
|
||||
|
||||
- name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.src_path }}'
|
||||
dest: '{{ item.dest_path }}'
|
||||
owner: root
|
||||
@@ -129,97 +126,114 @@
|
||||
tags:
|
||||
- systemd-config
|
||||
|
||||
|
||||
# ----------
|
||||
# unattended upgrades
|
||||
# ----------
|
||||
|
||||
- name: (basic.yml) install unattended-upgrades
|
||||
apt: pkg=unattended-upgrades state=present
|
||||
ansible.builtin.apt:
|
||||
pkg: unattended-upgrades
|
||||
state: present
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) install apt-listchanges
|
||||
apt: pkg=apt-listchanges state=present
|
||||
ansible.builtin.apt:
|
||||
pkg: apt-listchanges
|
||||
state: present
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) remove apticron
|
||||
apt: pkg=apticron state=absent
|
||||
ansible.builtin.apt:
|
||||
pkg: apticron
|
||||
state: absent
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
|
||||
stat: path=/etc/apt/apt.conf.d/20auto-upgrades
|
||||
register: ua_enabled
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
register: common_ua_enabled
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) activate unattended upgrades
|
||||
shell: DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true dpkg-reconfigure -plow unattended-upgrades
|
||||
ansible.builtin.command:
|
||||
cmd: dpkg-reconfigure -plow unattended-upgrades
|
||||
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
DEBCONF_NONINTERACTIVE_SEEN: "true"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ua_enabled.stat.exists == False
|
||||
- not common_ua_enabled.stat.exists
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) copy apt-listchanges.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/apt/listchanges.conf.j2
|
||||
dest: /etc/apt/listchanges.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) copy unattended-upgrades conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/apt/apt.conf.d/50unattended-upgrades.j2
|
||||
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
backup: yes
|
||||
backup: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
|
||||
# ----------
|
||||
# - /etc/hosts
|
||||
# ----------
|
||||
|
||||
- name: (basic.yml) Check file '/etc/hosts.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/hosts.ORIG
|
||||
register: etc_hosts_ORIG
|
||||
register: common_etc_hosts_orig
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- etc_hosts
|
||||
|
||||
- name: (basic.yml) Backup installation version of file '/etc/hosts'
|
||||
command: cp -a /etc/hosts /etc/hosts.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/hosts
|
||||
dest: /etc/hosts.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- etc_hosts_ORIG.stat.exists == False
|
||||
- not common_etc_hosts_orig.stat.exists
|
||||
tags:
|
||||
- etc_hosts
|
||||
|
||||
- name: (basic.yml) addjust '/etc/hosts' add nis-server ..
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: '^192\.168\.'
|
||||
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
|
||||
@@ -227,4 +241,3 @@
|
||||
- "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- etc_hosts
|
||||
|
||||
|
||||
+26
-29
@@ -1,48 +1,45 @@
|
||||
---
|
||||
|
||||
- name: (cron.yml) Set env entries in user crontabs
|
||||
cron:
|
||||
name: '{{ item.name }}'
|
||||
env: 'yes'
|
||||
user: '{{ item.user | default("root", true) }}'
|
||||
job: '{{ item.job }}'
|
||||
insertafter: '{{ item.insertafter | default(omit) }}'
|
||||
loop: "{{ cron_env_entries }}"
|
||||
ansible.builtin.cron:
|
||||
name: "{{ item.name }}"
|
||||
env: "yes"
|
||||
user: '{{ item.user | default("root") }}'
|
||||
job: "{{ item.job }}"
|
||||
insertafter: "{{ item.insertafter | default(omit) }}"
|
||||
loop: "{{ cron_env_entries | default([]) }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: item.job is defined
|
||||
tags:
|
||||
- user_crontab
|
||||
|
||||
|
||||
- name: (cron.yml) Set special time entries in user crontabs
|
||||
cron:
|
||||
name: '{{ item.name }}'
|
||||
special_time: '{{ item.special_time }}'
|
||||
user: '{{ item.user | default("root", true) }}'
|
||||
job: '{{ item.job }}'
|
||||
ansible.builtin.cron:
|
||||
name: "{{ item.name }}"
|
||||
special_time: "{{ item.special_time }}"
|
||||
user: '{{ item.user | default("root") }}'
|
||||
job: "{{ item.job }}"
|
||||
state: present
|
||||
loop: "{{ cron_user_special_time_entries }}"
|
||||
loop: "{{ cron_user_special_time_entries | default([]) }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: item.job is defined
|
||||
tags:
|
||||
- user_crontab
|
||||
|
||||
|
||||
- name: (cron.yml) Set normal entries in user crontabs
|
||||
cron:
|
||||
name: '{{ item.name }}'
|
||||
minute: '{{ item.minute | default(omit) }}'
|
||||
hour: '{{ item.hour | default(omit) }}'
|
||||
day: '{{ day | default(omit) }}'
|
||||
weekday: '{{ item.weekday | default(omit) }}'
|
||||
month: '{{ item.month | default(omit) }}'
|
||||
user: '{{ item.user | default("root", true) }}'
|
||||
job: '{{ item.job }}'
|
||||
loop: "{{ cron_user_entries }}"
|
||||
ansible.builtin.cron:
|
||||
name: "{{ item.name }}"
|
||||
minute: "{{ item.minute | default(omit) }}"
|
||||
hour: "{{ item.hour | default(omit) }}"
|
||||
day: "{{ item.day | default(omit) }}"
|
||||
weekday: "{{ item.weekday | default(omit) }}"
|
||||
month: "{{ item.month | default(omit) }}"
|
||||
user: '{{ item.user | default("root") }}'
|
||||
job: "{{ item.job }}"
|
||||
loop: "{{ cron_user_entries | default([]) }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: item.job is defined
|
||||
tags:
|
||||
- user_crontab
|
||||
|
||||
@@ -1,26 +1,24 @@
|
||||
---
|
||||
|
||||
|
||||
# ---
|
||||
# Cups Server
|
||||
# ---
|
||||
|
||||
- name: (cups-install.yml) Ensure CUPS packages server (buster) are installed.
|
||||
package:
|
||||
pkg: '{{ apt_install_server_cups }}'
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ apt_install_server_cups }}"
|
||||
state: present
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
|
||||
# ---
|
||||
# Cups clients
|
||||
# ---
|
||||
|
||||
- name: (cups.yml) Ensure CUPS packages clients are installed.
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ apt_install_client_cups }}"
|
||||
state: present
|
||||
when:
|
||||
@@ -30,92 +28,103 @@
|
||||
tags:
|
||||
- cups-client
|
||||
|
||||
|
||||
|
||||
# -- file /etc/cups/cups-browsed.conf
|
||||
- name: (cups.yml) Check if file '/etc/cups/cups-browsed.conf.ORIGi' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/cups/cups-browsed.conf.ORIG
|
||||
register: cups_browsed_conf_orig_exists
|
||||
register: common_cups_browsed_conf_orig_exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) Backup /etc/cups/cups-browsed.conf file
|
||||
command: cp /etc/cups/cups-browsed.conf /etc/cups/cups-browsed.conf.ORIG
|
||||
when: cups_browsed_conf_orig_exists.stat.exists == False
|
||||
ansible.builtin.copy:
|
||||
src: /etc/cups/cups-browsed.conf
|
||||
dest: /etc/cups/cups-browsed.conf.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: not common_cups_browsed_conf_orig_exists.stat.exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) update configuration file server - /etc/cups/cups-browsed.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/cups/cups-browsed.conf.server.j2"
|
||||
dest: /etc/cups/cups-browsed.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify:
|
||||
Restart cups-browsed
|
||||
- Restart cups-browsed
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
- name: (cups.yml) update configuration file client - /etc/cups/cups-browsed.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/cups/cups-browsed.conf.client.j2"
|
||||
dest: /etc/cups/cups-browsed.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify:
|
||||
Restart cups-browsed
|
||||
- Restart cups-browsed
|
||||
when:
|
||||
- groups['client_pc']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-client
|
||||
|
||||
|
||||
# -- file /etc/cups/cupsd.conf
|
||||
- name: (cups.yml) Check if file '/etc/cups/cupsd.conf.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/cups/cupsd.conf.ORIG
|
||||
register: cupsd_conf_orig_exists
|
||||
register: common_cupsd_conf_orig_exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) Backup /etc/cups/cupsd.conf file
|
||||
command: cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.ORIG
|
||||
when: cupsd_conf_orig_exists.stat.exists == False
|
||||
ansible.builtin.copy:
|
||||
src: /etc/cups/cupsd.conf
|
||||
dest: /etc/cups/cupsd.conf.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: not common_cupsd_conf_orig_exists.stat.exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) update configuration file server - /etc/cups/cupsd.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/cups/cupsd.conf.server.j2"
|
||||
dest: /etc/cups/cupsd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify:
|
||||
Restart cups
|
||||
- Restart cups
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
- name: (cups.yml) update configuration file client - /etc/cups/cupsd.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/cups/cupsd.conf.client.j2"
|
||||
dest: /etc/cups/cupsd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify:
|
||||
Restart cups
|
||||
- Restart cups
|
||||
when:
|
||||
- groups['client_pc']|string is search(inventory_hostname)
|
||||
tags:
|
||||
@@ -123,30 +132,36 @@
|
||||
|
||||
# -- file /etc/cups/cups-files.conf
|
||||
- name: (cups.yml) Check if file '/etc/cups/cups-files.conf.ORIGi' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/cups/cups-files.conf.ORIG
|
||||
register: cups_files_conf_orig_exists
|
||||
register: common_cups_files_conf_orig_exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) Backup /etc/cups/cups-files.conf file
|
||||
command: cp /etc/cups/cups-files.conf /etc/cups/cups-files.conf.ORIG
|
||||
when: cups_files_conf_orig_exists.stat.exists == False
|
||||
ansible.builtin.copy:
|
||||
src: /etc/cups/cups-files.conf
|
||||
dest: /etc/cups/cups-files.conf.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: not common_cups_files_conf_orig_exists.stat.exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) update configuration file server - /etc/cups/cups-files.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/cups/cups-files.conf.j2"
|
||||
dest: /etc/cups/cups-files.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify:
|
||||
Restart cups
|
||||
- Restart cups
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
# ---
|
||||
|
||||
- name: (default-users.yml) Ensure default groups exists
|
||||
group:
|
||||
ansible.builtin.group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
@@ -17,14 +17,14 @@
|
||||
- groups-exists
|
||||
|
||||
- name: (default-users.yml) Ensure default users exists
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
group: '{{ item.group | default(omit) }}'
|
||||
#group: '{{ item.name | default(omit) }}'
|
||||
# group: '{{ item.name | default(omit) }}'
|
||||
home: '{{ item.home | default(omit) }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
shell: '{{ item.shell | d("/bin/bash") }}'
|
||||
password: "{{ item.password }}"
|
||||
update_password: on_create
|
||||
loop: "{{ default_user }}"
|
||||
@@ -34,7 +34,7 @@
|
||||
- users-exists
|
||||
|
||||
- name: (default-users.yml) Ensure authorized_key files for default users are present
|
||||
authorized_key:
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ item.0.name }}"
|
||||
key: "{{ item.1 }}"
|
||||
state: present
|
||||
@@ -51,7 +51,7 @@
|
||||
# ---
|
||||
|
||||
- name: (default-users.yml) Ensure extra groups exists
|
||||
group:
|
||||
ansible.builtin.group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
@@ -64,13 +64,13 @@
|
||||
- groups-exists
|
||||
|
||||
- name: (default-users.yml) Ensure extra users exists
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
group: '{{ item.name | default(omit) }}'
|
||||
home: '{{ item.home | default(omit) }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
shell: '{{ item.shell | d("/bin/bash") }}'
|
||||
password: "{{ item.password }}"
|
||||
update_password: on_create
|
||||
loop: "{{ extra_user }}"
|
||||
@@ -81,7 +81,7 @@
|
||||
- users-exists
|
||||
|
||||
- name: (default-users.yml) Ensure authorized_key files for extra users are present
|
||||
authorized_key:
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ item.0.name }}"
|
||||
key: "{{ item.1 }}"
|
||||
state: present
|
||||
@@ -95,7 +95,7 @@
|
||||
- authorized_key
|
||||
|
||||
- name: (default-users.yml) other entries authorized_key files
|
||||
authorized_key:
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ item.user }}"
|
||||
key: "{{ item.key }}"
|
||||
state: present
|
||||
@@ -111,12 +111,12 @@
|
||||
# ---
|
||||
|
||||
- name: (default-users.yml) extra system user exists?
