nis/roles/common/tasks/basic.yml

---

- name: (basic.yml) Ensure timezone is is correct
  community.general.timezone:
    name: "{{ time_zone }}"
  tags:
    - timezone

- name: (basic.yml) Ensure locales are present
  community.general.locale_gen:
    name: "{{ item }}"
    state: present
  with_items: "{{ locales }}"
  tags:
    - locales

- name: (basic.yml) Create a symbolic link /bin/sh -> bash
  ansible.builtin.file:
    src: bash
    dest: /bin/sh
    owner: root
    group: root
    state: link
  when:
    - "groups['file_server']|string is search(inventory_hostname)"
  tags:
    - symlink-sh

# ----------
# security limit (maybe DEPRECATED see systemd settings)
# ----------

- name: (basic.yml) Ensure directory '/etc/security/limits.d' exists
  ansible.builtin.file:
    path: /etc/security/limits.d
    state: directory
    mode: "0755"
    group: root
    owner: root
  when:
    - inventory_hostname in groups['file_server']
    - copy_plain_files_security_limits is defined
    - copy_plain_files_security_limits|length > 0
  tags:
    - systemd-config

- name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists
  ansible.builtin.copy:
    src: '{{ item.src_path }}'
    dest: '{{ item.dest_path }}'
    owner: root
    group: root
    mode: '0644'
  loop: "{{ copy_plain_files_security_limits }}"
  loop_control:
    label: 'dest: {{ item.name }}'
  when:
    - inventory_hostname in groups['file_server']
    - copy_plain_files_security_limits is defined
    - copy_plain_files_security_limits|length > 0
  tags:
    - systemd-config

# ----------
# systemd stuff
# ----------

- name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists
  ansible.builtin.file:
    path: /etc/systemd/system.conf.d
    state: directory
    mode: "0755"
    group: root
    owner: root
  when:
    - inventory_hostname in groups['file_server']
    - copy_plain_files_systemd is defined
    - copy_plain_files_systemd|length > 0
  tags:
    - systemd-config

- name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
  ansible.builtin.copy:
    src: '{{ item.src_path }}'
    dest: '{{ item.dest_path }}'
    owner: root
    group: root
    mode: '0644'
  loop: "{{ copy_plain_files_systemd }}"
  loop_control:
    label: 'dest: {{ item.name }}'
  when:
    - inventory_hostname in groups['file_server']
    - copy_plain_files_systemd is defined
    - copy_plain_files_systemd|length > 0
  tags:
    - systemd-config

- name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists
  ansible.builtin.file:
    path: /etc/systemd/journald.conf.d
    state: directory
    mode: "0755"
    group: root
    owner: root
  when:
    - copy_plain_files_journald is defined
    - copy_plain_files_journald|length > 0
  tags:
    - systemd-config

- name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists
  ansible.builtin.copy:
    src: '{{ item.src_path }}'
    dest: '{{ item.dest_path }}'
    owner: root
    group: root
    mode: '0644'
  loop: "{{ copy_plain_files_journald }}"
  loop_control:
    label: 'dest: {{ item.name }}'
  notify: "Restart systemd-journald"
  when:
    - copy_plain_files_journald is defined
    - copy_plain_files_journald|length > 0
  tags:
    - systemd-config

# ----------
# unattended upgrades
# ----------

- name: (basic.yml) install unattended-upgrades
  ansible.builtin.apt:
    pkg: unattended-upgrades
    state: present
  when:
    - ansible_facts['distribution'] == "Debian"
  tags:
    - unattended-upgrades

- name: (basic.yml) install apt-listchanges
  ansible.builtin.apt:
    pkg: apt-listchanges
    state: present
  when:
    - ansible_facts['distribution'] == "Debian"
  tags:
    - unattended-upgrades

- name: (basic.yml) remove apticron
  ansible.builtin.apt:
    pkg: apticron
    state: absent
  when:
    - ansible_facts['distribution'] == "Debian"
  tags:
    - unattended-upgrades

- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
  ansible.builtin.stat:
    path: /etc/apt/apt.conf.d/20auto-upgrades
  register: common_ua_enabled
  when:
    - ansible_facts['distribution'] == "Debian"
  tags:
    - unattended-upgrades

- name: (basic.yml) activate unattended upgrades
  ansible.builtin.command:
    cmd: dpkg-reconfigure -plow unattended-upgrades
    creates: /etc/apt/apt.conf.d/20auto-upgrades
  environment:
    DEBIAN_FRONTEND: noninteractive
    DEBCONF_NONINTERACTIVE_SEEN: "true"
  when:
    - ansible_facts['distribution'] == "Debian"
    - not common_ua_enabled.stat.exists
  tags:
    - unattended-upgrades

- name: (basic.yml) copy apt-listchanges.conf
  ansible.builtin.template:
    src: etc/apt/listchanges.conf.j2
    dest: /etc/apt/listchanges.conf
    owner: root
    group: root
    mode: "0644"
  when:
    - ansible_facts['distribution'] == "Debian"
  tags:
    - unattended-upgrades

- name: (basic.yml) copy unattended-upgrades conf
  ansible.builtin.template:
    src: etc/apt/apt.conf.d/50unattended-upgrades.j2
    dest: /etc/apt/apt.conf.d/50unattended-upgrades
    backup: true
    owner: root
    group: root
    mode: "0644"
  when:
    - ansible_facts['distribution'] == "Debian"
  tags:
    - unattended-upgrades

# ----------
# - /etc/hosts
# ----------

- name: (basic.yml) Check file '/etc/hosts.ORIG' exists
  ansible.builtin.stat:
    path: /etc/hosts.ORIG
  register: common_etc_hosts_orig
  when:
    - "groups['file_server']|string is search(inventory_hostname)"
  tags:
    - etc_hosts

- name: (basic.yml) Backup installation version of file '/etc/hosts'
  ansible.builtin.copy:
    src: /etc/hosts
    dest: /etc/hosts.ORIG
    remote_src: true
    force: false
    owner: root
    group: root
    mode: "0644"
  when:
    - "groups['file_server']|string is search(inventory_hostname)"
    - not common_etc_hosts_orig.stat.exists
  tags:
    - etc_hosts

- name: (basic.yml) addjust '/etc/hosts' add nis-server ..
  ansible.builtin.lineinfile:
    path: /etc/hosts
    regexp: '^192\.168\.'
    line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
  when:
    - "groups['nis_server']|string is search(inventory_hostname)"
  tags:
    - etc_hosts