From 81398e847ec3721d53ee5d074e458b37e9e9dd65 Mon Sep 17 00:00:00 2001 From: Christoph Date: Mon, 20 Jul 2026 23:09:30 +0200 Subject: [PATCH] Refactor Ansible tasks to use fully qualified module names and improve code consistency - Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity. - Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems. - Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation. - Removed unnecessary comments and whitespace to enhance readability. - Ensured that conditions and loops are consistently formatted across all tasks. --- roles/common/tasks/apt-gateway.yml | 10 +- roles/common/tasks/apt.yml | 95 +++++----- roles/common/tasks/basic.yml | 60 +++--- roles/common/tasks/caching-nameserver.yml | 52 +++-- .../tasks/config_files_mailsystem_scripts.yml | 11 +- roles/common/tasks/copy_files.yml | 86 ++++----- roles/common/tasks/cron.yml | 6 +- roles/common/tasks/extrepo.yml | 13 +- roles/common/tasks/first-run.yml | 10 +- roles/common/tasks/git.yml | 179 ++++++++---------- roles/common/tasks/main.yml | 96 ++++++---- roles/common/tasks/motd.yml | 16 +- roles/common/tasks/mysql.yml | 18 +- roles/common/tasks/nfs.yml | 48 ++--- roles/common/tasks/ntp.yml | 18 +- roles/common/tasks/redis-server.yml | 55 +++--- roles/common/tasks/samba-config-server.yml | 68 ++++--- roles/common/tasks/samba-remove-user.yml | 30 ++- roles/common/tasks/samba-user.yml | 57 +++--- roles/common/tasks/shell.yml | 10 +- roles/common/tasks/show.yml | 7 +- roles/common/tasks/sshd.yml | 67 +++---- roles/common/tasks/sudoers.yml | 21 +- roles/common/tasks/symlink_files.yml | 11 +- roles/common/tasks/systemd-resolved.yml | 31 ++- .../systemd-services_debian_based_OS.yml | 31 ++- .../systemd-services_redhat_based_OS.yml | 33 ++-- roles/common/tasks/tor.yml | 17 +- roles/common/tasks/users-systemfiles.yml | 98 +++++----- roles/common/tasks/users.yml | 144 +++++++------- roles/common/tasks/webadmin-user.yml | 142 +++++++------- roles/common/tasks/x2go-server.yml | 6 +- roles/common/tasks/yum.yml | 43 ++--- 33 files changed, 745 insertions(+), 844 deletions(-) diff --git a/roles/common/tasks/apt-gateway.yml b/roles/common/tasks/apt-gateway.yml index a4d6704..6a58f95 100644 --- a/roles/common/tasks/apt-gateway.yml +++ b/roles/common/tasks/apt-gateway.yml @@ -1,31 +1,27 @@ --- - - name: (apt-gateway.yml) Install gateway related packages ansible.builtin.apt: name: "{{ apt_gateway_host_pkgs }}" state: "{{ apt_install_state }}" - - name: (apt-gateway.yml) Check if file '/etc/logrotate.d/speedtest' exists ansible.builtin.stat: path: /etc/logrotate.d/speedtest register: common_logrotate_speedtest_exists - - name: (apt-gateway.yml) Ensure file /etc/logrotate.d/speedtest exists ansible.builtin.copy: src: "{{ role_path + '/files/etc/logrotate.d/speedtest' }}" dest: /etc/logrotate.d/speedtest owner: root group: root - mode: '0644' + mode: "0644" when: - not common_logrotate_speedtest_exists.stat.exists - - name: (apt-gateway.yml) Set crontab entry for nightly speedtests ansible.builtin.cron: - name: 'Speedtest' + name: "Speedtest" minute: 13 hour: 0-8 - job: '/root/bin/admin-stuff/speedtest.sh' + job: "/root/bin/admin-stuff/speedtest.sh" diff --git a/roles/common/tasks/apt.yml b/roles/common/tasks/apt.yml index 529e155..7a7aab2 100644 --- a/roles/common/tasks/apt.yml +++ b/roles/common/tasks/apt.yml @@ -1,6 +1,6 @@ --- - name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list' - file: + ansible.builtin.file: path: "{{ item }}" state: absent with_items: @@ -10,12 +10,12 @@ - apt-configuration - name: (apt.yml) update configuration file - /etc/apt/sources.list - template: + ansible.builtin.template: src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2" dest: /etc/apt/sources.list owner: root group: root - mode: 0644 + mode: "0644" register: apt_config_updated when: - apt_manage_sources_list|bool @@ -25,7 +25,7 @@ - apt-configuration - name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13) - apt: + ansible.builtin.apt: name: debian-archive-keyring state: present when: @@ -37,7 +37,7 @@ - apt-configuration - name: (apt.yml) check if legacy /etc/apt/sources.list exists (Debian >= 13) - stat: + ansible.builtin.stat: path: /etc/apt/sources.list register: apt_sources_list_stat when: @@ -48,7 +48,7 @@ - apt-configuration - name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13) - copy: + ansible.builtin.copy: src: /etc/apt/sources.list dest: /etc/apt/sources.list.before-deb822 remote_src: true @@ -66,7 +66,7 @@ - apt-configuration - name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13) - copy: + ansible.builtin.copy: dest: /etc/apt/sources.list content: | # {{ ansible_managed }} @@ -85,7 +85,7 @@ - apt-configuration - name: (apt.yml) configure deb822 Debian repository (Debian >= 13) - template: + ansible.builtin.template: src: "etc/apt/deb822/debian.sources.j2" dest: /etc/apt/sources.list.d/debian.sources owner: root @@ -100,7 +100,7 @@ - apt-configuration - name: (apt.yml) configure deb822 security repository (Debian >= 13) - template: + ansible.builtin.template: src: "etc/apt/deb822/security.sources.j2" dest: /etc/apt/sources.list.d/security.sources owner: root @@ -115,7 +115,7 @@ - apt-configuration - name: (apt.yml) configure deb822 backports repository (Debian >= 13) - template: + ansible.builtin.template: src: "etc/apt/deb822/backports.sources.j2" dest: /etc/apt/sources.list.d/backports.sources owner: root @@ -133,7 +133,7 @@ # If 'backports' was enabled in a previous run but is now disabled. # - name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13) - file: + ansible.builtin.file: path: /etc/apt/sources.list.d/backports.sources state: absent register: apt_config_removed_backports_sources @@ -148,7 +148,7 @@ # Collect change states from all Debian >=13 deb822 source tasks so apt update # can force a fresh cache refresh when repository files changed. - name: (apt.yml) aggregate deb822 source changes (Debian >= 13) - set_fact: + ansible.builtin.set_fact: apt_config_updated: changed: >- {{ @@ -166,7 +166,7 @@ - apt-configuration - name: (apt.yml) apt update - apt: + ansible.builtin.apt: update_cache: true cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" when: apt_update|bool @@ -193,7 +193,7 @@ - apt-webserver-pkgs - name: (apt.yml) apt upgrade - apt: + ansible.builtin.apt: upgrade: "{{ apt_upgrade_type }}" update_cache: true dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" @@ -206,7 +206,7 @@ - apt-webserver-pkgs - name: (apt.yml) Initial install debian packages (stretch) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_stretch }}" state: "{{ apt_install_state }}" when: @@ -217,7 +217,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (buster) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_buster }}" state: "{{ apt_install_state }}" environment: @@ -230,7 +230,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (bullseye) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_bullseye }}" state: "{{ apt_install_state }}" environment: @@ -243,7 +243,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (bookworm) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_bookworm }}" state: "{{ apt_install_state }}" environment: @@ -256,7 +256,7 @@ - apt-initial-install - name: (apt.yml) Initial install debian packages (trixie) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_trixie }}" state: "{{ apt_install_state }}" environment: @@ -269,7 +269,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (bionic) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_bionic }}" state: "{{ apt_install_state }}" environment: @@ -281,7 +281,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (xenial) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_xenial }}" state: "{{ apt_install_state }}" environment: @@ -293,7 +293,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (jammy) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_jammy }}" state: "{{ apt_install_state }}" environment: @@ -305,7 +305,7 @@ - apt-initial-install - name: (apt.yml) Initial install ubuntu packages (noble) - apt: + ansible.builtin.apt: name: "{{ apt_initial_install_ubuntu_noble }}" state: "{{ apt_install_state }}" environment: @@ -321,7 +321,7 @@ # --- - name: (apt.yml) Ensure we have CPU microcode from backports (debian stretch) - apt: + ansible.builtin.apt: name: "{{ microcode_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}-backports" @@ -334,20 +334,21 @@ - apt-microcode - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie) - apt: + ansible.builtin.apt: name: "{{ microcode_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" when: - ansible_facts['distribution'] == "Debian" - - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13" + - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or ansible_facts['distribution_major_version'] + == "12" or