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
system: yes
|
||||
system: true
|
||||
home: '{{ item.home }}'
|
||||
shell: '{{ item.shell|d("/usr/sbin/nologin") }}'
|
||||
shell: '{{ item.shell | d("/usr/sbin/nologin") }}'
|
||||
groups: '{{ item.groups | default(omit) }}'
|
||||
loop: "{{ extra_system_user }}"
|
||||
loop_control:
|
||||
@@ -125,37 +125,36 @@
|
||||
tags:
|
||||
- user-exists
|
||||
|
||||
|
||||
# ---
|
||||
# - extra system groups 'sftp_users'
|
||||
# ---
|
||||
|
||||
- name: (default-users.yml) Extra system group sftp_users
|
||||
group:
|
||||
ansible.builtin.group:
|
||||
name: 'sftp_users'
|
||||
state: present
|
||||
system: yes
|
||||
system: true
|
||||
when:
|
||||
- create_sftp_group is defined and create_sftp_group > 0
|
||||
tags:
|
||||
- groups-exists
|
||||
|
||||
|
||||
|
||||
# =======================================================
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow connection via ssh to backup host
|
||||
# ---
|
||||
|
||||
- name: Ensure root's .ssh directory exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /root/.ssh
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0700'
|
||||
|
||||
- name: (default-users.yml) Copy (backup) ed25519 ssh private key to user root
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.priv_key_src }}'
|
||||
dest: '{{ item.priv_key_dest }}'
|
||||
owner: root
|
||||
@@ -172,7 +171,7 @@
|
||||
- insert_ssh_keypair_backup_server
|
||||
|
||||
- name: (default-users.yml) Copy (backup) ed25519 ssh public key to user root
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.pub_key_src }}'
|
||||
dest: '{{ item.pub_key_dest }}'
|
||||
owner: root
|
||||
@@ -189,7 +188,7 @@
|
||||
- insert_ssh_keypair_backup_server
|
||||
|
||||
- name: (default-users.yml) Ensure authorized_key (root) on backup hosts contains public key
|
||||
authorized_key:
|
||||
ansible.posix.authorized_key:
|
||||
user: root
|
||||
key: "{{ lookup('file', item.pub_key_src) }}"
|
||||
state: present
|
||||
@@ -204,9 +203,8 @@
|
||||
- authorized_key
|
||||
- ssh-keypair-backup-server
|
||||
|
||||
|
||||
- name: (default-users.yml) Copy further ssh private key(s) to user root
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.priv_key_src }}'
|
||||
dest: '{{ item.priv_key_dest }}'
|
||||
owner: root
|
||||
@@ -222,9 +220,8 @@
|
||||
tags:
|
||||
- insert_root_ssh_keypair
|
||||
- root-defaut-ssh-keypair
|
||||
|
||||
- name: (default-users.yml) Copy further ssh public key(s) to user root
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item.pub_key_src }}'
|
||||
dest: '{{ item.pub_key_dest }}'
|
||||
owner: root
|
||||
@@ -240,4 +237,3 @@
|
||||
tags:
|
||||
- insert_root_ssh_keypair
|
||||
- root-defaut-ssh-keypair
|
||||
|
||||
|
||||
+67
-19
@@ -5,10 +5,20 @@
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update default repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_default_repositories }}'
|
||||
ansible.builtin.git:
|
||||
repo: "{{ item.repo }}"
|
||||
dest: "{{ item.dest }}"
|
||||
version: >-
|
||||
{{
|
||||
item.version
|
||||
| default(item.branch)
|
||||
| default(
|
||||
'master'
|
||||
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
|
||||
else 'main'
|
||||
)
|
||||
}}
|
||||
with_items: "{{ git_default_repositories }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
tags:
|
||||
@@ -20,10 +30,20 @@
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update file_server repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_oopen_server_repositories }}'
|
||||
ansible.builtin.git:
|
||||
repo: "{{ item.repo }}"
|
||||
dest: "{{ item.dest }}"
|
||||
version: >-
|
||||
{{
|
||||
item.version
|
||||
| default(item.branch)
|
||||
| default(
|
||||
'master'
|
||||
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
|
||||
else 'main'
|
||||
)
|
||||
}}
|
||||
with_items: "{{ git_oopen_server_repositories }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
@@ -36,14 +56,34 @@
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update samba server repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_samba_repositories }}'
|
||||
ansible.builtin.git:
|
||||
repo: "{{ item.repo }}"
|
||||
dest: "{{ item.dest }}"
|
||||
version: >-
|
||||
{{
|
||||
item.version
|
||||
| default(item.branch)
|
||||
| default(
|
||||
'master'
|
||||
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
|
||||
else 'main'
|
||||
)
|
||||
}}
|
||||
with_items: "{{ git_samba_repositories }}"
|
||||
register: common_git_samba_result
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when: "groups['samba_server']|string is search(inventory_hostname)"
|
||||
ignore_errors: True
|
||||
failed_when: >-
|
||||
(common_git_samba_result.failed | default(false)) and (
|
||||
common_git_samba_result.msg is not defined or (
|
||||
('Could not resolve host' not in common_git_samba_result.msg)
|
||||
and ('Connection timed out' not in common_git_samba_result.msg)
|
||||
and ('Failed to connect to' not in common_git_samba_result.msg)
|
||||
and ('Connection reset by peer' not in common_git_samba_result.msg)
|
||||
and ('Operation timed out' not in common_git_samba_result.msg)
|
||||
)
|
||||
)
|
||||
tags:
|
||||
- git-samba-server-repositories
|
||||
|
||||
@@ -53,14 +93,22 @@
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update gateway repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_gateway_repositories }}'
|
||||
ansible.builtin.git:
|
||||
repo: "{{ item.repo }}"
|
||||
dest: "{{ item.dest }}"
|
||||
version: >-
|
||||
{{
|
||||
item.version
|
||||
| default(item.branch)
|
||||
| default(
|
||||
'master'
|
||||
if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
|
||||
else 'main'
|
||||
)
|
||||
}}
|
||||
with_items: "{{ git_gateway_repositories }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when: "groups['gateway_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- git-gateway-server-repositories
|
||||
|
||||
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
- name: (luks.ym) add new key to the LUKS container (container has to exist)
|
||||
luks_device:
|
||||
community.crypto.luks_device:
|
||||
device: "{{ luks_device }}"
|
||||
keyfile: "{{ role_path + '/files/vault/luks_default_passwd' }}"
|
||||
new_keyfile: "{{ role_path + '/files/vault/luks_chris_passwd' }}"
|
||||
|
||||
|
||||
+54
-33
@@ -5,7 +5,8 @@
|
||||
# timezone
|
||||
# locales
|
||||
# systemd-nofiles
|
||||
- import_tasks: basic.yml
|
||||
- name: (main.yml) Import basic.yml tasks
|
||||
ansible.builtin.import_tasks: basic.yml
|
||||
tags:
|
||||
- basic
|
||||
|
||||
@@ -13,7 +14,8 @@
|
||||
# tags supported inside sshd.yml
|
||||
#
|
||||
# sshd-config
|
||||
- import_tasks: sshd.yml
|
||||
- name: (main.yml) Import sshd.yml tasks
|
||||
ansible.builtin.import_tasks: sshd.yml
|
||||
tags: sshd
|
||||
|
||||
|
||||
@@ -27,18 +29,21 @@
|
||||
# apt-remove
|
||||
# apt-autoremove
|
||||
# apt-clean
|
||||
- import_tasks: apt.yml
|
||||
- name: (main.yml) Import apt.yml tasks
|
||||
ansible.builtin.import_tasks: apt.yml
|
||||
tags: apt
|
||||
|
||||
|
||||
- import_tasks: default-users.yml
|
||||
- name: (main.yml) Import default-users.yml tasks
|
||||
ansible.builtin.import_tasks: default-users.yml
|
||||
tags: default-user
|
||||
|
||||
|
||||
# tags supported inside systemd-resolved.yml
|
||||
#
|
||||
# systemd-resolved
|
||||
- import_tasks: systemd-resolved.yml
|
||||
- name: (main.yml) Import systemd-resolved.yml tasks
|
||||
ansible.builtin.import_tasks: systemd-resolved.yml
|
||||
tags:
|
||||
- systemd-resolved
|
||||
when:
|
||||
@@ -52,7 +57,8 @@
|
||||
# git-default-repositories
|
||||
# git-file-server-repositories
|
||||
# git-gateway-server-repositories
|
||||
- import_tasks: git.yml
|
||||
- name: (main.yml) Import git.yml tasks
|
||||
ansible.builtin.import_tasks: git.yml
|
||||
tags: git
|
||||
|
||||
|
||||
@@ -60,7 +66,8 @@
|
||||
#
|
||||
# cups-server
|
||||
# cups-client
|
||||
- import_tasks: cups-install.yml
|
||||
- name: (main.yml) Import cups-install.yml tasks
|
||||
ansible.builtin.import_tasks: cups-install.yml
|
||||
tags:
|
||||
- cups
|
||||
|
||||
@@ -68,7 +75,8 @@
|
||||
# tags supported inside nis-user.yml:
|
||||
#
|
||||
# nis-user
|
||||
- import_tasks: nis-user.yml
|
||||
- name: (main.yml) Import nis-user.yml tasks
|
||||
ansible.builtin.import_tasks: nis-user.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-user
|
||||
@@ -77,14 +85,16 @@
|
||||
# tags supported inside ntp.yml:
|
||||
#
|
||||
# ntp-server
|
||||
- import_tasks: ntp.yml
|
||||
- name: (main.yml) Import ntp.yml tasks
|
||||
ansible.builtin.import_tasks: ntp.yml
|
||||
tags:
|
||||
- ntp
|
||||
|
||||
|
||||
# tags supported inside pure-ftpd-install.yml:
|
||||
#
|
||||
- import_tasks: pure-ftpd-install.yml
|
||||
- name: (main.yml) Import pure-ftpd-install.yml tasks
|
||||
ansible.builtin.import_tasks: pure-ftpd-install.yml
|
||||
when:
|
||||
- groups['ftp_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
@@ -95,7 +105,8 @@
|
||||
#
|
||||
# nfs-server
|
||||
# nfs-client
|
||||
- import_tasks: nfs.yml
|
||||
- name: (main.yml) Import nfs.yml tasks
|
||||
ansible.builtin.import_tasks: nfs.yml
|
||||
tags:
|
||||
- nfs
|
||||
|
||||
@@ -104,7 +115,8 @@
|
||||
#
|
||||
# samba-server
|
||||
# samba-client
|
||||
- import_tasks: samba-install.yml
|
||||
- name: (main.yml) Import samba-install.yml tasks
|
||||
ansible.builtin.import_tasks: samba-install.yml
|
||||
tags:
|
||||
- samba-install
|
||||
- samba
|
||||
@@ -112,14 +124,16 @@
|
||||
|
||||
# tags supported inside samba-remove-user.yml:
|
||||
#
|
||||
- import_tasks: samba-remove-user.yml
|
||||
- name: (main.yml) Import samba-remove-user.yml tasks
|
||||
ansible.builtin.import_tasks: samba-remove-user.yml
|
||||
tags:
|
||||
- samba-remove-user
|
||||
|
||||
|
||||
# tags supported inside system-remove-user.yml:
|
||||
#
|
||||
- import_tasks: system-remove-user.yml
|
||||
- name: (main.yml) Import system-remove-user.yml tasks
|
||||
ansible.builtin.import_tasks: system-remove-user.yml
|
||||
tags:
|
||||
- system-remove-user
|
||||
|
||||
@@ -127,7 +141,8 @@
|
||||
# tags supported inside system-user.yml:
|
||||
#
|
||||
# system-user
|
||||
- import_tasks: system-user.yml
|
||||
- name: (main.yml) Import system-user.yml tasks
|
||||
ansible.builtin.import_tasks: system-user.yml
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- system-user
|
||||
@@ -136,7 +151,8 @@
|
||||
# tags supported inside nis-install-server.yml:
|
||||
#
|
||||
# nis-install-server
|
||||
- import_tasks: nis-install-server.yml
|
||||
- name: (main.yml) Import nis-install-server.yml tasks
|
||||
ansible.builtin.import_tasks: nis-install-server.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
@@ -146,7 +162,8 @@
|
||||
# tags supported inside nis-install-client.yml:
|
||||
#
|
||||
# nis-install-client
|
||||
- import_tasks: nis-install-client.yml
|
||||
- name: (main.yml) Import nis-install-client.yml tasks
|
||||
ansible.builtin.import_tasks: nis-install-client.yml
|
||||
when: "groups['nis_client']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
@@ -156,7 +173,8 @@
|
||||
# tags supported inside samba-user.yml:
|
||||
#
|
||||
# samba-user
|
||||
- import_tasks: samba-user.yml
|
||||
- name: (main.yml) Import samba-user.yml tasks
|
||||
ansible.builtin.import_tasks: samba-user.yml
|
||||
when: "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-samba-user
|
||||
@@ -167,7 +185,8 @@
|
||||
# profile
|
||||
# bashrc
|
||||
# vimrc
|
||||
- import_tasks: system-user-systemfiles.yml
|
||||
- name: (main.yml) Import system-user-systemfiles.yml tasks
|
||||
ansible.builtin.import_tasks: system-user-systemfiles.yml
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- user-systemfiles
|
||||
@@ -178,7 +197,8 @@
|
||||
# profile
|
||||
# bashrc
|
||||
# vimrc
|
||||
- import_tasks: nis-user-systemfiles.yml
|
||||
- name: (main.yml) Import nis-user-systemfiles.yml tasks
|
||||
ansible.builtin.import_tasks: nis-user-systemfiles.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- user-systemfiles
|
||||
@@ -188,7 +208,8 @@
|
||||
# tags supported root-files-scripts.yml:
|
||||
|
||||
# wakeup_lan
|
||||
- import_tasks: root-files-scripts.yml
|
||||
- name: (main.yml) Import root-files-scripts.yml tasks
|
||||
ansible.builtin.import_tasks: root-files-scripts.yml
|
||||
tags:
|
||||
- root-files-scripts
|
||||
|
||||
@@ -198,7 +219,8 @@
|
||||
# sudoers-remove
|
||||
# sudoers-file-configuration
|
||||
# sudoers-global-configuration
|
||||
- import_tasks: sudoers-pc.yml
|
||||
- name: (main.yml) Import sudoers-pc.yml tasks
|
||||
ansible.builtin.import_tasks: sudoers-pc.yml
|
||||
when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- sudoers
|
||||
@@ -209,21 +231,21 @@
|
||||
# sudoers-remove
|
||||
# sudoers-file-configuration
|
||||
# sudoers-global-configuration
|
||||
- import_tasks: sudoers-server.yml
|
||||
- name: (main.yml) Import sudoers-server.yml tasks
|
||||
ansible.builtin.import_tasks: sudoers-server.yml
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- sudoers
|
||||
|
||||
|
||||
- import_tasks: cron.yml
|
||||
- name: (main.yml) Import cron.yml tasks
|
||||
ansible.builtin.import_tasks: cron.yml
|
||||
tags:
|
||||
- cron
|
||||
|
||||
|
||||
|
||||
# tags supported inside mount_samba_shares.yml:
|
||||
#
|
||||
#- import_tasks: mount_samba_shares.yml
|
||||
# - import_tasks: mount_samba_shares.yml
|
||||
# when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
# tags:
|
||||
# - samba-shares
|
||||
@@ -236,7 +258,7 @@
|
||||
# - Ubuntu 18.04LTSi
|
||||
|
||||
- name: "For OS: Ubuntu 16.04LTS, Arch: amd64"
|
||||
import_tasks: ubuntu-x11vnc-1604-amd64.yml
|
||||
ansible.builtin.import_tasks: ubuntu-x11vnc-1604-amd64.yml
|
||||
when:
|
||||
- ansible_facts["distribution_version"] == "16.04"
|
||||
- ansible_architecture == "x86_64"
|
||||
@@ -247,7 +269,7 @@
|
||||
|
||||
|
||||
- name: "For OS: Ubuntu 18.04LTS, Arch: amd64"
|
||||
import_tasks: ubuntu-x11vnc-1804-amd64.yml
|
||||
ansible.builtin.import_tasks: ubuntu-x11vnc-1804-amd64.yml
|
||||
when:
|
||||
- ansible_facts["distribution_version"] == "18.04"
|
||||
- ansible_architecture == "x86_64"
|
||||
@@ -258,7 +280,7 @@
|
||||
|
||||
|
||||
- name: "For OS: Ubuntu 20.04LTS, Arch: amd64"
|
||||
import_tasks: ubuntu-x11vnc-2004-amd64.yml
|
||||
ansible.builtin.import_tasks: ubuntu-x11vnc-2004-amd64.yml
|
||||
when:
|
||||
- ansible_facts["distribution_version"] == "20.04"
|
||||
- ansible_architecture == "x86_64"
|
||||
@@ -269,7 +291,7 @@
|
||||
|
||||
|
||||
- name: "For OS: Ubuntu 22.04LTS, Arch: amd64"
|
||||
import_tasks: ubuntu-x11vnc-2204-amd64.yml
|
||||
ansible.builtin.import_tasks: ubuntu-x11vnc-2204-amd64.yml
|
||||
when:
|
||||
- ansible_facts["distribution_version"] == "22.04"
|
||||
- ansible_architecture == "x86_64"
|
||||
@@ -279,8 +301,7 @@
|
||||
- finish-client-install
|
||||
|
||||
|
||||
|
||||
#- name: "Configure LUKS"
|
||||
# - name: "Configure LUKS"
|
||||
# import_tasks: luks.yml
|
||||
# when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
# tags:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
|
||||
- name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "/mnt/{{ item.name }}"
|
||||
owner: "{{ item.name }}"
|
||||
group: "{{ item.name }}"
|
||||
@@ -14,7 +14,7 @@
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
|
||||
#- name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists
|
||||
# - name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists
|
||||
# file:
|
||||
# path: "/mnt/{{ item.1 }}/{{ item.0.name }}"
|
||||
# owner: "{{ item.1 }}"
|
||||
|
||||
+26
-22
@@ -5,7 +5,7 @@
|
||||
# ---
|
||||
|
||||
- name: (nfs.yml) Ensure NFS utilities (server) are installed.
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- nfs-common
|
||||
- nfs-kernel-server
|
||||
@@ -17,7 +17,7 @@
|
||||
- nfs-server
|
||||
|
||||
- name: (nfs.yml) Ensure directories to export exist
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: '{{ item.src.split(":")[1] }}'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -32,12 +32,12 @@
|
||||
- nfs-server
|
||||
|
||||
- name: (nfs.yml) Copy exports file.
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/exports.j2
|
||||
dest: /etc/exports
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname in groups['nfs_server']
|
||||
notify: Reload nfs
|
||||
@@ -45,15 +45,15 @@
|
||||
- nfs-server
|
||||
|
||||
- name: Enable service rpc-statd and ensure it is not masked
|
||||
systemd:
|
||||
ansible.builtin.systemd:
|
||||
name: rpc-statd
|
||||
enabled: yes
|
||||
masked: no
|
||||
enabled: true
|
||||
masked: false
|
||||
when:
|
||||
- inventory_hostname in groups['nfs_server']
|
||||
|
||||
- name: Make sure service rpc-statd is running
|
||||
systemd:
|
||||
ansible.builtin.systemd:
|
||||
state: started
|
||||
name: rpc-statd
|
||||
when:
|
||||
@@ -66,24 +66,31 @@
|
||||
# ---
|
||||
|
||||
- name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/default/nfs-kernel-server
|
||||
register: default_nfs_kernel_server_exists
|
||||
register: common_default_nfs_kernel_server_exists
|
||||
when:
|
||||
- inventory_hostname in groups['nfs_server']
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
- name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server
|
||||
command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/default/nfs-kernel-server
|
||||
dest: /etc/default/nfs-kernel-server.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname in groups['nfs_server']
|
||||
- default_nfs_kernel_server_exists.stat.exists == False
|
||||
- common_default_nfs_kernel_server_exists.stat.exists
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
- name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/default/nfs-kernel-server
|
||||
regexp: '^RPCNFSDCOUNT=.*'
|
||||
replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}"
|
||||
@@ -97,10 +104,10 @@
|
||||
# ---
|
||||
|
||||
- name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/nfs.conf.d
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
group: root
|
||||
owner: root
|
||||
when:
|
||||
@@ -110,12 +117,12 @@
|
||||
|
||||
|
||||
- name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2'
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/nfs.conf.d/20-start_servers.conf.j2
|
||||
dest: /etc/nfs.conf.d/20-start_servers.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: "Restart nfs-kernel-server"
|
||||
when:
|
||||
- inventory_hostname in groups['nfs_server']
|
||||
@@ -128,7 +135,7 @@
|
||||
# ---
|
||||
|
||||
- name: (nfs.yml) Ensure NFS utilities (clients) are installed.
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
pkg: nfs-common
|
||||
state: present
|
||||
when:
|
||||
@@ -138,7 +145,7 @@
|
||||
- nfs-client
|
||||
|
||||
- name: (nfs.yml) NFS Mount exports from nfs server
|
||||
mount:
|
||||
ansible.posix.mount:
|
||||
path: "{{ item.path }}"
|
||||
src: "{{ item.src }}"
|
||||
fstype: nfs
|
||||
@@ -153,6 +160,3 @@
|
||||
- inventory_hostname in groups['nfs_client']
|
||||
tags:
|
||||
- nfs-client
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -5,29 +5,29 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Set (nis) default domain (/etc/defaultdomain)
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
dest: /etc/defaultdomain
|
||||
src: etc/defaultdomain.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Create preconfigured /etc/yp.conf on nis clients
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
dest: /etc/yp.conf
|
||||
src: etc/yp.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Install nis common packages
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ nis_common_packages }}"
|
||||
@@ -41,23 +41,30 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Check if file '/etc/default/nis.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/default/nis.ORIG
|
||||
register: default_nis_exists
|
||||
register: common_default_nis_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Backup existing file /etc/default/nis
|
||||
command: cp -a /etc/default/nis /etc/default/nis.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/default/nis
|
||||
dest: /etc/default/nis.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- default_nis_exists.stat.exists == False
|
||||
- not common_default_nis_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISSERVER' (client)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^NISSERVER=.*'
|
||||
replace: 'NISSERVER=false'
|
||||
@@ -66,7 +73,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (client)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^NISCLIENT=.*'
|
||||
replace: 'NISCLIENT=true'
|
||||
@@ -75,7 +82,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'YPBINDARGS' (client)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^YPBINDARGS=.*'
|
||||
replace: 'YPBINDARGS='
|
||||
@@ -89,7 +96,7 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Add '+::::::' to file /etc/passwd
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/passwd
|
||||
line: '+::::::'
|
||||
insertafter: EOF
|
||||
@@ -103,7 +110,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Add '+:::' to file /etc/group
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/group
|
||||
line: '+:::'
|
||||
insertafter: EOF
|
||||
@@ -117,7 +124,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Add '+::::::::' to file /etc/shadow
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/shadow
|
||||
line: '+::::::::'
|
||||
insertafter: EOF
|
||||
@@ -136,23 +143,30 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Check if file '/etc/hosts.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/hosts.ORIG
|
||||
register: etc_hosts_orig_exists
|
||||
register: common_etc_hosts_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Backup existing file /etc/hosts
|
||||
command: cp -a /etc/hosts /etc/hosts.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/hosts
|
||||
dest: /etc/hosts.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- etc_hosts_orig_exists.stat.exists == False
|
||||
- not common_etc_hosts_orig_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Add nis-server to file /etc/hosts
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
|
||||
insertafter: EOF
|
||||
@@ -170,23 +184,30 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Check if file '/etc/nsswitch.conf.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/nsswitch.conf.ORIG
|
||||
register: nsswitch_conf_orig_exists
|
||||
register: common_nsswitch_conf_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Backup existing file /etc/nsswitch.conf
|
||||
command: cp -a /etc/nsswitch.conf /etc/nsswitch.conf.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/nsswitch.conf
|
||||
dest: /etc/nsswitch.conf.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- nsswitch_conf_orig_exists.stat.exists == False
|
||||
- not common_nsswitch_conf_orig_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set hosts)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: '(hosts:\s+files)\s+((?!nis).*)$'
|
||||
replace: '\1 nis \2'
|
||||
@@ -195,7 +216,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set passwd/group/shadow)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: '^({{ item }}:\s+((?!nis).)*)$'
|
||||
replace: '\1 nis'
|
||||
@@ -239,7 +260,7 @@
|
||||
# - systemctl restart systemd-logind.service
|
||||
|
||||
- name: (nis-install-client.yml) Ensure directory /etc/systemd/system/systemd-logind.service.d exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/systemd-logind.service.d
|
||||
owner: root
|
||||
group: root
|
||||
@@ -251,7 +272,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path + '/files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf' }}"
|
||||
dest: /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
|
||||
owner: root
|
||||
@@ -281,7 +302,7 @@
|
||||
# - cat /etc/systemd/system/rpcbind.socket.d/override.conf
|
||||
|
||||
- name: (nis-install-client.yml) Ensure directory /etc/systemd/system/rpcbind.socket.d exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/rpcbind.socket.d
|
||||
owner: root
|
||||
group: root
|
||||
@@ -293,7 +314,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/rpcbind.socket.d/override.conf exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path + '/files/etc/systemd/system/rpcbind.socket.d/override.conf' }}"
|
||||
dest: /etc/systemd/system/rpcbind.socket.d/override.conf
|
||||
owner: root
|
||||
@@ -307,7 +328,7 @@
|
||||
- nis-install-client
|
||||
|
||||
- name: Make sure service rpcbind, nscd and ypbind are started and enabled
|
||||
systemd:
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
state: restarted
|
||||
enabled: true
|
||||
@@ -315,4 +336,3 @@
|
||||
- rpcbind
|
||||
- nscd
|
||||
- ypbind
|
||||
|
||||
|
||||
@@ -5,39 +5,40 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Install nis common packages
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ nis_common_packages }}"
|
||||
register: nis_installed
|
||||
register: common_nis_installed
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Set (nis) default domain (/etc/defaultdomain)
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
dest: /etc/defaultdomain
|
||||
src: etc/defaultdomain.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 644
|
||||
mode: "0644"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Create preconfigured /etc/yp.conf on nis clients
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
dest: /etc/yp.conf
|
||||
src: etc/yp.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 644
|
||||
mode: "0644"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-server.yml) Set local host's domain name
|
||||
command: domainname "{{ nis_domain }}"
|
||||
ansible.builtin.command: domainname "{{ nis_domain }}"
|
||||
changed_when: false
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
@@ -51,9 +52,9 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/pam.d/common-password' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/pam.d/common-password
|
||||
register: file_etc_pam_d_common_password
|
||||
register: common_file_etc_pam_d_common_password
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
@@ -62,28 +63,28 @@
|
||||
- ansible_facts['distribution_major_version']|int >= 11
|
||||
|
||||
- name: (nis-install-server.yml) Check if default hash for password is 'yescrypt'
|
||||
shell: "grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password"
|
||||
register: presence_of_passwprd_hashing_yescrypt
|
||||
changed_when:
|
||||
- presence_of_passwprd_hashing_yescrypt.rc < 1
|
||||
ansible.builtin.command: grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password
|
||||
register: common_presence_of_passwprd_hashing_yescrypt
|
||||
changed_when: false
|
||||
failed_when:
|
||||
- presence_of_passwprd_hashing_yescrypt.rc >= 2
|
||||
- common_presence_of_passwprd_hashing_yescrypt.rc >= 2
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version']|int >= 11
|
||||
- file_etc_pam_d_common_password.stat.exists == True
|
||||
#- ansible_distribution_major_version|int <= 12
|
||||
- common_file_etc_pam_d_common_password.stat.exists
|
||||
# - ansible_distribution_major_version|int <= 12
|
||||
|
||||
- name: (nis-install-server.yml) Change default password hash for local system
|
||||
accounts from SHA-512 to yescrypt
|
||||
shell: perl -i -n -p -e "s/^(password.+)yescrypt/\1sha512/"
|
||||
/etc/pam.d/common-password
|
||||
- name: (nis-install-server.yml) Change default password hash for local system accounts from yescrypt to SHA-512
|
||||
ansible.builtin.replace:
|
||||
path: /etc/pam.d/common-password
|
||||
regexp: '^(password.+)yescrypt'
|
||||
replace: '\1sha512'
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version']|int >= 11
|
||||
- file_etc_pam_d_common_password.stat.exists == True
|
||||
- presence_of_passwprd_hashing_yescrypt is changed
|
||||
#- ansible_facts['distribution_major_version']|int <= 12
|
||||
- common_file_etc_pam_d_common_password.stat.exists
|
||||
- common_presence_of_passwprd_hashing_yescrypt.rc == 0
|
||||
# - ansible_facts['distribution_major_version']|int <= 12
|
||||
|
||||
|
||||
# ---
|
||||
@@ -91,24 +92,31 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/default/nis.ORIG
|
||||
register: default_nis_exists
|
||||
register: common_default_nis_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /etc/default/nis
|
||||
command: cp -a /etc/default/nis /etc/default/nis.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/default/nis
|
||||
dest: /etc/default/nis.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- default_nis_exists.stat.exists == False
|
||||
- not common_default_nis_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER'
|
||||
(server)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/default/nis
|
||||
regexp: "^NISSERVER=.*"
|
||||
replace: "NISSERVER=master"
|
||||
@@ -118,7 +126,7 @@
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT'
|
||||
(server)
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/default/nis
|
||||
regexp: "^NISCLIENT=.*"
|
||||
replace: "NISCLIENT=false"
|
||||
@@ -131,24 +139,31 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/ypserv.securenets.ORIG
|
||||
register: ypserv_securenets_orig_exists
|
||||
register: common_ypserv_securenets_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets
|
||||
command: cp -a /etc/ypserv.securenets /etc/ypserv.securenets.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/ypserv.securenets
|
||||
dest: /etc/ypserv.securenets.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- ypserv_securenets_orig_exists.stat.exists == False
|
||||
- not common_ypserv_securenets_orig_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file
|
||||
/etc/ypserv.securenets
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /etc/ypserv.securenets
|
||||
regexp: "^(0.0.0.0\\s+.*)"
|
||||
replace: "#\\1"
|
||||
@@ -158,7 +173,7 @@
|
||||
|
||||
- name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file
|
||||
/etc/ypserv.securenets
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ypserv.securenets
|
||||
line: "255.255.0.0 192.168.0.0"
|
||||
insertafter: EOF
|
||||
@@ -172,7 +187,7 @@
|
||||
|
||||
- name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file
|
||||
/etc/ypserv.securenets
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ypserv.securenets
|
||||
line: "255.0.0.0 10.0.0.0"
|
||||
insertafter: EOF
|
||||
@@ -185,8 +200,13 @@
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m'
|
||||
shell: printf '\n' | /usr/lib/yp/ypinit -m
|
||||
when: nis_installed.changed
|
||||
ansible.builtin.command: /usr/lib/yp/ypinit -m
|
||||
args:
|
||||
stdin: "\n"
|
||||
changed_when: false
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] | int >= 11
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
@@ -197,7 +217,7 @@
|
||||
|
||||
- name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually
|
||||
/data/home) exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ nis_base_home }}"
|
||||
owner: root
|
||||
group: root
|
||||
@@ -230,9 +250,9 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists'
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/adduser.conf.ORIG
|
||||
register: adduser_conf_exists
|
||||
register: common_adduser_conf_exists
|
||||
when:
|
||||
- nis_base_home is defined
|
||||
- nis_base_home != '/home'
|
||||
@@ -241,11 +261,18 @@
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /etc/adduser.conf
|
||||
command: cp -a /etc/adduser.conf /etc/adduser.conf.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/adduser.conf
|
||||
dest: /etc/adduser.conf.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- nis_base_home is defined
|
||||
- nis_base_home != '/home'
|
||||
- adduser_conf_exists.stat.exists == False
|
||||
- not common_adduser_conf_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
@@ -267,23 +294,30 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists'
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /var/yp/Makefile.ORIG
|
||||
register: adduser_conf_exists
|
||||
register: common_yp_makefile_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /var/yp/Makefile
|
||||
command: cp -a /var/yp/Makefile /var/yp/Makefile.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /var/yp/Makefile
|
||||
dest: /var/yp/Makefile.ORIG
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- adduser_conf_exists.stat.exists == False
|
||||
- not common_yp_makefile_orig_exists.stat.exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file '/var/yp/Makefile'
|
||||
replace:
|
||||
ansible.builtin.replace:
|
||||
path: /var/yp/Makefile
|
||||
regexp: "^#?{{ item }}=.*"
|
||||
replace: "{{ item }}=true"
|
||||
|
||||
@@ -5,26 +5,26 @@
|
||||
# ---
|
||||
|
||||
# nis_users
|
||||
#- name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
|
||||
# local_action: stat path={{ inventory_dir }}/files/{{ nis_domain}}/homedirs/{{ item.name }}
|
||||
# - name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
|
||||
# local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}
|
||||
# with_items: "{{ nis_user }}"
|
||||
# loop_control:
|
||||
# label: '{{ item.name }}'
|
||||
# register: local_template_dir_nis_user
|
||||
# register: common_local_template_dir_nis_user
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
|
||||
delegate_to: localhost
|
||||
stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain}}/homedirs/{{ item.name }}"
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
|
||||
with_items: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: local_template_dir_nis_user
|
||||
register: common_local_template_dir_nis_user
|
||||
|
||||
#- name: Print variable local_template_dir_nis_user
|
||||
# debug: var=local_template_dir_nis_user.results
|
||||
# - name: Print variable common_local_template_dir_nis_user
|
||||
# debug: var=common_local_template_dir_nis_user.results
|
||||
|
||||
#- meta: end_play
|
||||
# - meta: end_play
|
||||
|
||||
|
||||
# --
|
||||
@@ -32,9 +32,9 @@
|
||||
# ---
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Check if users file '.profile.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: "~{{ item.name }}/.profile.ORIG"
|
||||
register: profile_user_orig_exists
|
||||
register: common_profile_user_orig_exists
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -42,12 +42,19 @@
|
||||
- profile
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
|
||||
loop: "{{ profile_user_orig_exists.results }}"
|
||||
ansible.builtin.copy:
|
||||
src: "~{{ item.item.name }}/.profile"
|
||||
dest: "~{{ item.item.name }}/.profile.ORIG"
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: "0644"
|
||||
loop: "{{ common_profile_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == False
|
||||
- not item.stat.exists
|
||||
tags:
|
||||
- profile
|
||||
|
||||
@@ -59,7 +66,7 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ nis_user }}"
|
||||
register: profile_template_stats
|
||||
register: common_profile_template_stats
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
@@ -72,7 +79,7 @@
|
||||
group: "{{ user.name }}"
|
||||
mode: "0644"
|
||||
become: true
|
||||
loop: "{{ nis_user | zip(profile_template_stats.results) | list }}"
|
||||
loop: "{{ nis_user | zip(common_profile_template_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -83,16 +90,14 @@
|
||||
tags: [bash]
|
||||
|
||||
|
||||
|
||||
|
||||
# --
|
||||
# Copy .bashrc
|
||||
# ---
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: "~{{ item.name }}/.bashrc.ORIG"
|
||||
register: bashrc_user_orig_exists
|
||||
register: common_bashrc_user_orig_exists
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -100,11 +105,18 @@
|
||||
- bashrc
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Backup existing users .bashrc file
|
||||
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
|
||||
loop: "{{ bashrc_user_orig_exists.results }}"
|
||||
ansible.builtin.copy:
|
||||
src: "~{{ item.item.name }}/.bashrc"
|
||||
dest: "~{{ item.item.name }}/.bashrc.ORIG"
|
||||
remote_src: true
|
||||
force: false
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: "0644"
|
||||
loop: "{{ common_bashrc_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when: item.stat.exists == False
|
||||
when: not item.stat.exists
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
@@ -115,7 +127,7 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ nis_user }}"
|
||||
register: bashrc_stats
|
||||
register: common_bashrc_stats
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
@@ -128,7 +140,7 @@
|
||||
group: "{{ user.name }}"
|
||||
mode: "0644"
|
||||
become: true
|
||||
loop: "{{ nis_user | zip(bashrc_stats.results) | list }}"
|
||||
loop: "{{ nis_user | zip(common_bashrc_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -150,7 +162,7 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ nis_user }}"
|
||||
register: vimrc_stats
|
||||
register: common_vimrc_stats
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
|
||||
@@ -162,7 +174,7 @@
|
||||
owner: "{{ user.name }}"
|
||||
group: "{{ user.name }}"
|
||||
mode: '0644'
|
||||
loop: "{{ nis_user | zip(vimrc_stats.results) | list }}"
|
||||
loop: "{{ nis_user | zip(common_vimrc_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -181,7 +193,7 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ nis_user }}"
|
||||
register: dotvim_stats
|
||||
register: common_dotvim_stats
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
@@ -193,7 +205,7 @@
|
||||
dest: "~{{ user.name }}/"
|
||||
mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch
|
||||
become: true
|
||||
loop: "{{ nis_user | zip(dotvim_stats.results) | list }}"
|
||||
loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -213,7 +225,7 @@
|
||||
recurse: true
|
||||
state: directory
|
||||
become: true
|
||||
loop: "{{ nis_user | zip(dotvim_stats.results) | list }}"
|
||||
loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -222,4 +234,3 @@
|
||||
user: "{{ item.0 }}"
|
||||
stat_result: "{{ item.1 }}"
|
||||
tags: [vim]
|
||||
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Ensure nis groups exists
|
||||
group:
|
||||
ansible.builtin.group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
@@ -46,17 +46,18 @@
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
# - meta: end_host
|
||||
|
||||
- name: (nis_user.yml) Get database of nis (system) users
|
||||
getent:
|
||||
ansible.builtin.getent:
|
||||
database: passwd
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Add nis (system) users if not yet exists..