ansible_facts['distribution_major_version'] == "13" - ansible_facts['processor']|string is search("Intel") tags: - apt-initial-install - apt-microcode - name: (apt.yml) Install CPU microcode (ubuntu bionic) - apt: + ansible.builtin.apt: name: "{{ microcode_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -360,7 +361,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode (ubuntu xenial) - apt: + ansible.builtin.apt: name: "{{ microcode_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -373,7 +374,7 @@ - apt-microcode - name: (apt.yml) Install CPU microcode (ubuntu jammy) - apt: + ansible.builtin.apt: name: "{{ microcode_package }}" state: present default_release: "{{ ansible_facts['distribution_release'] }}" @@ -386,7 +387,7 @@ - apt-microcode - name: (apt.yml) Install lxc_host related packages - apt: + ansible.builtin.apt: name: "{{ apt_lxc_host_pkgs }}" state: "{{ apt_install_state }}" when: @@ -395,7 +396,7 @@ - apt-lxc-hosts-pkgs - name: (apt.yml) Install docker related packages - apt: + ansible.builtin.apt: name: "{{ apt_docker_host_pkgs }}" state: "{{ apt_install_state }}" when: @@ -404,7 +405,7 @@ - apt-docker-hosts-pkgs - name: (apt.yml) Install kvm_host related packages - apt: + ansible.builtin.apt: name: "{{ apt_kvm_host_pkgs }}" state: "{{ apt_install_state }}" when: @@ -413,7 +414,7 @@ - apt-kvm-hosts-pkgs - name: (apt.yml) Install kvm_host related packages only debian 10 (buster) - apt: + ansible.builtin.apt: name: "{{ apt_kvm_host_buster_pkgs }}" state: "{{ apt_install_state }}" when: @@ -424,7 +425,7 @@ - apt-kvm-hosts-pkgs - name: (apt.yml) Install compiler related packages - apt: + ansible.builtin.apt: name: "{{ apt_compiler_pkgs }}" state: "{{ apt_install_state }}" when: install_compiler_pkgs|bool @@ -432,7 +433,7 @@ - apt-compiler-pkgs - name: (apt.yml) Install postgresql_server related packages - apt: + ansible.builtin.apt: name: "{{ apt_postgresql_pkgs }}" state: "{{ apt_install_state }}" when: install_postgresql_pkgs|bool @@ -440,7 +441,7 @@ - apt-postgresql-server-pkgs - name: (apt.yml) Install webserver related packages (Debian <= 12) - apt: + ansible.builtin.apt: name: "{{ apt_webserver_pkgs }}" state: "{{ apt_install_state }}" when: @@ -451,7 +452,7 @@ - apt-webserver-pkgs - name: (apt.yml) Install webserver related packages (Debian >= 13) - apt: + ansible.builtin.apt: name: "{{ apt_webserver_pkgs_trixie }}" state: "{{ apt_install_state }}" when: @@ -462,7 +463,7 @@ - apt-webserver-pkgs - name: (apt.yml) Install samba related packages - package: + ansible.builtin.package: pkg: "{{ apt_install_server_samba }}" state: present when: @@ -471,7 +472,7 @@ - samba-server - name: (apt.yml) Install extra packages - apt: + ansible.builtin.apt: name: "{{ apt_extra_pkgs }}" state: "{{ apt_install_state }}" when: apt_install_extra_pkgs|bool @@ -479,7 +480,7 @@ - apt-extra-pkgs - name: (apt.yml) Remove unwanted packages - apt: + ansible.builtin.apt: name: "{{ apt_remove }}" state: absent purge: "{{ apt_remove_purge }}" @@ -487,7 +488,7 @@ - apt-remove - name: (apt.yml) autoremove - apt: + ansible.builtin.apt: autoremove: true dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" when: apt_autoremove|bool @@ -514,7 +515,7 @@ - name: (apt.yml) autoclean cache ansible.builtin.apt: - autoclean: yes + autoclean: true when: apt_clean | bool tags: - apt-clean @@ -528,11 +529,10 @@ # link '/etc/mysql/my.cnf' in case mysql/mariadb was installed from source # - name: (apt.yml) Check if file '/usr/local/mysql/etc/my.cnf' exists - stat: + ansible.builtin.stat: path: /usr/local/mysql/etc/my.cnf register: usr_local_mysql_etc_my_cnf - when: groups['mysql_server']|string is search(inventory_hostname) or - groups['apache2_webserver']|string is search(inventory_hostname) or + when: groups['mysql_server']|string is search(inventory_hostname) or groups['apache2_webserver']|string is search(inventory_hostname) or groups['nextcloud_server']|string is search(inventory_hostname) tags: - apt-webserver-pkgs @@ -548,15 +548,14 @@ # - check_mysql_cnf - name: (apt.yml) Create a symbolic link /etc/my.cnf -> /usr/local/mysql/etc/my.cnf - file: + ansible.builtin.file: src: /usr/local/mysql/etc/my.cnf dest: /etc/mysql/my.cnf owner: root group: root state: link when: - - (groups['mysql_server']|string is search(inventory_hostname) or - groups['apache2_webserver']|string is search(inventory_hostname) or + - (groups['mysql_server']|string is search(inventory_hostname) or groups['apache2_webserver']|string is search(inventory_hostname) or groups['nextcloud_server']|string is search(inventory_hostname)) - usr_local_mysql_etc_my_cnf.stat.exists tags: diff --git a/roles/common/tasks/basic.yml b/roles/common/tasks/basic.yml index 74139d1..bb14781 100644 --- a/roles/common/tasks/basic.yml +++ b/roles/common/tasks/basic.yml @@ -1,5 +1,4 @@ --- - - name: Ensure util-linux-extra is installed on Debian ansible.builtin.apt: name: util-linux-extra @@ -15,7 +14,6 @@ tags: - timezone - - name: (basic.yml) Ensure locales are present community.general.locale_gen: name: "{{ item }}" @@ -36,7 +34,6 @@ tags: - symlink-sh - # ---------- # security limit (maybe DEPRECATED see systemd settings) # ---------- @@ -45,7 +42,7 @@ ansible.builtin.file: path: /etc/security/limits.d state: directory - mode: '0755' + mode: "0755" group: root owner: root when: @@ -57,14 +54,14 @@ - name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists ansible.builtin.copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_security_limits }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" when: - inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server'] - copy_plain_files_security_limits is defined @@ -72,7 +69,6 @@ tags: - systemd-config - # ---------- # systemd stuff # ---------- @@ -81,7 +77,7 @@ ansible.builtin.file: path: /etc/systemd/system.conf.d state: directory - mode: '0755' + mode: "0755" group: root owner: root when: @@ -97,14 +93,14 @@ - name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists ansible.builtin.copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_systemd }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" when: - >- inventory_hostname not in groups['lxc_guest'] or @@ -120,7 +116,7 @@ ansible.builtin.file: path: /etc/systemd/journald.conf.d state: directory - mode: '0755' + mode: "0755" group: root owner: root when: @@ -131,14 +127,14 @@ - name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists ansible.builtin.copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_journald }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" notify: "Restart systemd-journald" when: - copy_plain_files_journald is defined @@ -146,7 +142,6 @@ tags: - systemd-config - # ---------- # kernel parameter # ---------- @@ -155,7 +150,7 @@ ansible.builtin.file: path: etc/sysctl.d state: directory - mode: '0755' + mode: "0755" group: root owner: root when: @@ -167,14 +162,14 @@ - name: (basic.yml) Ensure files /etc/sysctl.d/*.conf exists ansible.builtin.copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_sysctl }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" when: - inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server'] - copy_plain_files_sysctl is defined @@ -184,14 +179,14 @@ - name: (basic.yml) Additional Kernel Parameters (files /etc/sysctl.d/*.conf) ansible.builtin.copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_additional_plain_files_sysctl }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" when: - inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server'] - copy_additional_plain_files_sysctl is defined @@ -199,7 +194,6 @@ tags: - systctl-config - # ---------- # unattended upgrades # ---------- @@ -246,7 +240,7 @@ creates: /etc/apt/apt.conf.d/20auto-upgrades environment: DEBIAN_FRONTEND: noninteractive - DEBCONF_NONINTERACTIVE_SEEN: 'true' + DEBCONF_NONINTERACTIVE_SEEN: "true" when: - ansible_facts['distribution'] == "Debian" - not common_ua_enabled.stat.exists @@ -259,7 +253,7 @@ dest: /etc/apt/listchanges.conf owner: root group: root - mode: '0644' + mode: "0644" when: - ansible_facts['distribution'] == "Debian" tags: @@ -272,7 +266,7 @@ backup: true owner: root group: root - mode: '0644' + mode: "0644" when: - ansible_facts['distribution'] == "Debian" tags: diff --git a/roles/common/tasks/caching-nameserver.yml b/roles/common/tasks/caching-nameserver.yml index f8b34af..2db0c2d 100644 --- a/roles/common/tasks/caching-nameserver.yml +++ b/roles/common/tasks/caching-nameserver.yml @@ -1,12 +1,11 @@ --- - # --- # Install 'bind' apt based OS # --- - name: (caching-nameserver.yml) update - apt: + ansible.builtin.apt: update_cache: true cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" when: @@ -26,9 +25,8 @@ tags: - apt-caching-nameserver - - name: (caching-nameserver.yml) upgrade - apt: + ansible.builtin.apt: upgrade: "{{ apt_upgrade_type }}" update_cache: true dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" @@ -38,9 +36,8 @@ tags: - apt-caching-nameserver - - name: (caching-nameserver.yml) Install bind packages (using apt) - apt: + ansible.builtin.apt: name: "{{ apt_bind_pkgs }}" state: present when: @@ -54,10 +51,10 @@ # --- - name: (yum.yml) Install system updates for centos systems - yum: - name: '*' + ansible.builtin.dnf: + name: "*" state: latest - update_cache: yes + update_cache: true #cache_valid_time: 3600 when: - ansible_facts.os_family == "RedHat" @@ -66,7 +63,7 @@ - yum-update - name: (yum.yml) Install bind packages (using yum) - yum: + ansible.builtin.dnf: name: "{{ yum_bind_pks }}" state: "{{ yum_install_state }}" when: @@ -80,30 +77,29 @@ # -- - name: (caching-nameserver.yml) Create directory /var/log/named if it does not exist - file: + ansible.builtin.file: path: /var/log/named state: directory owner: bind group: bind - mode: '0755' + mode: "0755" when: - ansible_facts["distribution"] == "Debian" - - name: (caching-nameserver.yml) update named.conf.options configuration file (normal server) - template: + ansible.builtin.template: src: etc/bind/named.conf.options.j2 dest: /etc/bind/named.conf.options - backup: yes + backup: true owner: root group: bind - mode: 0644 + mode: "0644" #validate: visudo -cf %s notify: Reload bind9 tags: - apt-caching-nameserver - caching-nameserver - when: + when: - ansible_facts["distribution"] == "Debian" - inventory_hostname not in groups["gateway_server"] @@ -112,44 +108,42 @@ # In case of gateway gateway servers ONLY if bind ption file NOT exists # - name: Check if file '/etc/bind/named.conf.options' exists - stat: + ansible.builtin.stat: path: /etc/bind/named.conf.options register: file_named_conf_options - name: (caching-nameserver.yml) update named.conf.options configuration file (gateway server) - template: + ansible.builtin.template: src: etc/bind/named.conf.options.gateway.j2 dest: /etc/bind/named.conf.options - backup: yes + backup: true owner: root group: bind - mode: 0644 + mode: "0644" #validate: visudo -cf %s notify: Reload bind9 tags: - apt-caching-nameserver - caching-nameserver - when: + when: - ansible_facts["distribution"] == "Debian" - inventory_hostname in groups["gateway_server"] # - not file_named_conf_options.stat.exists # -------------------- - - name: (caching-nameserver.yml) Add 127.0.0.1 as first nameserver entry to /etc/resolv.conf - lineinfile: + ansible.builtin.lineinfile: path: /etc/resolv.conf line: nameserver 127.0.0.1 - firstmatch: yes - insertbefore: '^nameserver' + firstmatch: true + insertbefore: "^nameserver" state: present owner: root group: root - mode: '0644' + mode: "0644" tags: - apt-caching-nameserver - when: + when: - ansible_facts["distribution"] == "Debian" - not systemd_resolved - diff --git a/roles/common/tasks/config_files_mailsystem_scripts.yml b/roles/common/tasks/config_files_mailsystem_scripts.yml index 34cde33..83e8491 100644 --- a/roles/common/tasks/config_files_mailsystem_scripts.yml +++ b/roles/common/tasks/config_files_mailsystem_scripts.yml @@ -1,15 +1,14 @@ --- - - name: (config_files_mailsystem_scripts.yml) Copy config file templates mailsystem scripts - template: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.template: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ template_files_mailsystem_script }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" when: - template_files_mailsystem_script is defined - template_files_mailsystem_script|length > 0 diff --git a/roles/common/tasks/copy_files.yml b/roles/common/tasks/copy_files.yml index 6530577..2ab1127 100644 --- a/roles/common/tasks/copy_files.yml +++ b/roles/common/tasks/copy_files.yml @@ -1,35 +1,34 @@ --- - # --- # Some Checks # --- - name: Check if file '/etc/postfix/relay_domains' exists - stat: + ansible.builtin.stat: path: /etc/postfix/relay_domains register: relay_domains_actual - name: (copy_files.yml) Get checksum of '/etc/postfix/relay_domains' - set_fact: + ansible.builtin.set_fact: relay_domains_sha1: "{{ relay_domains_actual.stat.checksum }}" when: - relay_domains_actual.stat.exists - + # --- # Copy files - main # --- - name: (copy_files.yml) Copy plain files - copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.copy: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files }}" loop_control: - label: 'dest: {{ item.name }}' - when: + label: "dest: {{ item.name }}" + when: - copy_plain_files is defined - copy_plain_files|length > 0 tags: @@ -37,16 +36,16 @@ - copy-plain-files - name: (copy_files.yml) Copy plain files Postfix (/etc/postfix) - copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.copy: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_postfix }}" loop_control: - label: 'dest: {{ item.name }}' - when: + label: "dest: {{ item.name }}" + when: - inventory_hostname in groups['mail_server'] - copy_plain_files_postfix is defined - copy_plain_files_postfix|length > 0 @@ -56,16 +55,16 @@ notify: "Reload postfwd" - name: (copy_files.yml) Copy host specific plain files Postfix (/etc/postfix) - copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.copy: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_postfix_host_specific }}" loop_control: - label: 'dest: {{ item.name }}' - when: + label: "dest: {{ item.name }}" + when: - inventory_hostname in groups['mail_server'] - copy_plain_files_postfix_host_specific is defined - copy_plain_files_postfix_host_specific|length > 0 @@ -75,16 +74,16 @@ notify: "Reload postfwd" - name: (copy_files.yml) Copy plain files Postfix Firewall (postfwd) - copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.copy: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_postfwd }}" loop_control: - label: 'dest: {{ item.name }}' - when: + label: "dest: {{ item.name }}" + when: - inventory_hostname in groups['mail_server'] - copy_plain_files_postfwd is defined - copy_plain_files_postfwd|length > 0 @@ -94,16 +93,16 @@ notify: "Reload postfwd" - name: (copy_files.yml) Copy host specific plain files Postfix Firewall (postfwd) - copy: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.copy: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_plain_files_postfwd_host_specific }}" loop_control: - label: 'dest: {{ item.name }}' - when: + label: "dest: {{ item.name }}" + when: - inventory_hostname in groups['mail_server'] - copy_plain_files_postfwd_host_specific is defined - copy_plain_files_postfwd_host_specific|length > 0 @@ -112,17 +111,16 @@ - copy-plain-files notify: "Reload postfwd" - - name: (copy_files.yml) Copy template files - template: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.template: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ copy_template_files }}" loop_control: - label: 'dest: {{ item.name }}' + label: "dest: {{ item.name }}" when: - copy_template_files is defined - copy_template_files|length > 0 @@ -135,18 +133,18 @@ # --- - name: Get checksum oif (possible upodated) file '/etc/postfix/relay_domains' exists - stat: + ansible.builtin.stat: path: /etc/postfix/relay_domains register: relay_domains_new - name: (copy_files.yml) Get checksum of '/etc/postfix/relay_domains' - set_fact: + ansible.builtin.set_fact: relay_domains_sha1_new: "{{ relay_domains_new.stat.checksum }}" when: - relay_domains_new.stat.exists - + - name: (copy_files.yml) Renew database /etc/postfix/relay_domains.db - shell: '/usr/sbin/postmap btree:/etc/postfix/relay_domains' + ansible.builtin.command: "/usr/sbin/postmap btree:/etc/postfix/relay_domains" when: - relay_domains_actual.stat.exists - relay_domains_new.stat.exists diff --git a/roles/common/tasks/cron.yml b/roles/common/tasks/cron.yml index c598bc9..166458f 100644 --- a/roles/common/tasks/cron.yml +++ b/roles/common/tasks/cron.yml @@ -77,7 +77,7 @@ - user_crontab - name: (cron.yml) Set env entries in user crontabs - cron: + ansible.builtin.cron: name: "{{ item.name }}" env: "yes" user: '{{ item.user | default("root") }}' @@ -91,7 +91,7 @@ - user_crontab - name: (cron.yml) Set special time entries in user crontabs - cron: + ansible.builtin.cron: name: "{{ item.name }}" special_time: "{{ item.special_time }}" user: '{{ item.user | default("root") }}' @@ -105,7 +105,7 @@ - user_crontab - name: (cron.yml) Set normal entries in user crontabs - cron: + ansible.builtin.cron: name: "{{ item.name }}" minute: "{{ item.minute | default(omit) }}" hour: "{{ item.hour | default(omit) }}" diff --git a/roles/common/tasks/extrepo.yml b/roles/common/tasks/extrepo.yml index eaa172c..03d13b5 100644 --- a/roles/common/tasks/extrepo.yml +++ b/roles/common/tasks/extrepo.yml @@ -1,5 +1,4 @@ --- - - name: (extrepo.yml) Install extrepo package ansible.builtin.apt: name: extrepo @@ -10,17 +9,17 @@ - name: (extrepo.yml) Enable contrib policy in /etc/extrepo/config.yaml ansible.builtin.lineinfile: path: /etc/extrepo/config.yaml - regexp: '^(#\s*)?