|
||||
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
changed_when: true
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -69,17 +70,17 @@
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Ensure nis users exists
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
#group: '{{ item.0.name | default(omit) }}'
|
||||
groups: "{{ item.groups|join(', ') }}"
|
||||
# group: '{{ item.0.name | default(omit) }}'
|
||||
groups: "{{ item.groups | join(', ') }}"
|
||||
home: '{{ nis_base_home }}/{{ item.name }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
shell: '{{ item.shell | d("/bin/bash") }}'
|
||||
password: "{{ item.password | password_hash('sha512') }}"
|
||||
update_password: on_create
|
||||
append: yes
|
||||
append: true
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -90,42 +91,42 @@
|
||||
|
||||
|
||||
- name: (nis_user.yml) Check if directory ~/.config/autostart exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: home_config_autostart
|
||||
register: common_home_config_autostart
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
|
||||
- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart'
|
||||
state: directory
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0700
|
||||
recurse: yes
|
||||
loop: "{{ home_config_autostart.results }}"
|
||||
mode: "0700"
|
||||
recurse: true
|
||||
loop: "{{ common_home_config_autostart.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when : not item.stat.exists|bool
|
||||
when: not item.stat.exists|bool
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
|
||||
#- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
|
||||
# - name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
|
||||
# file:
|
||||
# path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
|
||||
# state: directory
|
||||
# owner: "{{ item.name }}"
|
||||
# group: "{{ item.name }}"
|
||||
# mode: 0700
|
||||
# recurse: yes
|
||||
# mode: "0700"
|
||||
# recurse: true
|
||||
# loop: "{{ nis_user }}"
|
||||
# loop_control:
|
||||
# label: '{{ item.name }}'
|
||||
@@ -135,42 +136,40 @@
|
||||
|
||||
|
||||
- name: (nis_user.yml) Check if file ~/.config/autostart/x11vnc.desktop exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: home_config_autostart_x11vnc
|
||||
register: common_home_config_autostart_x11vnc
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
|
||||
dest: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart/x11vnc.desktop'
|
||||
owner: '{{ item.item.name }}'
|
||||
group: '{{ item.item.name }}'
|
||||
mode: 0600
|
||||
loop: "{{ home_config_autostart_x11vnc.results }}"
|
||||
mode: "0600"
|
||||
loop: "{{ common_home_config_autostart_x11vnc.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
#- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
|
||||
# - name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
|
||||
# copy:
|
||||
# src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
|
||||
# dest: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
|
||||
# owner: '{{ item.name }}'
|
||||
# group: '{{ item.name }}'
|
||||
# mode: 0600
|
||||
# mode: "0600"
|
||||
# loop: "{{ nis_user }}"
|
||||
# loop_control:
|
||||
# label: '{{ item.name }}'
|
||||
# tags:
|
||||
# - nis-user
|
||||
# - x11vnc
|
||||
|
||||
|
||||
|
||||
+19
-14
@@ -5,28 +5,27 @@
|
||||
# ---
|
||||
|
||||
- name: (ntp.yml) Ensure ntpsec package is installed.
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- ntpsec
|
||||
state: present
|
||||
when:
|
||||
- ansible_facts.os_family == "Debian"
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
- name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/ntpsec/ntp.conf.ORIG
|
||||
register: etc_ntpsec_conf_ORIG
|
||||
register: common_etc_ntpsec_conf_orig
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
|
||||
- name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /var/log/ntpsec
|
||||
state: directory
|
||||
owner: ntpsec
|
||||
@@ -37,23 +36,29 @@
|
||||
|
||||
|
||||
- name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf'
|
||||
command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/ntpsec/ntp.conf
|
||||
dest: /etc/ntpsec/ntp.conf.ORIG
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: false
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- etc_ntpsec_conf_ORIG.stat.exists == False
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
- not common_etc_ntpsec_conf_orig.stat.exists
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
- name: (ntp.yml) Update '/etc/ntpsec/ntp.conf'
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/ntpsec/ntp.conf.j2"
|
||||
dest: /etc/ntpsec/ntp.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Restart ntp
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
|
||||
@@ -13,40 +13,42 @@
|
||||
# Install PureFTP Daemon
|
||||
# ---
|
||||
|
||||
- include_tasks: pure-ftpd/setup.yml
|
||||
- name: (pure-ftpd-install.yml) Include pure-ftpd setup tasks.
|
||||
ansible.builtin.include_tasks: pure-ftpd/setup.yml
|
||||
|
||||
|
||||
# ---
|
||||
# Configure PureFTP Daemon
|
||||
# ---
|
||||
|
||||
- include_tasks: pure-ftpd/configure.yml
|
||||
- name: (pure-ftpd-install.yml) Include pure-ftpd configure tasks.
|
||||
ansible.builtin.include_tasks: pure-ftpd/configure.yml
|
||||
|
||||
|
||||
# ---
|
||||
# Authentication Configuration
|
||||
# ---
|
||||
|
||||
- include_tasks: pure-ftpd/authentication.yml
|
||||
- name: (pure-ftpd-install.yml) Include pure-ftpd authentication tasks.
|
||||
ansible.builtin.include_tasks: pure-ftpd/authentication.yml
|
||||
|
||||
|
||||
# ---
|
||||
# Virtual user
|
||||
# ---
|
||||
|
||||
- include_tasks: pure-ftpd/virtual-users.yml
|
||||
|
||||
- name: (pure-ftpd-install.yml) Include pure-ftpd virtual user tasks.
|
||||
ansible.builtin.include_tasks: pure-ftpd/virtual-users.yml
|
||||
|
||||
# ---
|
||||
# TLS Certificate
|
||||
# ---
|
||||
|
||||
- include_tasks: pure-ftpd/tls-certificate.yml
|
||||
|
||||
- name: (pure-ftpd-install.yml) Include pure-ftpd TLS certificate tasks.
|
||||
ansible.builtin.include_tasks: pure-ftpd/tls-certificate.yml
|
||||
|
||||
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd service is started enabled on startup.
|
||||
service:
|
||||
ansible.builtin.service:
|
||||
name: pure-ftpd
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
enabled: true
|
||||
|
||||
@@ -5,16 +5,16 @@
|
||||
# ---
|
||||
|
||||
- name: (pure-ftpd-install.yml) Get current authentications.
|
||||
command: ls -1 {{ pureftpd_config_auth_dir }}
|
||||
register: pureftpd_current_auth
|
||||
ansible.builtin.command: ls -1 {{ pureftpd_config_auth_dir }}
|
||||
register: common_pureftpd_current_auth
|
||||
changed_when: false
|
||||
|
||||
- name: (pure-ftpd-install.yml) Define empty pureftpd_authentications variable.
|
||||
set_fact:
|
||||
pureftpd_authentications: []
|
||||
ansible.builtin.set_fact:
|
||||
common_pureftpd_authentications: []
|
||||
|
||||
- name: (pure-ftpd-install.yml) Enable PureDB authentication.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
src: "{{ pureftpd_config_conf_dir }}/PureDB"
|
||||
dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_puredb }}pure"
|
||||
state: link
|
||||
@@ -22,18 +22,18 @@
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
- name: (pure-ftpd-install.yml) Add PureDB to Pure-FTPd authentications.
|
||||
set_fact:
|
||||
pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']"
|
||||
ansible.builtin.set_fact:
|
||||
common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']"
|
||||
when: pureftpd_auth_puredb > 0 and pureftpd_config['PureDB'] is defined
|
||||
|
||||
- name: (pure-ftpd-install.yml) Add PAM to Pure-FTPd authentications.
|
||||
set_fact:
|
||||
pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']"
|
||||
ansible.builtin.set_fact:
|
||||
common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']"
|
||||
when: pureftpd_auth_pam > 0 and pureftpd_config['PAMAuthentication'] is defined
|
||||
|
||||
|
||||
- name: (pure-ftpd-install.yml) Enable UNIX authentication.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
src: "{{ pureftpd_config_conf_dir }}/UnixAuthentication"
|
||||
dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_unix }}unix"
|
||||
state: link
|
||||
@@ -41,13 +41,13 @@
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
- name: (pure-ftpd-install.yml) Add UnixAuthentication to Pure-FTPd authentications.
|
||||
set_fact:
|
||||
pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']"
|
||||
ansible.builtin.set_fact:
|
||||
common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']"
|
||||
when: pureftpd_auth_unix > 0 and pureftpd_config['UnixAuthentication'] is defined
|
||||
|
||||
|
||||
- name: (pure-ftpd-install.yml) Enable PAM authentication.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
src: "{{ pureftpd_config_conf_dir }}/PAMAuthentication"
|
||||
dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_pam }}pam"
|
||||
state: link
|
||||
@@ -58,9 +58,9 @@
|
||||
# Delete unused authentification if exists
|
||||
|
||||
- name: (pure-ftpd-install.yml) Delete old authentications.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ pureftpd_config_auth_dir }}/{{ item }}"
|
||||
state: absent
|
||||
when: item not in pureftpd_authentications
|
||||
with_items: "{{ pureftpd_current_auth.stdout_lines }}"
|
||||
when: item not in common_pureftpd_authentications
|
||||
with_items: "{{ common_pureftpd_current_auth.stdout_lines }}"
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
# Remove old current configurations if exists
|
||||
|
||||
- name: Upload Pure-FTPd global configuration file.
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/default/pure-ftpd-common.j2
|
||||
dest: "{{ pureftpd_global_config_file }}"
|
||||
owner: root
|
||||
@@ -16,30 +16,30 @@
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
- name: (pure-ftpd-install.yml) Compile Pure-FTPd configurations (set fact..).
|
||||
set_fact:
|
||||
pureftpd_config_compiled: "{{ pureftpd_config }}"
|
||||
ansible.builtin.set_fact:
|
||||
common_pureftpd_config_compiled: "{{ pureftpd_config }}"
|
||||
|
||||
- name: (pure-ftpd-install.yml) Get current configuration.
|
||||
command: ls -1 {{ pureftpd_config_conf_dir }}
|
||||
register: pureftpd_current_config
|
||||
ansible.builtin.command: ls -1 {{ pureftpd_config_conf_dir }}
|
||||
register: common_pureftpd_current_config
|
||||
changed_when: false
|
||||
|
||||
- name: (pure-ftpd-install.yml) Delete old configuration.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ pureftpd_config_conf_dir }}/{{ item }}"
|
||||
state: absent
|
||||
when: pureftpd_config_compiled[item] is not defined
|
||||
with_items: "{{ pureftpd_current_config.stdout_lines }}"
|
||||
when: common_pureftpd_config_compiled[item] is not defined
|
||||
with_items: "{{ common_pureftpd_current_config.stdout_lines }}"
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
# write new configuration
|
||||
|
||||
- name: (pure-ftpd-install.yml) Write configuration.
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/pure-ftpd/conf/config.j2
|
||||
dest: "{{ pureftpd_config_conf_dir }}/{{ item.key }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
with_dict: '{{ pureftpd_config_compiled }}'
|
||||
with_dict: '{{ common_pureftpd_config_compiled }}'
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
@@ -4,31 +4,59 @@
|
||||
# Add virtual ftp users
|
||||
# ---
|
||||
|
||||
- name: "(create-virtual-ftp-user.yml) Verify if virtual ftp user {{ user.name }} exists"
|
||||
command: pure-pw show {{ user.name }}
|
||||
register: pureftpd_virtual_user_exists
|
||||
changed_when: "pureftpd_virtual_user_exists.rc != 0"
|
||||
- name: (create-virtual-ftp-user.yml) Verify if virtual ftp user exists for {{ user.name }}
|
||||
ansible.builtin.command: pure-pw show {{ user.name }}
|
||||
register: common_pureftpd_virtual_user_exists
|
||||
changed_when: false
|
||||
failed_when:
|
||||
- "pureftpd_virtual_user_exists.rc != 0"
|
||||
- "pureftpd_virtual_user_exists.rc != 16"
|
||||
ignore_errors: true
|
||||
- common_pureftpd_virtual_user_exists.rc != 0
|
||||
- common_pureftpd_virtual_user_exists.rc != 16
|
||||
loop_control:
|
||||
label: '{{ user.name }}'
|
||||
|
||||
- name: "(create-virtual-ftp-user.yml) Create virtual ftp user {{ user.name }} ."
|
||||
shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw useradd {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}"
|
||||
#when: pureftpd_virtual_user_exists.failed is defined and pureftpd_virtual_user_exists.failed
|
||||
when: pureftpd_virtual_user_exists.changed
|
||||
- name: (create-virtual-ftp-user.yml) Create virtual ftp user for {{ user.name }}
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
set -o pipefail &&
|
||||
(echo {{ user.password }}; echo {{ user.password }}) |
|
||||
pure-pw useradd {{ user.name }}
|
||||
-u {{ user.uid | default(pureftpd_virtual_users_user) }}
|
||||
-g {{ user.gid | default(pureftpd_virtual_users_group) }}
|
||||
-d {{ user.homedir }}
|
||||
-n {{ user.quota_files | default('""') }}
|
||||
-N {{ user.quota_size | default('""') }}
|
||||
-t {{ user.bandwidth_dl | default('""') }}
|
||||
-T {{ user.bandwidth_ul | default('""') }}
|
||||
-q {{ user.ratio_ul | default('""') }}
|
||||
-Q {{ user.ratio_dl | default('""') }}
|
||||
executable: /bin/bash
|
||||
when: common_pureftpd_virtual_user_exists.rc == 16
|
||||
changed_when: true
|
||||
notify: reload Pure-FTPd users
|
||||
|
||||
- name: "User {{ user.name }}: Update virtual user"
|
||||
command: "pure-pw usermod {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}"
|
||||
#when: pureftpd_virtual_user_exists.failed is defined and not pureftpd_virtual_user_exists.failed
|
||||
when: not pureftpd_virtual_user_exists.changed
|
||||
- name: (create-virtual-ftp-user.yml) Update virtual ftp user for {{ user.name }}
|
||||
ansible.builtin.command: >-
|
||||
pure-pw usermod {{ user.name }}
|
||||
-u {{ user.uid | default(pureftpd_virtual_users_user) }}
|
||||
-g {{ user.gid | default(pureftpd_virtual_users_group) }}
|
||||
-d {{ user.homedir }}
|
||||
-n {{ user.quota_files | default('""') }}
|
||||
-N {{ user.quota_size | default('""') }}
|
||||
-t {{ user.bandwidth_dl | default('""') }}
|
||||
-T {{ user.bandwidth_ul | default('""') }}
|
||||
-q {{ user.ratio_ul | default('""') }}
|
||||
-Q {{ user.ratio_dl | default('""') }}
|
||||
when: common_pureftpd_virtual_user_exists.rc == 0
|
||||
changed_when: true
|
||||
notify: reload Pure-FTPd users
|
||||
|
||||
- name: "User {{ user.name }}: Update virtual user password"
|
||||
shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw passwd {{ user.name }}"
|
||||
when: not pureftpd_virtual_user_exists.changed
|
||||
- name: (create-virtual-ftp-user.yml) Update virtual ftp user password for {{ user.name }}
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
set -o pipefail &&
|
||||
(echo {{ user.password }}; echo {{ user.password }}) |
|
||||
pure-pw passwd {{ user.name }}
|
||||
executable: /bin/bash
|
||||
when: common_pureftpd_virtual_user_exists.rc == 0
|
||||
changed_when: true
|
||||
notify: reload Pure-FTPd users
|
||||
|
||||
|
||||
@@ -4,16 +4,16 @@
|
||||
# Remove virtual ftp users
|
||||
# ---
|
||||
|
||||
- name: "User {{ user.name }}: Verify if it exists"
|
||||
command: pure-pw show {{ user.name }}
|
||||
register: pureftpd_virtual_user_exists
|
||||
changed_when: "pureftpd_virtual_user_exists.rc == 0"
|
||||
- name: (remove-virtual-user.yml) Verify virtual ftp user exists for {{ user.name }}
|
||||
ansible.builtin.command: pure-pw show {{ user.name }}
|
||||
register: common_pureftpd_virtual_user_exists
|
||||
changed_when: false
|
||||
failed_when:
|
||||
- "pureftpd_virtual_user_exists.rc != 0"
|
||||
- "pureftpd_virtual_user_exists.rc != 16"
|
||||
ignore_errors: true
|
||||
- common_pureftpd_virtual_user_exists.rc != 0
|
||||
- common_pureftpd_virtual_user_exists.rc != 16
|
||||
|
||||
- name: "User {{ user.name }}: Remove virtual user"
|
||||
shell: "pure-pw userdel {{ user.name }}"
|
||||
when: pureftpd_virtual_user_exists.changed
|
||||
- name: (remove-virtual-user.yml) Remove virtual ftp user for {{ user.name }}
|
||||
ansible.builtin.command: pure-pw userdel {{ user.name }}
|
||||
when: common_pureftpd_virtual_user_exists.rc == 0
|
||||
changed_when: true
|
||||
notify: reload Pure-FTPd users
|
||||
|
||||
@@ -5,14 +5,14 @@
|
||||
# ---
|
||||
|
||||
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd is installed.
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name: "{{ pureftpd_packages }}"
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
|
||||
- name: (pure-ftpd-install.yml) Upload Pure-FTPd global configuration file.
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/default/pure-ftpd-common.j2
|
||||
dest: "{{ pureftpd_global_config_file }}"
|
||||
owner: root
|
||||
|
||||
@@ -6,8 +6,37 @@
|
||||
|
||||
# - method 'generate'
|
||||
|
||||
- name: Build Pure-FTPd TLS subject.
|
||||
ansible.builtin.set_fact:
|
||||
common_pureftpd_tls_subject: >-
|
||||
/C={{ pureftpd_tls_certificate_openssl.country | default('') }}
|
||||
/ST={{ pureftpd_tls_certificate_openssl.state | default('') }}
|
||||
/L={{ pureftpd_tls_certificate_openssl.locality | default('') }}
|
||||
/O={{ pureftpd_tls_certificate_openssl.organization | default('') }}
|
||||
/OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}
|
||||
/CN={{ pureftpd_tls_certificate_openssl.fqdn }}
|
||||
when:
|
||||
- pureftpd_tls_certificate_method == 'generate'
|
||||
- pureftpd_tls_certificate_openssl | length > 0
|
||||
|
||||
- name: Generate Pure-FTPd TLS certificate.
|
||||
command: openssl req -x509 -nodes -newkey rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }} -sha256 -days {{ pureftpd_tls_certificate_openssl.days | default(365) }} -keyout {{ pureftpd_tls_certificate_pem }} -out {{ pureftpd_tls_certificate_pem }} -subj "/C={{ pureftpd_tls_certificate_openssl.country | default('') }}/ST={{ pureftpd_tls_certificate_openssl.state | default('') }}/L={{ pureftpd_tls_certificate_openssl.locality | default('') }}/O={{ pureftpd_tls_certificate_openssl.organization | default('') }}/OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}/CN={{ pureftpd_tls_certificate_openssl.fqdn }}"
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- openssl
|
||||
- req
|
||||
- -x509
|
||||
- -nodes
|
||||
- -newkey
|
||||
- rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }}
|
||||
- -sha256
|
||||
- -days
|
||||
- '{{ pureftpd_tls_certificate_openssl.days | default(365) }}'
|
||||
- -keyout
|
||||
- '{{ pureftpd_tls_certificate_pem }}'
|
||||
- -out
|
||||
- '{{ pureftpd_tls_certificate_pem }}'
|
||||
- -subj
|
||||
- '{{ common_pureftpd_tls_subject }}'
|
||||
args:
|
||||
creates: "{{ pureftpd_tls_certificate_pem }}"
|
||||
when:
|
||||
@@ -16,7 +45,7 @@
|
||||
notify: restart Pure-FTPd
|
||||
|
||||
- name: Ensure Pure-FTPd TLS certificate permissions.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ pureftpd_tls_certificate_pem }}"
|
||||
owner: root
|
||||
group: root
|
||||
@@ -29,12 +58,12 @@
|
||||
# - final checks
|
||||
|
||||
- name: (pure-ftpd-install.yml) Verify TLS certificate exists.
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: "{{ pureftpd_tls_certificate_pem }}"
|
||||
register: pureftpd_tls_certificate
|
||||
register: common_pureftpd_tls_certificate
|
||||
|
||||
- name: (pure-ftpd-install.yml) Fail when no certificate is found.
|
||||
fail:
|
||||
ansible.builtin.fail:
|
||||
msg: |
|
||||
The certificate file was not found at {{ pureftpd_tls_certificate_pem }}
|
||||
when: not pureftpd_tls_certificate.stat.exists | default(False)
|
||||
when: not common_pureftpd_tls_certificate.stat.exists | default(false)
|
||||
|
||||
@@ -3,44 +3,45 @@
|
||||
# Default virtual users/group
|
||||
|
||||
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd group exists.
|
||||
group:
|
||||
ansible.builtin.group:
|
||||
name: "{{ pureftpd_virtual_users_group }}"
|
||||
gid: "{{ pureftpd_virtual_users_gid | default(omit) }}"
|
||||
system: no
|
||||
system: false
|
||||
state: present
|
||||
when: pureftpd_virtual_users | length > 0
|
||||
|
||||
- name: (pure-ftpd-install.yml) Ensure Pure-FTPd user exists.
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: "{{ pureftpd_virtual_users_user }}"
|
||||
uid: "{{ pureftpd_virtual_users_uid | default(omit) }}"
|
||||
group: "{{ pureftpd_virtual_users_group }}"
|
||||
home: /dev/null
|
||||
shell: /usr/sbin/nologin
|
||||
system: no
|
||||
system: false
|
||||
state: present
|
||||
when: pureftpd_virtual_users | length > 0
|
||||
|
||||
# user databas
|
||||
|
||||
- name: (pure-ftpd-install.yml) Verify virtual users database existence.
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: "{{ pureftpd_config_dir }}/pureftpd.passwd"
|
||||
register: pureftpd_virtual_users_database
|
||||
register: common_pureftpd_virtual_users_database
|
||||
|
||||
- name: (pure-ftpd-install.yml) Ensure virtual users database exists.
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ pureftpd_config_dir }}/pureftpd.passwd"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
state: touch
|
||||
when: (pureftpd_virtual_users | length > 0) and not pureftpd_virtual_users_database.stat.exists | default(False)
|
||||
when: (pureftpd_virtual_users | length > 0) and not common_pureftpd_virtual_users_database.stat.exists | default(false)
|
||||
|
||||
|
||||
# - Cretate virtual user
|
||||
|
||||
- include_tasks: create-virtual-ftp-user.yml
|
||||
- name: (pure-ftpd-install.yml) Include create virtual ftp user task.
|
||||
ansible.builtin.include_tasks: create-virtual-ftp-user.yml
|
||||
vars:
|
||||
user: "{{ item }}"
|
||||
with_items: "{{ pureftpd_virtual_users }}"
|
||||
@@ -50,7 +51,8 @@
|
||||
|
||||
# Remove virtual user
|
||||
# -
|
||||
- include_tasks: remove-virtual-user.yml
|
||||
- name: (pure-ftpd-install.yml) Include remove virtual ftp user task.
|
||||
ansible.builtin.include_tasks: remove-virtual-user.yml
|
||||
vars:
|
||||
user: "{{ item }}"
|
||||
with_items: "{{ pureftpd_virtual_deleted_users }}"
|
||||
|
||||
@@ -1,51 +1,57 @@
|
||||
---
|
||||
|
||||
- name: (root_files_scripts.yml) Ensure directory /root/bin exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /root/bin
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0700'
|
||||
state: directory
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
|
||||
- name: (root_files_scripts.yml) Ensure script 'wakeup_lan.sh' is present
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path + '/files/' + nis_domain + '/root/bin/wakeup_lan.sh' }}"
|
||||
dest: /root/bin/wakeup_lan.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
tags:
|
||||
- wakeup_lan
|
||||
|
||||
- name: (root_files_scripts.yml) Check file '/etc/motd.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/motd.ORIG
|
||||
register: etc_motd_ORIG
|
||||
register: common_etc_motd_orig
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
tags:
|
||||
- etc_motd
|
||||
|
||||
- name: (basic.yml) Backup installation version of file '/etc/motd'
|
||||
command: cp -a /etc/motd /etc/motd.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/motd
|
||||
dest: /etc/motd.ORIG
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: false
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- etc_motd_ORIG.stat.exists == False
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
- not common_etc_motd_orig.stat.exists
|
||||
tags:
|
||||
- etc_motd
|
||||
|
||||
|
||||
- name: (root_files_scripts.yml) Write new '/etc/motd' file..
|
||||
shell: >
|
||||
ansible.builtin.shell: >
|
||||
figlet '{{ nis_server_name.split(".")[0] }}' > /etc/motd
|
||||
changed_when: true
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- etc_motd_ORIG.stat.exists == False
|
||||
- groups['file_server'] | string is search(inventory_hostname)
|
||||
- not common_etc_motd_orig.stat.exists
|
||||
tags:
|
||||
- etc_motd
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Ensure samba packages server (buster) are installed.
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ apt_install_server_samba }}"
|
||||
state: present
|
||||
when:
|
||||
@@ -13,7 +13,7 @@
|
||||
- samba-server
|
||||
|
||||
- name: (samba-install.yml) Ensure quarantine directory exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /data/samba/QUARANTINE
|
||||
owner: root
|
||||
group: root
|
||||
@@ -28,13 +28,13 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-install.yml) Ensure samba share directories exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
owner: "root"
|
||||
group: "{{ item.group_write_list }}"
|
||||
mode: "{{ item.dir_create_mask | default('2770', true) }}"
|
||||
state: directory
|
||||
recurse: no
|
||||
recurse: false
|
||||
with_items: "{{ samba_shares }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
@@ -48,7 +48,7 @@
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ apt_install_server_samba_virusfilter }}"
|
||||
state: present
|
||||
when:
|
||||
@@ -60,12 +60,12 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Check if ClamAV virus databases are present
|
||||
find:
|
||||
ansible.builtin.find:
|
||||
paths: /var/lib/clamav
|
||||
patterns:
|
||||
- "*.cvd"
|
||||
- "*.cld"
|
||||
register: clamav_db_files
|
||||
register: common_clamav_db_files
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
@@ -74,23 +74,23 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download
|
||||
service:
|
||||
ansible.builtin.service:
|
||||
name: clamav-freshclam
|
||||
state: stopped
|
||||
failed_when: false
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
- clamav_db_files.files | length == 0
|
||||
- common_clamav_db_files.files | length == 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update
|
||||
service:
|
||||
ansible.builtin.service:
|
||||
name: clamav-daemon
|
||||
state: started
|
||||
enabled: yes
|
||||
enabled: true
|
||||
failed_when: false
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
@@ -100,20 +100,21 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam
|
||||
command: freshclam
|
||||
ansible.builtin.command: freshclam
|
||||
changed_when: true
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
- clamav_db_files.files | length == 0
|
||||
- common_clamav_db_files.files | length == 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started
|
||||
service:
|
||||
ansible.builtin.service:
|
||||
name: clamav-daemon
|
||||
state: started
|
||||
enabled: yes
|
||||
enabled: true
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
@@ -122,10 +123,10 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started
|
||||
service:
|
||||
ansible.builtin.service:
|
||||
name: clamav-freshclam
|
||||
state: started
|
||||
enabled: yes
|
||||
enabled: true
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
@@ -134,10 +135,10 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-install.yml) Ensure clamav user is member of all NIS groups
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: clamav
|
||||
groups: "{{ item.name }}"
|
||||
append: yes
|
||||
append: true
|
||||
loop: "{{ nis_groups }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
@@ -151,10 +152,10 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Ensure clamav user is member of all NIS user groups (homes virusfilter)
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: clamav
|
||||
groups: "{{ item.name }}"
|
||||
append: yes
|
||||
append: true
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
@@ -173,7 +174,7 @@
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
register: samba_user_getent
|
||||
register: common_samba_user_getent
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- samba_homes_virusfilter | default(false) | bool
|
||||
@@ -183,11 +184,11 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter)
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}"
|
||||
mode: "0750"
|
||||
state: directory
|
||||
loop: "{{ samba_user_getent.results | default([]) }}"
|
||||
loop: "{{ common_samba_user_getent.results | default([]) }}"
|
||||
loop_control:
|
||||
label: "{{ item.item.name }}"
|
||||
when:
|
||||
@@ -199,7 +200,7 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths)
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/apparmor.d/local/usr.sbin.clamd.j2
|
||||
dest: /etc/apparmor.d/local/usr.sbin.clamd
|
||||
owner: root
|
||||
@@ -217,7 +218,7 @@
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/clamav/clamd.conf
|
||||
regexp: "^#?\\s*AllowAllMatchScan\\s"
|
||||
line: "AllowAllMatchScan true"
|
||||
@@ -236,29 +237,36 @@
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Check if file '/etc/samba/smb.conf.ORIG exists'
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/samba/smb.conf.ORIG
|
||||
register: smb_conf_exists
|
||||
register: common_smb_conf_exists
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
- name: (samba-install.yml) Backup existing file /etc/samba/smb.conf
|
||||
command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG
|
||||
ansible.builtin.copy:
|
||||
src: /etc/samba/smb.conf
|
||||
dest: /etc/samba/smb.conf.ORIG
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: false
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- smb_conf_exists.stat.exists == False
|
||||
- not common_smb_conf_exists.stat.exists
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
- name: (samba-install.yml) /etc/samba/smb.conf
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
dest: /etc/samba/smb.conf
|
||||
src: etc/samba/smb.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 644
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
notify:
|
||||
@@ -268,12 +276,12 @@
|
||||
- samba-server
|
||||
|
||||
- name: (samba-install.yml) Ensure file /etc/samba/users.map exists
|
||||
copy:
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path + '/files/etc/samba/users.map' }}"
|
||||
dest: /etc/samba/users.map
|
||||
owner: root
|
||||
group: root
|
||||
mode: 644
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
notify:
|
||||
@@ -287,9 +295,9 @@
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /root/bin/samba/clean_samba_trash.sh
|
||||
register: clean_samba_trash_exists
|
||||
register: common_clean_samba_trash_exists
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
tags:
|
||||
@@ -297,12 +305,15 @@
|
||||
- samba-cron
|
||||
|
||||
- name: (samba-install.yml) Adjust configuration for script 'clean_samba_trash.sh'
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
dest: /root/bin/samba/conf/clean_samba_trash.conf
|
||||
src: root/bin/samba/conf/clean_samba_trash.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- clean_samba_trash_exists.stat.exists|bool
|
||||
- common_clean_samba_trash_exists.stat.exists | bool
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-cron
|
||||
@@ -314,7 +325,7 @@
|
||||
state: absent
|
||||
check_mode: true
|
||||
changed_when: false
|
||||
register: clean_samba_trash_dirs
|
||||
register: common_clean_samba_trash_dirs
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
tags: [samba-server, samba-cron]
|
||||
@@ -331,8 +342,8 @@
|
||||
job: "{{ samba_cronjob_trash_dirs.job }}"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- clean_samba_trash_exists.stat.exists | bool
|
||||
- (clean_samba_trash_dirs.found | int) > 0
|
||||
- common_clean_samba_trash_exists.stat.exists | bool
|
||||
- (common_clean_samba_trash_dirs.found | int) > 0
|
||||
tags: [samba-server, samba-cron]
|
||||
|
||||
# ---
|
||||
@@ -342,7 +353,7 @@
|
||||
- name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists
|
||||
ansible.builtin.stat:
|
||||
path: /root/bin/samba/set_permissions_samba_shares.sh
|
||||
register: set_permissions_on_samba_shares_exists
|
||||
register: common_set_permissions_on_samba_shares_exists
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
tags: [samba-server, samba-cron]
|
||||
@@ -351,9 +362,12 @@
|
||||
ansible.builtin.template:
|
||||
dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
|
||||
src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- set_permissions_on_samba_shares_exists.stat.exists | bool
|
||||
- common_set_permissions_on_samba_shares_exists.stat.exists | bool
|
||||
tags: [samba-server, samba-cron]
|
||||
|
||||
- name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs
|
||||
@@ -368,7 +382,7 @@
|
||||
job: "{{ samba_cronjob_permissions.job }}"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
|
||||
- (common_clean_samba_trash_dirs.found | int) > 0 # << int -> bool
|
||||
tags: [samba-server, samba-cron]
|
||||
|
||||
# ---
|
||||
@@ -376,7 +390,7 @@
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Ensure samba packages clients are installed.
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ apt_install_client_samba }}"
|
||||
state: present
|
||||
when:
|
||||
|
||||
@@ -6,10 +6,14 @@
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Check if samba user exists for removable system user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_remove_system_users_present
|
||||
changed_when: "samba_remove_system_users_present.rc == 0"
|
||||
failed_when: "samba_remove_system_users_present.rc > 1"
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
set -o pipefail &&
|
||||
pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
executable: /bin/bash
|
||||
register: common_samba_remove_system_users_present
|
||||
changed_when: false
|
||||
failed_when: common_samba_remove_system_users_present.rc > 1
|
||||
with_items:
|
||||
- "{{ remove_system_users }}"
|
||||
loop_control:
|
||||
@@ -19,23 +23,27 @@
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Remove (old) system users from samba
|
||||
shell: >
|
||||
smbpasswd -s -x {{ item.item.name }}
|
||||
ansible.builtin.command: smbpasswd -s -x {{ item.item.name }}
|
||||
changed_when: true
|
||||
with_items:
|
||||
- "{{ samba_remove_system_users_present.results }}"
|
||||
- "{{ common_samba_remove_system_users_present.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.changed
|
||||
- item.rc == 0
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Check if samba user exists for removable nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_remove_nis_users_present
|
||||
changed_when: "samba_remove_nis_users_present.rc == 0"
|
||||
failed_when: "samba_remove_nis_users_present.rc > 1"
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
set -o pipefail &&
|
||||
pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
executable: /bin/bash
|
||||
register: common_samba_remove_nis_users_present
|
||||
changed_when: false
|
||||
failed_when: common_samba_remove_nis_users_present.rc > 1
|
||||
with_items:
|
||||
- "{{ remove_nis_users }}"
|
||||
loop_control:
|
||||
@@ -45,13 +53,13 @@
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Remove (old) nis users from samba
|
||||
shell: >
|
||||
smbpasswd -s -x {{ item.item.name }}
|
||||
ansible.builtin.command: smbpasswd -s -x {{ item.item.name }}
|
||||
changed_when: true
|
||||
with_items:
|
||||
- "{{ samba_remove_nis_users_present.results }}"
|
||||
- "{{ common_samba_remove_nis_users_present.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.changed
|
||||
- item.rc == 0
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
@@ -5,26 +5,33 @@
|
||||
# ---
|
||||
|
||||
- name: (samba-user.yml) Check if samba user exists for nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
|
||||
register: samba_nis_user_present
|
||||
changed_when: "samba_nis_user_present.rc == 1"
|
||||
failed_when: "samba_nis_user_present.rc > 1"
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
set -o pipefail &&
|
||||
pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
|
||||
executable: /bin/bash
|
||||
register: common_samba_nis_user_present
|
||||
changed_when: false
|
||||
failed_when: common_samba_nis_user_present.rc > 1
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
- item.is_samba_user is defined and item.is_samba_user | bool
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
- name: (samba-user.yml) Add nis user to samba (with nis users password)
|
||||
shell: >
|
||||
(echo '{{ item.item.password }}'; echo '{{ item.item.password }}')
|
||||
| smbpasswd -s -a {{ item.item.name }}
|
||||
loop: "{{ samba_nis_user_present.results }}"
|
||||
when: item.changed
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
set -o pipefail &&
|
||||
(echo '{{ item.item.password }}'; echo '{{ item.item.password }}') |
|
||||
smbpasswd -s -a {{ item.item.name }}
|
||||
executable: /bin/bash
|
||||
changed_when: true
|
||||
loop: "{{ common_samba_nis_user_present.results }}"
|
||||
when: item.rc == 1
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
+34
-27
@@ -6,40 +6,40 @@
|
||||
# ---
|
||||
|
||||
- name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list)
|
||||
set_fact:
|
||||
fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}"
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}"
|
||||
when:
|
||||
- sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Set fact_sshd_ciphers (comma separated list)
|
||||
set_fact:
|
||||
fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}"
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}"
|
||||
when:
|
||||
- sshd_ciphers is defined and sshd_ciphers | length > 0
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Set fact_sshd_macs
|
||||
set_fact:
|
||||
fact_sshd_macs: "{{ sshd_macs | join (',') }}"
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_sshd_macs: "{{ sshd_macs | join(',') }}"
|
||||
when:
|
||||
- sshd_macs is defined and sshd_macs | length > 0
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list)
|
||||
set_fact:
|
||||
fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}"
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}"
|
||||
when:
|
||||
- sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list)
|
||||
set_fact:
|
||||
fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}"
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}"
|
||||
when:
|
||||
- sshd_allowed_users is defined and sshd_allowed_users | length > 0
|
||||
tags:
|
||||
@@ -50,28 +50,35 @@
|
||||
# ---
|
||||
|
||||
- name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /etc/ssh/sshd_config.ORIG
|
||||
register: etc_sshd_sshd_config_ORIG
|
||||
register: common_etc_sshd_sshd_config_orig
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
|
||||
command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
|
||||
when: etc_sshd_sshd_config_ORIG.stat.exists == False
|
||||
ansible.builtin.copy:
|
||||
src: /etc/ssh/sshd_config
|
||||
dest: /etc/ssh/sshd_config.ORIG
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: false
|
||||
when: not common_etc_sshd_sshd_config_orig.stat.exists
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
|
||||
- name: (sshd.yml) Create new sshd_config from template sshd_config.j2
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.ubuntu.j2
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
validate: 'sshd -f %s -T'
|
||||
#backup: yes
|
||||
# backup: yes
|
||||
notify: "Restart ssh"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
@@ -80,12 +87,12 @@
|
||||
|
||||
|
||||
- name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.j2
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
validate: 'sshd -f %s -T'
|
||||
notify: "Restart ssh"
|
||||
when:
|
||||
@@ -96,12 +103,12 @@
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.j2
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
validate: 'sshd -f %s -T -C user=sftp_users'
|
||||
notify: "Restart ssh"
|
||||
when:
|
||||
@@ -113,21 +120,21 @@
|
||||
|
||||
|
||||
- name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^Subsystem\s+sftp(.+)$'
|
||||
state: absent
|
||||
check_mode: yes
|
||||
check_mode: true
|
||||
changed_when: false
|
||||
register: sshd_config_sftp
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/ssh/sshd_config.d
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
group: root
|
||||
owner: root
|
||||
when:
|
||||
@@ -137,12 +144,12 @@
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.j2
|
||||
dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: "Restart ssh"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
|
||||
@@ -1,28 +1,28 @@
|
||||
---
|
||||
|
||||
- name: (sudoers-pc.yml) update specific sudoers configuration files (/etc/sudoers.d/)
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/sudoers.d/50-user.pc.j2
|
||||
dest: /etc/sudoers.d/50-user
|
||||
validate: visudo -cf %s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
mode: "0440"
|
||||
tags:
|
||||
- sudoers-file-configuration
|
||||
|
||||
- name: (sudoers-pc.yml) update global sudoers configuration file
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/sudoers.pc.j2
|
||||
dest: /etc/sudoers
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
mode: "0440"
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- sudoers-global-configuration
|
||||
|
||||
#- name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
|
||||
# - name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
|
||||
# user:
|
||||
# name: "{{ item }}"
|
||||
# groups: sudo
|
||||
@@ -32,7 +32,10 @@
|
||||
# - sudo-users
|
||||
|
||||
- name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
|
||||
shell: usermod -a -G sudo "{{ item }}"
|
||||
ansible.builtin.user:
|
||||
name: "{{ item }}"
|
||||
groups: sudo
|
||||
append: true
|
||||
with_items: "{{ sudo_pc_users }}"
|
||||
tags:
|
||||
- sudo-users
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
|
||||
#- name: (sudoers-server.yml) include variables
|
||||
# - name: (sudoers-server.yml) include variables
|
||||
# include_vars: "{{ item }}"
|
||||
# with_first_found:
|
||||
# - "sudoers-{{ inventory_hostname }}.yml"
|
||||
@@ -13,45 +13,45 @@
|
||||
# - sudoers-global-configuration
|
||||
|
||||
- name: (sudoers-server.yml) Remove user entries in file /etc/sudoers
|
||||
lineinfile:
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/sudoers
|
||||
state: absent
|
||||
regexp: '^{{ item }}'
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
mode: "0440"
|
||||
validate: visudo -cf %s
|
||||
with_items: '{{ sudoers_server_remove_user }}'
|
||||
tags:
|
||||
- sudoers-remove
|
||||
|
||||
- name: (sudoers-server.yml) update specific sudoers configuration files (/etc/sudoers.d/)
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/sudoers.d/50-user.server.j2
|
||||
dest: /etc/sudoers.d/50-user
|
||||
#validate: visudo -cf %s
|
||||
# validate: visudo -cf %s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
mode: "0440"
|
||||
tags:
|
||||
- sudoers-file-configuration
|
||||
|
||||
- name: (sudoers-server.yml) update global sudoers configuration file
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: etc/sudoers.server.j2
|
||||
dest: /etc/sudoers
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
#validate: visudo -cf %s
|
||||
mode: "0440"
|
||||
# validate: visudo -cf %s
|
||||
tags:
|
||||
- sudoers-global-configuration
|
||||
|
||||
- name: (sudoers-server.yml) Ensure all sudo_users are in sudo group
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: "{{ item }}"
|
||||
groups: sudo
|
||||
append: yes
|
||||
append: true
|
||||
with_items: "{{ sudo_server_users }}"
|
||||
tags:
|
||||
- sudo-users
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
# ---
|
||||
|
||||
- name: (system-remove-user.yml) Remove (old) users from system
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
@@ -17,7 +17,7 @@
|
||||
- system-user
|
||||
|
||||
- name: (system-remove-user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
|
||||
@@ -6,16 +6,22 @@
|
||||
|
||||
# system_user
|
||||
- name: (system-user-systemfiles.yml) Check if local template directory exists for default users
|
||||
local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
with_items: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: local_template_dir_system_users
|
||||
register: common_local_template_dir_system_users
|
||||
|
||||
# root
|
||||
- name: (system-user-systemfiles.yml) Check if local template directory exists for root
|
||||
local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root
|
||||
register: local_template_dir_root
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: common_local_template_dir_root
|
||||
|
||||
|
||||
# --
|
||||
@@ -23,9 +29,9 @@
|
||||
# ---
|
||||
|
||||
- name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: "~{{ item.name }}/.profile.ORIG"
|
||||
register: profile_user_orig_exists
|
||||
register: common_profile_user_orig_exists
|
||||
loop: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -33,12 +39,19 @@
|
||||
- profile
|
||||
|
||||
- name: (user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
|
||||
loop: "{{ profile_user_orig_exists.results }}"
|
||||
ansible.builtin.copy:
|
||||
src: "~{{ item.item.name }}/.profile"
|
||||
dest: "~{{ item.item.name }}/.profile.ORIG"
|
||||
remote_src: true
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: "0644"
|
||||
force: false
|
||||
loop: "{{ common_profile_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == False
|
||||
- not item.stat.exists
|
||||
tags:
|
||||
- profile
|
||||
|
||||
@@ -49,17 +62,17 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ default_user }}"
|
||||
register: profile_stats
|
||||
register: common_profile_stats
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
# 2) Prüfe ob eine lokale default _baschrc existiert
|
||||
- name: stat DEFAULT _profile
|
||||
- name: Stat DEFAULT _profile
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: default_profile_stat
|
||||
register: common_default_profile_stat
|
||||
|
||||
# 2) Falls User _profile vorhanden, kopieren
|
||||
- name: (system-user-systemfiles.yml) copy .profile if it exists
|
||||
@@ -70,7 +83,7 @@
|
||||
group: "{{ user.name }}"
|
||||
mode: "0644"
|
||||
become: true
|
||||
loop: "{{ default_user | zip(profile_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -89,12 +102,12 @@
|
||||
group: "{{ user.name }}"
|
||||
mode: "0644"
|
||||
become: true
|
||||
loop: "{{ default_user | zip(profile_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
- not stat_result.stat.exists
|
||||
- default_profile_stat.stat.exists | bool
|
||||
- common_default_profile_stat.stat.exists | bool
|
||||
vars:
|
||||
user: "{{ item.0 }}"
|
||||
stat_result: "{{ item.1 }}"
|
||||
@@ -105,15 +118,22 @@
|
||||
# ---
|
||||
|
||||
- name: (system-user-systemfiles.yml) Check if file '/root/.profile.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /root/.profile.ORIG
|
||||
register: profile_root_orig_exists
|
||||
register: common_profile_root_orig_exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
- name: (system-user-systemfiles.yml) Backup /root/.profile file
|
||||
command: cp /root/.profile /root/.profile.ORIG
|
||||
when: profile_root_orig_exists.stat.exists == False
|
||||
ansible.builtin.copy:
|
||||
src: /root/.profile
|
||||
dest: /root/.profile.ORIG
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: false
|
||||
when: not common_profile_root_orig_exists.stat.exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
@@ -123,10 +143,10 @@
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: profile_root_stat
|
||||
register: common_profile_root_stat
|
||||
|
||||
# 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost
|
||||
- name: copy root .profile if it exists
|
||||
- name: Copy root .profile if it exists
|
||||
ansible.builtin.copy:
|
||||
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile"
|
||||
dest: /root/.profile
|
||||
@@ -134,7 +154,7 @@
|
||||
group: root
|
||||
mode: '0644'
|
||||
become: true
|
||||
when: profile_root_stat.stat.exists
|
||||
when: common_profile_root_stat.stat.exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
@@ -144,9 +164,9 @@
|
||||
# ---
|
||||
|
||||
- name: (system-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: "~{{ item.name }}/.bashrc.ORIG"
|
||||
register: bashrc_user_orig_exists
|
||||
register: common_bashrc_user_orig_exists
|
||||
loop: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -154,11 +174,18 @@
|
||||
- bashrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) Backup existing users .bashrc file
|
||||
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
|
||||
loop: "{{ bashrc_user_orig_exists.results }}"
|
||||
ansible.builtin.copy:
|
||||
src: "~{{ item.item.name }}/.bashrc"
|
||||
dest: "~{{ item.item.name }}/.bashrc.ORIG"
|
||||
remote_src: true
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: "0644"
|
||||
force: false
|
||||
loop: "{{ common_bashrc_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when: item.stat.exists == False
|
||||
when: not item.stat.exists
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
@@ -169,17 +196,17 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ default_user }}"
|
||||
register: bashrc_stats
|
||||
register: common_bashrc_stats
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
# 2) Prüfe ob eine lokale default _baschrc existiert
|
||||
- name: stat DEFAULT _bashrc
|
||||
- name: Stat DEFAULT _bashrc
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_bashrc"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: default_bashrc_stat
|
||||
register: common_default_bashrc_stat
|
||||
|
||||
# 2) Falls User _bashrc vorhanden, kopieren
|
||||
- name: (system-user-systemfiles.yml) copy .bashrc if it exists
|
||||
@@ -190,7 +217,7 @@
|
||||
group: "{{ user.name }}"
|
||||
mode: "0644"
|
||||
become: true
|
||||
loop: "{{ default_user | zip(bashrc_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -209,12 +236,12 @@
|
||||
group: "{{ user.name }}"
|
||||
mode: "0644"
|
||||
become: true
|
||||
loop: "{{ default_user | zip(bashrc_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
- not stat_result.stat.exists
|
||||
- default_bashrc_stat.stat.exists | bool
|
||||
- common_default_bashrc_stat.stat.exists | bool
|
||||
vars:
|
||||
user: "{{ item.0 }}"
|
||||
stat_result: "{{ item.1 }}"
|
||||
@@ -225,28 +252,35 @@
|
||||
# ---
|
||||
|
||||
- name: (system-user-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists
|
||||
stat:
|
||||
ansible.builtin.stat:
|
||||
path: /root/.bashrc.ORIG
|
||||
register: bashrc_root_orig_exists
|
||||
register: common_bashrc_root_orig_exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
- name: (system-user-systemfiles.yml) Backup /root/.bashrc file
|
||||
command: cp /root/.bashrc /root/.bashrc.ORIG
|
||||
when: bashrc_root_orig_exists.stat.exists == False
|
||||
ansible.builtin.copy:
|
||||
src: /root/.bashrc
|
||||
dest: /root/.bashrc.ORIG
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: false
|
||||
when: not common_bashrc_root_orig_exists.stat.exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
# 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert
|
||||
- name: stat root _bashrc on control node
|
||||
- name: Stat root _bashrc on control node
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: bashrc_root_stat
|
||||
register: common_bashrc_root_stat
|
||||
|
||||
# 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost
|
||||
- name: copy root .bashrc if it exists
|
||||
- name: Copy root .bashrc if it exists
|
||||
ansible.builtin.copy:
|
||||
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc"
|
||||
dest: /root/.bashrc
|
||||
@@ -254,7 +288,7 @@
|
||||
group: root
|
||||
mode: '0644'
|
||||
become: true
|
||||
when: bashrc_root_stat.stat.exists
|
||||
when: common_bashrc_root_stat.stat.exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
@@ -269,19 +303,19 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ default_user }}"
|
||||
register: vimrc_stats
|
||||
register: common_vimrc_stats
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
|
||||
# 2. Falls vorhanden, Datei kopieren
|
||||
- name: (system-user-systemfiles.yml) copy .vimrc if it exists
|
||||
- name: (system-user-systemfiles.yml) Copy .vimrc if it exists
|
||||
ansible.builtin.copy:
|
||||
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_vimrc"
|
||||
dest: "~{{ user.name }}/.vimrc"
|
||||
owner: "{{ user.name }}"
|
||||
group: "{{ user.name }}"
|
||||
mode: '0644'
|
||||
loop: "{{ default_user | zip(vimrc_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_vimrc_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -300,7 +334,7 @@
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
loop: "{{ default_user }}"
|
||||
register: dotvim_stats
|
||||
register: common_dotvim_stats
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
@@ -312,7 +346,7 @@
|
||||
dest: "~{{ user.name }}/"
|
||||
mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch
|
||||
become: true
|
||||
loop: "{{ default_user | zip(dotvim_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -332,7 +366,7 @@
|
||||
recurse: true
|
||||
state: directory
|
||||
become: true
|
||||
loop: "{{ default_user | zip(dotvim_stats.results) | list }}"
|
||||
loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
|
||||
loop_control:
|
||||
label: "{{ user.name }}"
|
||||
when:
|
||||
@@ -353,10 +387,10 @@
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: vimrc_root_stat
|
||||
register: common_vimrc_root_stat
|
||||
|
||||
# 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost
|
||||
- name: (system-user-systemfiles.yml)copy root .vimrc if it exists
|
||||
- name: (system-user-systemfiles.yml) Copy root .vimrc if it exists
|
||||
ansible.builtin.copy:
|
||||
src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc"
|
||||
dest: /root/.vimrc
|
||||
@@ -365,17 +399,17 @@
|
||||
mode: '0644'
|
||||
become: true
|
||||
when:
|
||||
- vimrc_root_stat.stat.exists
|
||||
- common_vimrc_root_stat.stat.exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
# 1) Lokal prüfen, ob ./files/{{ nis_domain }}/homedirs/root/.vim existiert
|
||||
# 1) Lokal prüfen, ob ./files/{{ nis_domain }}/homedirs/root/.vim existiert
|
||||
- name: (system-user-systemfiles.yml) stat local .vim for root
|
||||
ansible.builtin.stat:
|
||||
path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: root_dotvim_stat
|
||||
register: common_root_dotvim_stat
|
||||
tags: [vim]
|
||||
|
||||
|
||||
@@ -387,11 +421,11 @@
|
||||
mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen
|
||||
become: true
|
||||
when:
|
||||
- root_dotvim_stat.stat.exists | bool
|
||||
- common_root_dotvim_stat.stat.exists | bool
|
||||
tags: [vim]
|
||||
|
||||
# 2) Wenn vorhanden, nach /root/ kopieren
|
||||
#- name: (system-user-systemfiles.yml) rsync root .vim if it exists
|
||||
# - name: (system-user-systemfiles.yml) rsync root .vim if it exists
|
||||
# ansible.posix.synchronize:
|
||||
# src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim/"
|
||||
# dest: "/root/.vim/"
|
||||
@@ -400,7 +434,7 @@
|
||||
# rsync_path: "sudo -n rsync" # -n = kein Passwort-Prompt; erfordert NOPASSWD
|
||||
# delegate_to: localhost
|
||||
# when:
|
||||
# - root_dotvim_stat.stat.exists | bool
|
||||
# - common_root_dotvim_stat.stat.exists | bool
|
||||
# tags: [vim]
|
||||
|
||||
# 3) Ownership sicherstellen (rekursiv)
|
||||
@@ -413,5 +447,5 @@
|
||||
state: directory
|
||||
become: true
|
||||
when:
|
||||
- root_dotvim_stat.stat.exists | bool
|
||||
- common_root_dotvim_stat.stat.exists | bool
|
||||
tags: [vim]
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
# ---
|
||||
|
||||
- name: (user.yml) Remove (old) users from system
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
@@ -16,7 +16,7 @@
|
||||
- system-user
|
||||
|
||||
- name: (user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: '{{ base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
@@ -31,7 +31,7 @@
|
||||
# ---
|
||||
|
||||
- name: (user.yml) Ensure system groups exists
|
||||
group:
|
||||
ansible.builtin.group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
@@ -43,16 +43,16 @@
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
# - meta: end_host
|
||||
|
||||
- name: (system-user.yml) Get database of nis (system) users
|
||||
getent:
|
||||
ansible.builtin.getent:
|
||||
database: passwd
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
- name: (system-user.yml) Add (system) users if not yet exists..
|
||||
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
changed_when: true
|
||||
loop: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
@@ -62,4 +62,3 @@
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
|
||||
@@ -4,79 +4,73 @@
|
||||
# Set some facts
|
||||
# ---
|
||||
|
||||
- name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list)
|
||||
set_fact:
|
||||
fact_resolved_nameserver: "{{ resolved_nameserver | join (' ') }}"
|
||||
- name: (systemd-resolved.yml) Set common_fact_resolved_nameserver (blank separated list)
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_resolved_nameserver: "{{ resolved_nameserver | join(' ') }}"
|
||||
when:
|
||||
- resolved_nameserver is defined and resolved_nameserver | length > 0
|
||||
tags:
|
||||
- systemd-resolved
|
||||
|
||||
- name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list)
|
||||
set_fact:
|
||||
fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join (' ') }}"
|
||||
- name: (systemd-resolved.yml) Set common_fact_resolved_fallback_nameserver (blank separated list)
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join(' ') }}"
|
||||
when:
|
||||
- resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0
|
||||
tags:
|
||||
- systemd-resolved
|
||||
|
||||
- name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list)
|
||||
set_fact:
|
||||
fact_resolved_domains: "{{ resolved_domains | join (' ') }}"
|
||||
- name: (systemd-resolved.yml) Set common_fact_resolved_domains (blank separated list)
|
||||
ansible.builtin.set_fact:
|
||||
common_fact_resolved_domains: "{{ resolved_domains | join(' ') }}"
|
||||
when:
|
||||
- resolved_domains is defined and resolved_domains | length > 0
|
||||
tags:
|
||||
- systemd-resolved
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# Install/Enable systemd-resolved package
|
||||
# ---
|
||||
|
||||
- name: (systemd-resolved.yml) Ensure systemd-resolved package is installed.
|
||||
package:
|
||||
ansible.builtin.package:
|
||||
pkg: systemd-resolved
|
||||
state: present
|
||||
when:
|
||||
- systemd_resolved is defined and systemd_resolved|bool
|
||||
- systemd_resolved is defined and systemd_resolved | bool
|
||||
tags:
|
||||
- systemd-resolved
|
||||
|
||||
- name: (systemd-services.yml) Enable service
|
||||
systemd:
|
||||
- name: (systemd-services.yml) Enable systemd-resolved service
|
||||
ansible.builtin.systemd:
|
||||
name: systemd-resolved
|
||||
enabled: true
|
||||
when:
|
||||
- systemd_resolved is defined and systemd_resolved|bool
|
||||
- systemd_resolved is defined and systemd_resolved | bool
|
||||
tags:
|
||||
- systemd-resolved
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# Create configuration for systemd-resolved
|
||||
# ---
|
||||
|
||||
- name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/resolved.conf.d
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
group: root
|
||||
owner: root
|
||||
|
||||
- name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2
|
||||
template:
|
||||
- name: (systemd-resolved.yml) Create/update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf'
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/resolved.conf.d/50-resolved-local.conf
|
||||
dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
|
||||
- name: Restart systemd-resolved service
|
||||
- name: (systemd-resolved.yml) Restart systemd-resolved service
|
||||
ansible.builtin.service:
|
||||
name: systemd-resolved
|
||||
state: restarted
|
||||
|
||||
|
||||
|
||||
@@ -1,54 +1,61 @@
|
||||
---
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) check if x11vnc is already installed, if not found skipping...."
|
||||
stat:
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Check if x11vnc is already installed, if not found skipping...."
|
||||
ansible.builtin.stat:
|
||||
path: /usr/bin/x11vnc
|
||||
register: x11vnc_active
|
||||
register: common_x11vnc_active
|
||||
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages"
|
||||
apt:
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages"
|
||||
ansible.builtin.apt:
|
||||
name: ['x11vnc']
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
state: present
|
||||
when: x11vnc_active.stat.exists == False
|
||||
when: not common_x11vnc_active.stat.exists
|
||||
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Store password"
|
||||
shell: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Store password"
|
||||
ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
|
||||
changed_when: true
|
||||
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
file:
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
ansible.builtin.file:
|
||||
path: /etc/x11vnc.pass
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
state: file
|
||||
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
template:
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/x11vnc.service.j2
|
||||
dest: /lib/systemd/system/x11vnc.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
# - name: "(ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service"
|
||||
# shell: service x11vnc start
|
||||
|
||||
- name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service
|
||||
service:
|
||||
- name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service
|
||||
ansible.builtin.service:
|
||||
name: x11vnc
|
||||
state: started
|
||||
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot"
|
||||
systemd:
|
||||
- name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot"
|
||||
ansible.builtin.systemd:
|
||||
name: x11vnc.service
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
# - name: "(ubuntu-x11vnc-1604-amd64.yml) Blocks x11vnc in GreenOS Desktop Environment for enduser "
|
||||
@@ -57,4 +64,3 @@
|
||||
# mode: 0740
|
||||
# owner: root
|
||||
# group: administrator
|
||||
|
||||
|
||||
@@ -1,61 +1,68 @@
|
||||
---
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages"
|
||||
apt:
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages"
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages }}"
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
state: present
|
||||
vars:
|
||||
packages:
|
||||
- x11vnc
|
||||
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) get numeric id for group 'gdm'"
|
||||
shell: echo "$(id -u gdm)"
|
||||
register: grp_id_gdm
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Get numeric id for group 'gdm'"
|
||||
ansible.builtin.command: id -u gdm
|
||||
register: common_grp_id_gdm
|
||||
changed_when: false
|
||||
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
stat:
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
ansible.builtin.stat:
|
||||
path: /etc/gdm3/custom.conf
|
||||
register: etc_gdm_custom_conf_exists
|
||||
register: common_etc_gdm_custom_conf_exists
|
||||
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
lineinfile:
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/gdm3/custom.conf
|
||||
state: present
|
||||
regexp: '^WaylandEnable'
|
||||
line: 'WaylandEnable=false'
|
||||
insertafter: '^#?\s*WaylandEnable'
|
||||
when:
|
||||
- etc_gdm_custom_conf_exists.stat.exists
|
||||
- common_etc_gdm_custom_conf_exists.stat.exists
|
||||
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Store password"
|
||||
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Store password"
|
||||
ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
|
||||
changed_when: true
|
||||
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
file:
|
||||
path: "/etc/x11vnc.pass"
|
||||
mode: 0644
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
ansible.builtin.file:
|
||||
path: /etc/x11vnc.pass
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
state: file
|
||||
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
template:
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2
|
||||
dest: /lib/systemd/system/x11vnc.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service"
|
||||
systemd:
|
||||
- name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service"
|
||||
ansible.builtin.systemd:
|
||||
name: x11vnc.service
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: restarted
|
||||
|
||||
|
||||
@@ -1,65 +1,70 @@
|
||||
---
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages"
|
||||
apt:
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages"
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages }}"
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
state: present
|
||||
vars:
|
||||
packages:
|
||||
- x11vnc
|
||||
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) get numeric id for group 'gdm'"
|
||||
shell: echo "$(id -u gdm)"
|
||||
register: grp_id_gdm
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Get numeric id for group 'gdm'"
|
||||
ansible.builtin.command: id -u gdm
|
||||
register: common_grp_id_gdm
|
||||
changed_when: false
|
||||
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Store password"
|
||||
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Store password"
|
||||
ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
|
||||
changed_when: true
|
||||
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
stat:
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
ansible.builtin.stat:
|
||||
path: /etc/gdm3/custom.conf
|
||||
register: etc_gdm_custom_conf_exists
|
||||
register: common_etc_gdm_custom_conf_exists
|
||||
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
lineinfile:
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/gdm3/custom.conf
|
||||
state: present
|
||||
regexp: '^WaylandEnable'
|
||||
line: 'WaylandEnable=false'
|
||||
insertafter: '^#?\s*WaylandEnable'
|
||||
when:
|
||||
- etc_gdm_custom_conf_exists.stat.exists
|
||||
- common_etc_gdm_custom_conf_exists.stat.exists
|
||||
|
||||
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
file:
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
ansible.builtin.file:
|
||||
path: /etc/x11vnc.pass
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
state: file
|
||||
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
template:
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/x11vnc-gdm3.service.j2
|
||||
dest: /lib/systemd/system/x11vnc.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service"
|
||||
systemd:
|
||||
- name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service"
|
||||
ansible.builtin.systemd:
|
||||
name: x11vnc.service
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: restarted
|
||||
|
||||
# - name: "(ubuntu-x11vnc-2004-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
|
||||
@@ -68,4 +73,3 @@
|
||||
# mode: 0750
|
||||
# owner: root
|
||||
# group: root
|
||||
|
||||
|
||||
@@ -1,65 +1,70 @@
|
||||
---
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages"
|
||||
apt:
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages"
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages }}"
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
state: present
|
||||
vars:
|
||||
packages:
|
||||
- x11vnc
|
||||
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) get numeric id for group 'gdm'"
|
||||
shell: echo "$(id -u gdm)"
|
||||
register: grp_id_gdm
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Get numeric id for group 'gdm'"
|
||||
ansible.builtin.command: id -u gdm
|
||||
register: common_grp_id_gdm
|
||||
changed_when: false
|
||||
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Store password"
|
||||
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Store password"
|
||||
ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
|
||||
changed_when: true
|
||||
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
stat:
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
ansible.builtin.stat:
|
||||
path: /etc/gdm3/custom.conf
|
||||
register: etc_gdm_custom_conf_exists
|
||||
register: common_etc_gdm_custom_conf_exists
|
||||
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
lineinfile:
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/gdm3/custom.conf
|
||||
state: present
|
||||
regexp: '^WaylandEnable'
|
||||
line: 'WaylandEnable=false'
|
||||
insertafter: '^#?\s*WaylandEnable'
|
||||
when:
|
||||
- etc_gdm_custom_conf_exists.stat.exists
|
||||
- common_etc_gdm_custom_conf_exists.stat.exists
|
||||
|
||||
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
file:
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
ansible.builtin.file:
|
||||
path: /etc/x11vnc.pass
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
state: file
|
||||
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
template:
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/x11vnc-gdm3.service.j2
|
||||
dest: /lib/systemd/system/x11vnc.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service"
|
||||
systemd:
|
||||
- name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service"
|
||||
ansible.builtin.systemd:
|
||||
name: x11vnc.service
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: restarted
|
||||
|
||||
# - name: "(ubuntu-x11vnc-2204-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
|
||||
@@ -68,4 +73,3 @@
|
||||
# mode: 0750
|
||||
# owner: root
|
||||
# group: root
|
||||
|
||||
|
||||
@@ -1,65 +1,70 @@
|
||||
---
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
# Title: app-x11vnc-server
|
||||
#
|
||||
# Author: Luc Rutten
|
||||
# Version: 1.0
|
||||
# File: tasks/main.yml
|
||||
#
|
||||
# Description:
|
||||
# Remote support
|
||||
#
|
||||
# Source:
|
||||
# - http://c-nergy.be/blog/?p=8984
|
||||
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages"
|
||||
apt:
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages"
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages }}"
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
state: present
|
||||
vars:
|
||||
packages:
|
||||
- x11vnc
|
||||
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) get numeric id for group 'gdm'"
|
||||
shell: echo "$(id -u gdm)"
|
||||
register: grp_id_gdm
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Get numeric id for group 'gdm'"
|
||||
ansible.builtin.command: id -u gdm
|
||||
register: common_grp_id_gdm
|
||||
changed_when: false
|
||||
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Store password"
|
||||
raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Store password"
|
||||
ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
|
||||
changed_when: true
|
||||
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
stat:
|
||||
- name: Check if file '/etc/gdm3/custom.conf' exists
|
||||
ansible.builtin.stat:
|
||||
path: /etc/gdm3/custom.conf
|
||||
register: etc_gdm_custom_conf_exists
|
||||
register: common_etc_gdm_custom_conf_exists
|
||||
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
lineinfile:
|
||||
- name: Adjust file '/etc/gdm3/custom.conf'
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/gdm3/custom.conf
|
||||
state: present
|
||||
regexp: '^WaylandEnable'
|
||||
line: 'WaylandEnable=false'
|
||||
insertafter: '^#?\s*WaylandEnable'
|
||||
when:
|
||||
- etc_gdm_custom_conf_exists.stat.exists
|
||||
- common_etc_gdm_custom_conf_exists.stat.exists
|
||||
|
||||
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
file:
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass"
|
||||
ansible.builtin.file:
|
||||
path: /etc/x11vnc.pass
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
state: file
|
||||
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
template:
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/x11vnc-gdm3.service.j2
|
||||
dest: /lib/systemd/system/x11vnc.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service"
|
||||
systemd:
|
||||
- name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service"
|
||||
ansible.builtin.systemd:
|
||||
name: x11vnc.service
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: restarted
|
||||
|
||||
# - name: "(ubuntu-x11vnc-2404-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
|
||||
@@ -68,4 +73,3 @@
|
||||
# mode: 0750
|
||||
# owner: root
|
||||
# group: root
|
||||
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
# Managed by Ansible: deb822 definition for the Debian backports repository.
|
||||
# It enables deb-src only when apt_src_enable is true and sets Signed-By only
|
||||
# when apt_deb822_use_signed_by is enabled.
|
||||
Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
|
||||
URIs: {{ apt_debian_mirror }}
|
||||
Suites: {{ ansible_facts['distribution_release'] }}-backports
|
||||
Components: main contrib non-free non-free-firmware
|
||||
{% if apt_deb822_use_signed_by | default(true) | bool %}
|
||||
Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
|
||||
{% endif %}
|
||||
@@ -0,0 +1,10 @@
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
# Verwaltet via Ansible - Debian Basis & Updates fuer {{ ansible_facts['distribution_release'] }}
|
||||
Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
|
||||
URIs: {{ apt_debian_mirror }}
|
||||
Suites: {{ ansible_facts['distribution_release'] }} {{ ansible_facts['distribution_release'] }}-updates
|
||||
Components: main contrib non-free non-free-firmware
|
||||
{% if apt_deb822_use_signed_by | default(true) | bool %}
|
||||
Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
|
||||
{% endif %}
|
||||
@@ -0,0 +1,10 @@
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
# Verwaltet via Ansible - Security fuer {{ ansible_facts['distribution_release'] }}
|
||||
Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
|
||||
URIs: http://security.debian.org/debian-security
|
||||
Suites: {{ ansible_facts['distribution_release'] }}-security
|
||||
Components: main contrib non-free non-free-firmware
|
||||
{% if apt_deb822_use_signed_by | default(true) | bool %}
|
||||
Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
|
||||
{% endif %}
|
||||
@@ -533,6 +533,20 @@
|
||||
virusfilter:scan on open = yes
|
||||
virusfilter:scan on close = yes
|
||||
|
||||
{% set virusfilter_include_files = item.vfs_object_virusfilter_include_files | default([]) %}
|
||||
{% set virusfilter_exclude_files = item.vfs_object_virusfilter_exlude_files | default(item.vfs_object_virusfilter_exclude_files | default([])) %}
|
||||
{% if virusfilter_include_files | length > 0 %}
|
||||
# Nur diese Dateiendungen vom Virusfilter pruefen.
|
||||
virusfilter:include files = \.({{ virusfilter_include_files | join('|') }})$
|
||||
{% if virusfilter_exclude_files | length > 0 %}
|
||||
# Include und Exclude sind gesetzt: Include hat Vorrang, Exclude wird ignoriert.
|
||||
#virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
|
||||
{% endif %}
|
||||
{% elif virusfilter_exclude_files | length > 0 %}
|
||||
# Diese Dateiendungen von der Viruspruefung ausschliessen.
|
||||
virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
|
||||
{% endif %}
|
||||
|
||||
# Fehlercode bei infizierter Datei (beim Öffnen)
|
||||
virusfilter:infected file errno on open = EACCES
|
||||
|
||||
|
||||
@@ -177,8 +177,8 @@ HostbasedAuthentication no
|
||||
# The allow/deny directives are processed in the following order: DenyUsers,
|
||||
# AllowUsers, DenyGroups, and finally AllowGroups.
|
||||
# By default, login is allowed for all users.
|
||||
{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %}
|
||||
AllowUsers {{ fact_sshd_allowed_users }}
|
||||
{% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %}
|
||||
AllowUsers {{ common_fact_sshd_allowed_users }}
|
||||
{% else %}
|
||||
#AllowUsers back chris sysadm cityslang christoph
|
||||
{% endif %}
|
||||
@@ -239,8 +239,8 @@ UsePAM {{ sshd_use_pam }}
|
||||
#
|
||||
# The list of available key exchange algorithms may also be obtained using "ssh -Q kex".
|
||||
#
|
||||
{% if (fact_sshd_kexalgorithms is defined) and fact_sshd_kexalgorithms %}
|
||||
KexAlgorithms {{ fact_sshd_kexalgorithms }}
|
||||
{% if (common_fact_sshd_kexalgorithms is defined) and common_fact_sshd_kexalgorithms %}
|
||||
KexAlgorithms {{ common_fact_sshd_kexalgorithms }}
|
||||
{% else %}
|
||||
#KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
|
||||
{% endif %}
|
||||
@@ -273,8 +273,8 @@ KexAlgorithms {{ fact_sshd_kexalgorithms }}
|
||||
#
|
||||
# The list of available ciphers may also be obtained using "ssh -Q cipher".
|
||||
#
|
||||
{% if (fact_sshd_ciphers is defined) and fact_sshd_ciphers %}
|
||||
Ciphers {{ fact_sshd_ciphers }}
|
||||
{% if (common_fact_sshd_ciphers is defined) and common_fact_sshd_ciphers %}
|
||||
Ciphers {{ common_fact_sshd_ciphers }}
|
||||
{% else %}
|
||||
#Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
{% endif %}
|
||||
@@ -317,8 +317,8 @@ Ciphers {{ fact_sshd_ciphers }}
|
||||
#
|
||||
# The list of available MAC algorithms may also be obtained using "ssh -Q mac".
|
||||
#
|
||||
{% if (fact_sshd_macs is defined) and fact_sshd_macs %}
|
||||
MACs {{ fact_sshd_macs }}
|
||||
{% if (common_fact_sshd_macs is defined) and common_fact_sshd_macs %}
|
||||
MACs {{ common_fact_sshd_macs }}
|
||||
{% else %}
|
||||
#MACs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,mac-sha2-256,hmac-sha2-512,hmac-sha1
|
||||
{% endif %}
|
||||
@@ -337,8 +337,8 @@ MACs {{ fact_sshd_macs }}
|
||||
# ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
#
|
||||
# The list of available key types may also be obtained using "ssh -Q key".
|
||||
{% if (fact_sshd_hostkeyalgorithms is defined) and fact_sshd_hostkeyalgorithms %}
|
||||
HostKeyAlgorithms {{ fact_sshd_hostkeyalgorithms }}
|
||||
{% if (common_fact_sshd_hostkeyalgorithms is defined) and common_fact_sshd_hostkeyalgorithms %}
|
||||
HostKeyAlgorithms {{ common_fact_sshd_hostkeyalgorithms }}
|
||||
{% endif %}
|
||||
|
||||
|
||||
|
||||
@@ -171,8 +171,8 @@ HostbasedAuthentication no
|
||||
# The allow/deny directives are processed in the following order: DenyUsers,
|
||||
# AllowUsers, DenyGroups, and finally AllowGroups.
|
||||
# By default, login is allowed for all users.
|
||||
{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %}
|
||||
AllowUsers {{ fact_sshd_allowed_users }}
|
||||
{% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %}
|
||||
AllowUsers {{ common_fact_sshd_allowed_users }}
|
||||
{% else %}
|
||||
#AllowUsers back chris sysadm cityslang christoph
|
||||
{% endif %}
|
||||
|
||||
@@ -5,20 +5,20 @@
|
||||
# *** ---------------------------------------------- ***
|
||||
|
||||
[Resolve]
|
||||
{% if (fact_resolved_nameserver is defined) and fact_resolved_nameserver %}
|
||||
DNS={{ fact_resolved_nameserver}}
|
||||
{% if (common_fact_resolved_nameserver is defined) and common_fact_resolved_nameserver %}
|
||||
DNS={{ common_fact_resolved_nameserver }}
|
||||
{% else %}
|
||||
#DNS=
|
||||
{% endif -%}
|
||||
|
||||
{% if (fact_resolved_fallback_nameserver is defined) and fact_resolved_fallback_nameserver %}
|
||||
FallbackDNS={{ fact_resolved_fallback_nameserver }}
|
||||
{% if (common_fact_resolved_fallback_nameserver is defined) and common_fact_resolved_fallback_nameserver %}
|
||||
FallbackDNS={{ common_fact_resolved_fallback_nameserver }}
|
||||
{% else %}
|
||||
#FallbackDNS=
|
||||
{% endif -%}
|
||||
|
||||
{% if (fact_resolved_domains is defined) and fact_resolved_domains %}
|
||||
Domains={{ fact_resolved_domains }}
|
||||
{% if (common_fact_resolved_domains is defined) and common_fact_resolved_domains %}
|
||||
Domains={{ common_fact_resolved_domains }}
|
||||
{% else %}
|
||||
#Domains=
|
||||
{% endif -%}
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
- network-interfaces
|
||||
|
||||
- name: (interfaces.yml) Ensure interfaces file is latest
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/network/interfaces.j2"
|
||||
dest: /etc/network/interfaces
|
||||
with_items: network_interfaces
|
||||
@@ -22,7 +22,7 @@
|
||||
- network-interfaces
|
||||
|
||||
- name: (interfaces.yml) Ensure imported device files at interfaces.d are latest
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "etc/network/interfaces.d/device.j2"
|
||||
dest: "{{ network_interface_path }}/device-{{ item.0 }}"
|
||||
with_items:
|
||||
|
||||
Reference in New Issue
Block a user