-\s*contrib$' - insertafter: '^- main$' - line: '- contrib' + regexp: "^(#\\s*)?-\\s*contrib$" + insertafter: "^- main$" + line: "- contrib" tags: - extrepo - name: (extrepo.yml) Enable non-free policy in /etc/extrepo/config.yaml ansible.builtin.lineinfile: path: /etc/extrepo/config.yaml - regexp: '^(#\s*)?-\s*non-free$' - insertafter: '^- contrib$' - line: '- non-free' + regexp: "^(#\\s*)?-\\s*non-free$" + insertafter: "^- contrib$" + line: "- non-free" tags: - extrepo diff --git a/roles/common/tasks/first-run.yml b/roles/common/tasks/first-run.yml index 2a18a71..502c20e 100644 --- a/roles/common/tasks/first-run.yml +++ b/roles/common/tasks/first-run.yml @@ -1,11 +1,9 @@ --- - - hosts: o25.oopen.de tasks: + - name: Ensure aptitude is present + raw: test -e /usr/bin/aptitude || apt-get install aptitude -y - - name: Ensure aptitude is present - raw: test -e /usr/bin/aptitude || apt-get install aptitude -y - - - name: Ensure python2 is present (This is necessary for ansible to work properly) - raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) + - name: Ensure python2 is present (This is necessary for ansible to work properly) + raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) diff --git a/roles/common/tasks/git.yml b/roles/common/tasks/git.yml index 578f30c..6fd1d21 100644 --- a/roles/common/tasks/git.yml +++ b/roles/common/tasks/git.yml @@ -1,6 +1,5 @@ --- - -#- name: (git.yml) include variables +# - name: (git.yml) include variables # include_vars: "{{ item }}" # with_first_found: # - "git-{{ inventory_hostname }}.yml" @@ -21,15 +20,12 @@ # - git-mailservers-repositories # - git-sympa-repositories # - git-other-repositories - - - # --- # Firewall repository # --- - name: (git.yml) Install/Update firewall repository - git: + ansible.builtin.git: repo: "{{ git_firewall_repository.repo }}" dest: "{{ git_firewall_repository.dest }}" when: git_firewall_repository is defined and git_firewall_repository | length > 0 @@ -41,275 +37,257 @@ # --- - name: (git.yml) Install/Update default repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_default_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_default_repositories }}" loop_control: label: "{{ item.name }}" tags: - git-default-repositories - # --- # Group [oopen_server] reposotories # --- - name: (git.yml) Install/Update oopen_server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_oopen_server_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_oopen_server_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['oopen_server']|string is search(inventory_hostname)" tags: - git-oopen-server-repositories - # --- # Group [warenform_server] reposotories # --- - name: (git.yml) Install/Update warenform_server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_warenform_server_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_warenform_server_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['warenform_server']|string is search(inventory_hostname)" tags: - git-warenform-server-repositories - # --- # Group [lxc_guest] reposotories # --- - name: (git.yml) Install/Update lxc_guest repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_lxc_guest_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_lxc_guest_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['lxc_guest']|string is search(inventory_hostname)" tags: - git-lxc-guest-repositories - # --- # Group [lxc_host] reposotories # --- - name: (git.yml) Install/Update lxc_host repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_lxc_host_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_lxc_host_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['lxc_host']|string is search(inventory_hostname)" tags: - git-lxc-host-repositories - # --- # Group [gateway_server] reposotories # --- - name: (git.yml) Install/Update gateway repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_gateway_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_gateway_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['gateway_server']|string is search(inventory_hostname)" tags: - git-gateway-server-repositories - # --- # Group [apache2_webserver] reposotories # --- - name: (git.yml) Install/Update apache2 repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_apache2_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_apache2_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['apache2_webserver']|string is search(inventory_hostname)" tags: - git-apache2-repositories - # --- # Group [nginx_webserver] reposotories # --- - name: (git.yml) Install/Update nginx repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_nginx_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_nginx_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['nginx_webserver']|string is search(inventory_hostname)" tags: - git-nginx-repositories - # --- # Group [mysql_server] reposotories # --- - name: (git.yml) Install/Update mysql server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_mysql_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_mysql_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['mysql_server']|string is search(inventory_hostname)" tags: - git-mysql-server-repositories - # --- # Group [postgresql_server] reposotories # --- - name: (git.yml) Install/Update postgresql-server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_postgresql_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_postgresql_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['postgresql_server']|string is search(inventory_hostname)" tags: - git-postgresql-server-repositories - # --- # Group [nextcloud_server] reposotories # --- - name: (git.yml) Install/Update nextcloud server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_nextcloud_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_nextcloud_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['nextcloud_server']|string is search(inventory_hostname)" tags: - git-nextcloud-server-repositories - # --- # Group [dns_server] reposotories # --- - name: (git.yml) Install/Update dns server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_dns_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_dns_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['dns_server']|string is search(inventory_hostname)" tags: - git-dns-server-repositories - # --- # Group [backup_server] reposotories # --- - name: (git.yml) Install/Update backup server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_backup_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_backup_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['backup_server']|string is search(inventory_hostname)" - ignore_errors: True + ignore_errors: true tags: - git-backup-server-repositories - # --- # Group [samba_server] reposotories # --- - name: (git.yml) Install/Update samba server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_samba_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_samba_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['samba_server']|string is search(inventory_hostname)" - ignore_errors: True + ignore_errors: true tags: - git-samba-server-repositories - - # --- # Group [mail_server] reposotories # --- - name: (git.yml) Install/Update mail server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_mailserver_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_mailserver_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['mail_server']|string is search(inventory_hostname)" tags: - git-mailservers-repositories - # --- # Group [sympa_list_servers] reposotories # --- - name: (git.yml) Install/Update sympa server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_sympa_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_sympa_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['sympa_list_server']|string is search(inventory_hostname)" tags: - git-sympa-repositories - # --- # Group [jitsi_meet_server] reposotories # --- - name: (git.yml) Install/Update sympa server repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' - with_items: '{{ git_jitsi_meet_repositories }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" + with_items: "{{ git_jitsi_meet_repositories }}" loop_control: label: "{{ item.name }}" when: "groups['jitsi_meet_server']|string is search(inventory_hostname)" tags: - git-jitsi_meet-repositories - # --- # Group [so36_server_dehydrated] reposotories # --- @@ -325,32 +303,31 @@ # tags: # - git-so36-dehydrated-repositories - # --- # Other (host specific) repositories # --- # Read in host specific vars file if exists - name: (git.yml) Check for host specific git vars file - stat: + ansible.builtin.stat: path: "vars/git-{{ inventory_hostname }}.yml" register: git_host_vars_file tags: - git-other-repositories - name: (git.yml) Include only files matching git-.yml (2.2) - include_vars: + ansible.builtin.include_vars: file: "vars/git-{{ inventory_hostname }}.yml" when: git_host_vars_file.stat.exists tags: - git-other-repositories - name: (git.yml) Install/Update other repositories - git: - repo: '{{ item.repo }}' - dest: '{{ item.dest }}' + ansible.builtin.git: + repo: "{{ item.repo }}" + dest: "{{ item.dest }}" loop_control: label: "{{ item.name }}" - with_items: '{{ git_other_repositories }}' + with_items: "{{ git_other_repositories }}" tags: - git-other-repositories diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 7ee9900..0041d55 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -1,5 +1,6 @@ --- -- import_tasks: show.yml +- name: (main.yml) Import show.yml tasks + ansible.builtin.import_tasks: show.yml tags: - show @@ -8,7 +9,8 @@ # timezone # locales # systemd-nofiles -- import_tasks: basic.yml +- name: (main.yml) Import basic.yml tasks + ansible.builtin.import_tasks: basic.yml tags: - basic @@ -27,7 +29,8 @@ # apt-remove # apt-autoremove # apt-clean -- import_tasks: apt.yml +- name: (main.yml) Import apt.yml tasks + ansible.builtin.import_tasks: apt.yml when: - ansible_facts['distribution'] == "Debian" tags: apt @@ -35,7 +38,8 @@ # tags supported inside extrepo.yml # # extrepo -- import_tasks: extrepo.yml +- name: (main.yml) Import extrepo.yml tasks + ansible.builtin.import_tasks: extrepo.yml when: - ansible_facts['distribution'] == "Debian" - (ansible_facts['distribution_major_version'] | int) >= 12 @@ -45,7 +49,8 @@ # tags supported inside apt-gateway.yml: # # -- import_tasks: apt-gateway.yml +- name: (main.yml) Import apt-gateway.yml tasks + ansible.builtin.import_tasks: apt-gateway.yml when: inventory_hostname in groups['gateway_server'] tags: - apt @@ -55,7 +60,8 @@ # yum-update # yum-base-install # yum-initial-install -- import_tasks: yum.yml +- name: (main.yml) Import yum.yml tasks + ansible.builtin.import_tasks: yum.yml when: - ansible_facts.os_family == "RedHat" - ansible_facts.distribution == "CentOS" or ansible_facts.distribution == "Fedora" @@ -66,14 +72,16 @@ # apt-caching-nameserver # yum-caching-nameserver # -- import_tasks: caching-nameserver.yml +- name: (main.yml) Import caching-nameserver.yml tasks + ansible.builtin.import_tasks: caching-nameserver.yml when: groups['caching_nameserver']|string is search(inventory_hostname) tags: caching-nameserver # tags supported inside systemd-resolved.yml # # systemd-resolved -- import_tasks: systemd-resolved.yml +- name: (main.yml) Import systemd-resolved.yml tasks + ansible.builtin.import_tasks: systemd-resolved.yml tags: - systemd-resolved when: @@ -81,14 +89,16 @@ - ansible_facts['distribution_major_version'] > "11" - systemd_resolved is defined and systemd_resolved|bool -- import_tasks: tor.yml +- name: (main.yml) Import tor.yml tasks + ansible.builtin.import_tasks: tor.yml when: - inventory_hostname in groups['mail_server'] - ansible_facts['distribution'] == "Debian" tags: - tor-service -- import_tasks: cron.yml +- name: (main.yml) Import cron.yml tasks + ansible.builtin.import_tasks: cron.yml tags: - cron @@ -97,7 +107,8 @@ # vim-config # zsh-config # -- import_tasks: shell.yml +- name: (main.yml) Import shell.yml tasks + ansible.builtin.import_tasks: shell.yml when: - ansible_facts['distribution'] == "Debian" tags: @@ -115,7 +126,8 @@ # keypair-backup-server # root-defaut-ssh-keypair # insert_root_ssh_public_key -- import_tasks: users.yml +- name: (main.yml) Import users.yml tasks + ansible.builtin.import_tasks: users.yml tags: - users @@ -124,7 +136,8 @@ # bash # profile # vim -- import_tasks: users-systemfiles.yml +- name: (main.yml) Import users-systemfiles.yml tasks + ansible.builtin.import_tasks: users-systemfiles.yml tags: - users - users-systemfiles @@ -137,7 +150,8 @@ # sudo-users # webadmin-defaut-ssh-keypair # insert_webadmin_ssh_public_key -- import_tasks: webadmin-user.yml +- name: (main.yml) Import webadmin-user.yml tasks + ansible.builtin.import_tasks: webadmin-user.yml when: groups['webadmin']|string is search(inventory_hostname) tags: - users @@ -147,7 +161,8 @@ # tags supported inside sshd.yml # # sshd-config -- import_tasks: sshd.yml +- name: (main.yml) Import sshd.yml tasks + ansible.builtin.import_tasks: sshd.yml tags: sshd # tags supported inside sudoers.yml: @@ -155,16 +170,19 @@ # sudoers-remove # sudoers-file-configuration # sudoers-global-configuration -- import_tasks: sudoers.yml +- name: (main.yml) Import sudoers.yml tasks + ansible.builtin.import_tasks: sudoers.yml tags: sudoers -- import_tasks: motd.yml +- name: (main.yml) Import motd.yml tasks + ansible.builtin.import_tasks: motd.yml tags: motd # tags supported inside ntp.yml: # # ntp-server -- import_tasks: ntp.yml +- name: (main.yml) Import ntp.yml tasks + ansible.builtin.import_tasks: ntp.yml tags: - ntp when: @@ -189,21 +207,24 @@ # git-mailservers-repositories # git-sympa-repositories # git-other-repositories -- import_tasks: git.yml +- name: (main.yml) Import git.yml tasks + ansible.builtin.import_tasks: git.yml tags: git # tags supported inside nfs.yml: # # nfs-server # nfs-client -- import_tasks: nfs.yml +- name: (main.yml) Import nfs.yml tasks + ansible.builtin.import_tasks: nfs.yml tags: - nfs # tags supported inside x2go-server.yml: # # x2go-server -- import_tasks: x2go-server.yml +- name: (main.yml) Import x2go-server.yml tasks + ansible.builtin.import_tasks: x2go-server.yml when: inventory_hostname in groups['x2go_server'] tags: - x2go @@ -213,20 +234,23 @@ # copy-files # copy-plain-files # copy-template-files -- import_tasks: copy_files.yml +- name: (main.yml) Import copy_files.yml tasks + ansible.builtin.import_tasks: copy_files.yml tags: - copy-files # tags supported inside symlink_files.yml: # # symlink-files -- import_tasks: symlink_files.yml +- name: (main.yml) Import symlink_files.yml tasks + ansible.builtin.import_tasks: symlink_files.yml tags: - symlink-files # tags supported inside config_files_mailsystem_scripts.yml: # -- import_tasks: config_files_mailsystem_scripts.yml +- name: (main.yml) Import config_files_mailsystem_scripts.yml tasks + ansible.builtin.import_tasks: config_files_mailsystem_scripts.yml tags: - config-files-mailsystem @@ -236,7 +260,8 @@ # samba-user # system-user # -- import_tasks: samba-user.yml +- name: (main.yml) Import samba-user.yml tasks + ansible.builtin.import_tasks: samba-user.yml when: inventory_hostname in groups['samba_server'] tags: - samba-server @@ -248,7 +273,8 @@ # samba-server # samba-cron # -- import_tasks: samba-config-server.yml +- name: (main.yml) Import samba-config-server.yml tasks + ansible.builtin.import_tasks: samba-config-server.yml when: inventory_hostname in groups['samba_server'] tags: - samba-server @@ -259,37 +285,43 @@ # samba-user # system-user # -- import_tasks: samba-remove-user.yml +- name: (main.yml) Import samba-remove-user.yml tasks + ansible.builtin.import_tasks: samba-remove-user.yml when: inventory_hostname in groups['samba_server'] tags: - samba-server - remove-samba-user -- import_tasks: redis-server.yml +- name: (main.yml) Import redis-server.yml tasks + ansible.builtin.import_tasks: redis-server.yml when: inventory_hostname in groups['nextcloud_server'] or inventory_hostname in groups['apache2_webserver'] or inventory_hostname in groups['nginx_webserver'] tags: - redis-server -- import_tasks: mysql.yml +- name: (main.yml) Import mysql.yml tasks + ansible.builtin.import_tasks: mysql.yml when: groups['mysql_server']|string is search(inventory_hostname) tags: - mysql - mariadb -- import_tasks: apache2.yml +- name: (main.yml) Import apache2.yml tasks + ansible.builtin.import_tasks: apache2.yml when: groups['apache2_webserver']|string is search(inventory_hostname) tags: - apache2 -- import_tasks: systemd-services_debian_based_OS.yml +- name: (main.yml) Import systemd-services_debian_based_OS.yml tasks + ansible.builtin.import_tasks: systemd-services_debian_based_OS.yml when: - ansible_facts.os_family == "Debian" tags: - services -- import_tasks: systemd-services_redhat_based_OS.yml +- name: (main.yml) Import systemd-services_redhat_based_OS.yml tasks + ansible.builtin.import_tasks: systemd-services_redhat_based_OS.yml when: - ansible_facts.os_family == "RedHat" tags: diff --git a/roles/common/tasks/motd.yml b/roles/common/tasks/motd.yml index 0a49422..1edb4f0 100644 --- a/roles/common/tasks/motd.yml +++ b/roles/common/tasks/motd.yml @@ -1,26 +1,24 @@ --- - # ---------- # /etc/motd # ---------- - name: (motd.yml) Check if /etc/motd.ORIG exist - stat: + ansible.builtin.stat: path: /etc/motd.ORIG register: motd_orig_exist - name: (motd.yml) Check if /etc/motd exist - stat: + ansible.builtin.stat: path: /etc/motd register: motd_exist - - name: (motd.yml) Backup existing file /etc/motd - command: cp -a /etc/motd /etc/motd.ORIG - when: - - motd_exist.stat.exists == True - - motd_orig_exist.stat.exists == False + ansible.builtin.command: cp -a /etc/motd /etc/motd.ORIG + when: + - motd_exist.stat.exists == True + - motd_orig_exist.stat.exists == False - name: (motd.yml) create /etc/motd - shell: figlet {{ ansible_hostname }} > /etc/motd + ansible.builtin.shell: figlet {{ ansible_hostname }} > /etc/motd when: motd_orig_exist.stat.exists == False diff --git a/roles/common/tasks/mysql.yml b/roles/common/tasks/mysql.yml index e566805..bf5b644 100644 --- a/roles/common/tasks/mysql.yml +++ b/roles/common/tasks/mysql.yml @@ -1,5 +1,4 @@ --- - # --- # MySQL / MariaDB Server # --- @@ -7,31 +6,28 @@ - name: Populate service facts ansible.builtin.service_facts: -#- name: Print service facts +# - name: Print service facts # ansible.builtin.debug: # var: ansible_facts.services # when: # - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' - - - name: (mysql.yml) Ensure directory '/etc/systemd/system/mariadb.service.d' is present - file: + ansible.builtin.file: path: /etc/systemd/system/mariadb.service.d state: directory owner: root group: root - mode: '0755' + mode: "0755" when: - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' - - name: (mysql.yml) Ensure file '/etc/systemd/system/mariadb.service.d/limits.conf' exists - copy: - src: 'etc/systemd/system/mariadb.service.d/limits.conf' - dest: '/etc/systemd/system/mariadb.service.d/limits.conf' + ansible.builtin.copy: + src: "etc/systemd/system/mariadb.service.d/limits.conf" + dest: "/etc/systemd/system/mariadb.service.d/limits.conf" owner: root group: root - mode: '0644' + mode: "0644" notify: "Restart mariadb" when: - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' diff --git a/roles/common/tasks/nfs.yml b/roles/common/tasks/nfs.yml index a5672e9..a190f55 100644 --- a/roles/common/tasks/nfs.yml +++ b/roles/common/tasks/nfs.yml @@ -1,11 +1,10 @@ --- - # --- # NFS Server # --- - name: (nfs.yml) Ensure NFS utilities (server) are installed. - apt: + ansible.builtin.apt: name: - nfs-common - nfs-kernel-server @@ -17,27 +16,27 @@ - nfs-server - name: (nfs.yml) Ensure directories to export exist - file: + ansible.builtin.file: path: '{{ item.src.split(":")[1] }}' owner: root group: root - mode: '0755' + mode: "0755" state: directory with_items: "{{ nfs_exports }}" loop_control: - label: '{{ item.path }}' + label: "{{ item.path }}" when: - "groups['nfs_server']|string is search(inventory_hostname)" tags: - nfs-server - name: (nfs.yml) Copy exports file. - template: + ansible.builtin.template: src: etc/exports.j2 dest: /etc/exports owner: root group: root - mode: 0644 + mode: "0644" when: - "groups['nfs_server']|string is search(inventory_hostname)" notify: Reload nfs @@ -45,15 +44,15 @@ - nfs-server - name: Enable service rpc-statd and ensure it is not masked - systemd: + ansible.builtin.systemd: name: rpc-statd - enabled: yes - masked: no + enabled: true + masked: false when: - "groups['nfs_server']|string is search(inventory_hostname)" - name: Make sure service rpc-statd is running - systemd: + ansible.builtin.systemd: state: started name: rpc-statd when: @@ -66,7 +65,7 @@ # --- - name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/default/nfs-kernel-server register: default_nfs_kernel_server_exists when: @@ -75,7 +74,7 @@ - nfs-server - name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server - command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG + ansible.builtin.command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG when: - "groups['nfs_server']|string is search(inventory_hostname)" - default_nfs_kernel_server_exists.stat.exists == False @@ -83,9 +82,9 @@ - nfs-server - name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server) - replace: + ansible.builtin.replace: path: /etc/default/nfs-kernel-server - regexp: '^RPCNFSDCOUNT=.*' + regexp: "^RPCNFSDCOUNT=.*" replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}" when: - "groups['nfs_server']|string is search(inventory_hostname)" @@ -97,10 +96,10 @@ # --- - name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists - file: + ansible.builtin.file: path: /etc/nfs.conf.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -108,30 +107,28 @@ tags: - nfs-server - - name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2' - template: + ansible.builtin.template: src: etc/nfs.conf.d/20-start_servers.conf.j2 dest: /etc/nfs.conf.d/20-start_servers.conf owner: root group: root - mode: 0644 + mode: "0644" notify: "Restart nfs-kernel-server" when: - inventory_hostname in groups['nfs_server'] tags: - nfs-server - # --- # NFS clients # --- - name: (nfs.yml) Ensure NFS utilities (clients) are installed. - apt: + ansible.builtin.apt: pkg: nfs-common state: present - when: + when: - ansible_facts['os_family'] == "Debian" - "groups['nfs_client']|string is search(inventory_hostname)" tags: @@ -148,11 +145,8 @@ state: mounted loop: "{{ nfs_exports }}" loop_control: - label: '{{ item.src }}' + label: "{{ item.src }}" when: - "groups['nfs_client']|string is search(inventory_hostname)" tags: - nfs-client - - - diff --git a/roles/common/tasks/ntp.yml b/roles/common/tasks/ntp.yml index 31bd749..a5f995e 100644 --- a/roles/common/tasks/ntp.yml +++ b/roles/common/tasks/ntp.yml @@ -1,11 +1,10 @@ --- - # --- # NTP Server # --- - name: (ntp.yml) Ensure ntpsec package is installed. - apt: + ansible.builtin.apt: name: - ntpsec state: present @@ -15,7 +14,7 @@ - ntp-server - name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/ntpsec/ntp.conf.ORIG register: etc_ntpsec_conf_ORIG when: @@ -23,20 +22,18 @@ tags: - ntp-server - - name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present - file: + ansible.builtin.file: path: /var/log/ntpsec state: directory owner: ntpsec group: ntpsec - mode: '0755' + mode: "0755" when: - ansible_facts.distribution == "Debian" - - name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf' - command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG + ansible.builtin.command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG when: - groups['oopen_office_server']|string is search(inventory_hostname) - etc_ntpsec_conf_ORIG.stat.exists == False @@ -45,16 +42,15 @@ - ntp-server - name: (ntp.yml) Update '/etc/ntpsec/ntp.conf' - template: + ansible.builtin.template: src: "etc/ntpsec/ntp.conf.j2" dest: /etc/ntpsec/ntp.conf owner: root group: root - mode: 0644 + mode: "0644" notify: Restart ntp when: - groups['oopen_office_server']|string is search(inventory_hostname) - local_ntp_service is defined and local_ntp_service|bool tags: - ntp-server - diff --git a/roles/common/tasks/redis-server.yml b/roles/common/tasks/redis-server.yml index e460584..72ace21 100644 --- a/roles/common/tasks/redis-server.yml +++ b/roles/common/tasks/redis-server.yml @@ -1,12 +1,11 @@ --- - - name: (redis-server.yml) Set var '_redis_conf' - set_fact: - _redis_conf: "{{ '/etc/redis.conf' if ansible_facts['distribution'] == 'CentOS' else '/etc/redis/redis.conf' }}" + ansible.builtin.set_fact: + _redis_conf: "{{ '/etc/redis.conf' if ansible_facts['distribution'] == 'CentOS' else '/etc/redis/redis.conf' }}" - name: (redis-server.yml) update - apt: + ansible.builtin.apt: update_cache: true cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" when: @@ -26,9 +25,8 @@ tags: - redis-server - - name: (redis-server.yml) upgrade - apt: + ansible.builtin.apt: upgrade: "{{ apt_upgrade_type }}" update_cache: true dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" @@ -38,9 +36,8 @@ tags: - redis-server - - name: (redis-server.yml) Install redis-server packages (debian system) - apt: + ansible.builtin.apt: name: redis-server state: present when: @@ -49,10 +46,10 @@ - redis-server - name: (redis-server.yml) Install redis packages (centos / fedora system) - yum: + ansible.builtin.dnf: name: redis state: latest - update_cache: yes + update_cache: true when: - ansible_facts["os_family"] == "RedHat" - ansible_distribution == "CentOS" or ansible_distribution == "Fedora" @@ -60,72 +57,72 @@ - redis-server - name: (redis-server.yml) Determine available users - getent: + ansible.builtin.getent: database: passwd tags: - redis-server - name: (redis-server.yml) Determine available groups - getent: + ansible.builtin.getent: database: group tags: - redis-server - name: (redis-server.yml) Add user 'www-data' to group 'redis' - user: + ansible.builtin.user: name: www-data groups: redis - append: yes + append: true when: - "'www-data' in my_users" - "'redis' in my_groups" vars: - my_users: "{{ ansible_facts.getent_passwd.keys()|list }}" - my_groups: "{{ ansible_facts.getent_group.keys()|list }}" + my_users: "{{ ansible_facts.getent_passwd.keys() | list }}" + my_groups: "{{ ansible_facts.getent_group.keys() | list }}" tags: - redis-server - name: (redis-server.yml) Add user 'webadmin' to group 'redis' - user: + ansible.builtin.user: name: webadmin groups: redis - append: yes + append: true when: - "'webadmin' in my_users" - "'redis' in my_groups" vars: - my_users: "{{ ansible_facts.getent_passwd.keys()|list }}" - my_groups: "{{ ansible_facts.getent_group.keys()|list }}" + my_users: "{{ ansible_facts.getent_passwd.keys() | list }}" + my_groups: "{{ ansible_facts.getent_group.keys() | list }}" tags: - redis-server - name: (redis-server.yml) Check if redis configuration file exists - stat: + ansible.builtin.stat: path: "{{ _redis_conf }}.ORIG" register: redis_conf_exists tags: - redis-server - name: (redis-server.yml) Backup existing redis configuration file. - command: cp -a "{{ _redis_conf }}" "{{ _redis_conf }}".ORIG + ansible.builtin.command: cp -a "{{ _redis_conf }}" "{{ _redis_conf }}".ORIG when: - redis_conf_exists.stat.exists == False tags: - redis-server -- name: (redis-server.yml) adjust redis configuration - lineinfile: +- name: (redis-server.yml) adjust redis configuration + ansible.builtin.lineinfile: dest: "{{ _redis_conf }}" regexp: "{{ item.regexp }}" insertafter: "{{ item.insertafter }}" line: "{{ item.key }} {{ item.val }}" state: present loop: - - { regexp: '^bind\s+', key: 'bind', val: '127.0.0.1 ::1', insertafter: '^#\s*bind\s+' } - - { regexp: '^port\s+', key: 'port', val: '6379', insertafter: '^#\s*port\s+' } - - { regexp: '^unixsocket\s+', key: 'unixsocket', val: '/run/redis/redis-server.sock', insertafter: '^#\s*unixsocketperm' } - - { regexp: '^unixsocketperm', key: 'unixsocketperm', val: '770', insertafter: '^unixsocket\s+' } - - { regexp: '^logfile', key: 'logfile', val: '/var/log/redis/redis-server.log', insertafter: '^#\s+logfile\s+' } + - { regexp: "^bind\\s+", key: "bind", val: "127.0.0.1 ::1", insertafter: "^#\\s*bind\\s+" } + - { regexp: "^port\\s+", key: "port", val: "6379", insertafter: "^#\\s*port\\s+" } + - { regexp: "^unixsocket\\s+", key: "unixsocket", val: "/run/redis/redis-server.sock", insertafter: "^#\\s*unixsocketperm" } + - { regexp: "^unixsocketperm", key: "unixsocketperm", val: "770", insertafter: "^unixsocket\\s+" } + - { regexp: "^logfile", key: "logfile", val: "/var/log/redis/redis-server.log", insertafter: "^#\\s+logfile\\s+" } notify: "Restart redis-server" tags: - redis-server diff --git a/roles/common/tasks/samba-config-server.yml b/roles/common/tasks/samba-config-server.yml index b1c35dc..b63076f 100644 --- a/roles/common/tasks/samba-config-server.yml +++ b/roles/common/tasks/samba-config-server.yml @@ -4,7 +4,7 @@ # --- - name: (samba-config-server.yml) Ensure samba packages server are installed. - package: + ansible.builtin.package: pkg: "{{ apt_install_server_samba }}" state: present when: @@ -13,7 +13,7 @@ - samba-server - name: (samba-config-server.yml) Ensure quarantine directory exists - file: + ansible.builtin.file: path: /data/samba/QUARANTINE owner: root group: root @@ -27,13 +27,13 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure samba share directories exists - file: + ansible.builtin.file: path: "{{ item.path }}" owner: "root" group: "{{ item.group_write_list | default('root', true) }}" mode: "{{ item.dir_create_mask | default('2770', true) }}" state: directory - recurse: no + recurse: false with_items: "{{ samba_shares }}" loop_control: label: "{{ item.name }}" @@ -47,7 +47,7 @@ # --- - name: (samba-config-server.yml) Ensure virusfilter (ClamAV) packages are installed - package: + ansible.builtin.package: pkg: "{{ apt_install_server_samba_virusfilter }}" state: present when: @@ -58,7 +58,7 @@ - samba-virusfilter - name: (samba-config-server.yml) Check if ClamAV virus databases are present - find: + ansible.builtin.find: paths: /var/lib/clamav patterns: - "*.cvd" @@ -72,7 +72,7 @@ - samba-virusfilter - name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download - service: + ansible.builtin.service: name: clamav-freshclam state: stopped failed_when: false @@ -85,10 +85,10 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update - service: + ansible.builtin.service: name: clamav-daemon state: started - enabled: yes + enabled: true failed_when: false when: - inventory_hostname in groups['samba_server'] @@ -98,7 +98,7 @@ - samba-virusfilter - name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam - command: freshclam + ansible.builtin.command: freshclam when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 @@ -108,10 +108,10 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started - service: + ansible.builtin.service: name: clamav-daemon state: started - enabled: yes + enabled: true when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 @@ -120,10 +120,10 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started - service: + ansible.builtin.service: name: clamav-freshclam state: started - enabled: yes + enabled: true when: - inventory_hostname in groups['samba_server'] - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 @@ -132,27 +132,26 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav user is member of all Samba groups - user: + ansible.builtin.user: name: clamav groups: "{{ item.name }}" - append: yes + append: true loop: "{{ samba_groups }}" loop_control: label: "{{ item.name }}" when: - inventory_hostname in groups['samba_server'] - - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | - selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 + - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_groups | length > 0 tags: - samba-server - samba-virusfilter - name: (samba-config-server.yml) Ensure clamav user is member of all Samba user groups (homes virusfilter) - user: + ansible.builtin.user: name: clamav groups: "{{ item.name }}" - append: yes + append: true loop: "{{ samba_user }}" loop_control: label: "{{ item.name }}" @@ -181,7 +180,7 @@ - samba-virusfilter - name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter) - file: + ansible.builtin.file: path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}" mode: "0750" state: directory @@ -196,27 +195,25 @@ - samba-server - samba-virusfilter - - name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths) - template: + ansible.builtin.template: src: etc/apparmor.d/local/usr.sbin.clamd.j2 dest: /etc/apparmor.d/local/usr.sbin.clamd owner: root group: root mode: "0644" - notify: + notify: - Reload AppArmor profile clamd - Restart clamav-daemon when: - inventory_hostname in groups['samba_server'] - - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | - selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 + - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 tags: - samba-server - samba-virusfilter - name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf - lineinfile: + ansible.builtin.lineinfile: path: /etc/clamav/clamd.conf regexp: "^#?\\s*AllowAllMatchScan\\s" line: "AllowAllMatchScan true" @@ -224,8 +221,7 @@ notify: Restart clamav-daemon when: - inventory_hostname in groups['samba_server'] - - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | - selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 + - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 tags: - samba-server - samba-virusfilter @@ -235,7 +231,7 @@ # --- - name: (samba-config-server.yml) Check if file '/etc/samba/smb.conf.ORIG exists' - stat: + ansible.builtin.stat: path: /etc/samba/smb.conf.ORIG register: smb_conf_exists when: @@ -244,7 +240,7 @@ - samba-server - name: (samba-config-server.yml) Backup existing file /etc/samba/smb.conf - command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG + ansible.builtin.command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG when: - inventory_hostname in groups['samba_server'] - smb_conf_exists.stat.exists == False @@ -252,12 +248,12 @@ - samba-server - name: (samba-config-server.yml) /etc/samba/smb.conf - template: + ansible.builtin.template: dest: /etc/samba/smb.conf src: etc/samba/smb.conf.j2 owner: root group: root - mode: 0644 + mode: "0644" when: - inventory_hostname in groups['samba_server'] notify: @@ -267,12 +263,12 @@ - samba-server - name: (samba-config-server.yml) Ensure file /etc/samba/users.map exists - copy: + ansible.builtin.copy: src: "{{ role_path + '/files/etc/samba/users.map' }}" dest: /etc/samba/users.map owner: root group: root - mode: 0644 + mode: "0644" when: - inventory_hostname in groups['samba_server'] notify: @@ -296,7 +292,7 @@ - samba-cron - name: (samba-config-server.yml) Adjust configuration for script 'clean_samba_trash.sh' - template: + ansible.builtin.template: dest: /root/bin/samba/conf/clean_samba_trash.conf src: root/bin/samba/conf/clean_samba_trash.conf.j2 when: diff --git a/roles/common/tasks/samba-remove-user.yml b/roles/common/tasks/samba-remove-user.yml index fe0c6bd..98a0c1f 100644 --- a/roles/common/tasks/samba-remove-user.yml +++ b/roles/common/tasks/samba-remove-user.yml @@ -1,59 +1,53 @@ --- - # --- # - Remove unwanted users # --- - - - - name: "(samba-remove-user.yml) Check if samba user exists for removable system user" - shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -q '{{ item.name }}' + ansible.builtin.shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -q '{{ item.name }}' register: samba_remove_system_users_present changed_when: "samba_remove_system_users_present.rc == 0" failed_when: "samba_remove_system_users_present.rc > 1" - with_items: + with_items: - "{{ remove_samba_users }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - system-user - samba-user - - name: (samba-remove-user.yml) Remove (old) system users from samba - shell: > + ansible.builtin.shell: > smbpasswd -s -x {{ item.item.name }} - with_items: + with_items: - "{{ samba_remove_system_users_present.results }}" loop_control: - label: '{{ item.item.name }}' - when: + label: "{{ item.item.name }}" + when: - item.changed tags: - system-user - samba-user - name: (samba-remove-user.yml) Remove users from system - user: - name: '{{ item.name }}' + ansible.builtin.user: + name: "{{ item.name }}" state: absent with_items: - "{{ remove_samba_users }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - system-user - samba-user - name: (samba-remove-user.yml) Remove home directory from deleted users - file: + ansible.builtin.file: path: "{{ base_home | default('/home', true) }}/{{ item.name }}" state: absent with_items: - "{{ remove_samba_users }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - system-user - samba-user - diff --git a/roles/common/tasks/samba-user.yml b/roles/common/tasks/samba-user.yml index 56eb5c5..28ff912 100644 --- a/roles/common/tasks/samba-user.yml +++ b/roles/common/tasks/samba-user.yml @@ -1,5 +1,4 @@ --- - # --- # - default user/groups # --- @@ -7,13 +6,13 @@ # To be precise, samba groups are system groups. # - name: (samba-user.yml) Ensure samba groups exists - group: - name: '{{ item.name }}' + ansible.builtin.group: + name: "{{ item.name }}" state: present - gid: '{{ item.group_id | default(omit) }}' + gid: "{{ item.group_id | default(omit) }}" loop: "{{ samba_groups }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: item.group_id is defined tags: - samba-server @@ -26,21 +25,20 @@ # the result ist avalable in variable getent_passwd # - name: (samba_user.yml) Get database of (system) users - getent: + ansible.builtin.getent: database: passwd tags: - samba-server - samba-user - system-user - # Samba users mut be also system users # - name: (samba_user.yml) Add (system) users if not yet exists.. - shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" + ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" loop: "{{ samba_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: - ansible_facts.getent_passwd is defined - item.name not in ansible_facts.getent_passwd @@ -50,57 +48,54 @@ - system-user - name: (samba_user.yml) Ensure samba users exists in system with given group membership - user: - name: '{{ item.name }}' + ansible.builtin.user: + name: "{{ item.name }}" state: present - uid: '{{ item.user_id | default(omit) }}' + uid: "{{ item.user_id | default(omit) }}" #group: '{{ item.0.name | default(omit) }}' - groups: "{{ item.groups|join(', ') }}" + groups: "{{ item.groups | join(', ') }}" password: "{{ item.password | password_hash('sha512') }}" update_password: on_create - append: yes + append: true loop: "{{ samba_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - samba-server - samba-user - system-user - name: (samba-user.yml) Check if samba user exists - shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}" + ansible.builtin.shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}" register: samba_user_present changed_when: "samba_user_present.rc == 1" failed_when: "samba_user_present.rc > 1" loop: "{{ samba_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - samba-server - samba-user - name: (samba-user.yml) Add user to samba (with system users password) - shell: > - (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') - | smbpasswd -s -a {{ item.item.name }} + ansible.builtin.shell: > + (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') | smbpasswd -s -a {{ item.item.name }} loop: "{{ samba_user_present.results }}" when: item.changed loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" tags: - samba-server - samba-user - - # Only on fileservers: # zapata.opp.netz - name: (samba_user.yml) Check if folder '/data/backup' exists using file module - stat: + ansible.builtin.stat: path: /data/backup register: data_backup_dir - when: + when: - inventory_hostname == 'zapata.opp.netz' tags: - samba-server @@ -108,16 +103,16 @@ - system-user - name: (samba_user.yml) Ensure folder /data/backup/ exists for all (samba) users on host zapata - file: - path: '/data/backup/{{ item.name }}' + ansible.builtin.file: + path: "/data/backup/{{ item.name }}" state: directory - owner: '{{ item.name }}' - group: '{{ item.name }}' + owner: "{{ item.name }}" + group: "{{ item.name }}" mode: "2770" loop: "{{ samba_user }}" loop_control: - label: '{{ item.name }}' - when: + label: "{{ item.name }}" + when: - inventory_hostname == 'zapata.opp.netz' - data_backup_dir.stat.isdir is defined and data_backup_dir.stat.isdir tags: diff --git a/roles/common/tasks/shell.yml b/roles/common/tasks/shell.yml index 6129b62..1c96fcb 100644 --- a/roles/common/tasks/shell.yml +++ b/roles/common/tasks/shell.yml @@ -1,30 +1,28 @@ --- - - name: (shell.yml) Set default VIM configuration - file /etc/vim/vimrc exists - copy: + ansible.builtin.copy: src: "{{ item }}" dest: /etc/vim/vimrc owner: root group: root - mode: '0644' + mode: "0644" with_fileglob: "etc/vim/vimrc" tags: - shell-config - vim-config - name: (shell.yml) Set default VIM configuration - file /etc/vim/vimrc.local exists - copy: + ansible.builtin.copy: src: "{{ item }}" dest: /etc/vim/vimrc.local owner: root group: root - mode: '0644' + mode: "0644" with_fileglob: "etc/vim/vimrc.local" tags: - shell-config - vim-config - #- name: (shell.yml) Set default ZSH configuration - file /etc/zsh/zshrc # copy: # src: "{{ item }}" diff --git a/roles/common/tasks/show.yml b/roles/common/tasks/show.yml index 9821dbb..8821746 100644 --- a/roles/common/tasks/show.yml +++ b/roles/common/tasks/show.yml @@ -1,7 +1,6 @@ --- - - name: Show hostname - debug: - msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] }}.{{ ansible_facts.fqdn.split('.')[1] | default('NONE') }}.{{ ansible_facts.fqdn.split('.')[2] | default('NONE') }}" + ansible.builtin.debug: + msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] }}.{{ ansible_facts.fqdn.split('.')[1] | default('NONE') }}.{{ + ansible_facts.fqdn.split('.')[2] | default('NONE') }}" # msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] | join( '.') }} | {{ join ( ansible_facts.fqdn.split('.')[1] ) }}" - diff --git a/roles/common/tasks/sshd.yml b/roles/common/tasks/sshd.yml index dcec2b7..e1c984a 100644 --- a/roles/common/tasks/sshd.yml +++ b/roles/common/tasks/sshd.yml @@ -1,53 +1,51 @@ --- - - # --- # Set some facts # --- - name: (sshd.yml) Set fact_sshd_pubkey_accepted_algorithms (comma separated list) - set_fact: - fact_sshd_pubkey_accepted_algorithms: "{{ sshd_pubkey_accepted_algorithms | join (',') }}" + ansible.builtin.set_fact: + fact_sshd_pubkey_accepted_algorithms: "{{ sshd_pubkey_accepted_algorithms | join(',') }}" when: - sshd_pubkey_accepted_algorithms is defined and sshd_pubkey_accepted_algorithms | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list) - set_fact: - fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}" + ansible.builtin.set_fact: + fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}" when: - sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_ciphers (comma separated list) - set_fact: - fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}" + ansible.builtin.set_fact: + fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}" when: - sshd_ciphers is defined and sshd_ciphers | length > 0 tags: - sshd-config -- name: (sshd.yml) Set fact_sshd_macs - set_fact: - fact_sshd_macs: "{{ sshd_macs | join (',') }}" +- name: (sshd.yml) Set fact_sshd_macs + ansible.builtin.set_fact: + fact_sshd_macs: "{{ sshd_macs | join(',') }}" when: - sshd_macs is defined and sshd_macs | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list) - set_fact: - fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}" + ansible.builtin.set_fact: + fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}" when: - sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0 tags: - sshd-config - name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list) - set_fact: - fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}" + ansible.builtin.set_fact: + fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}" when: - sshd_allowed_users is defined and sshd_allowed_users | length > 0 tags: @@ -58,27 +56,26 @@ # --- - name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists - stat: + ansible.builtin.stat: path: /etc/ssh/sshd_config.ORIG register: etc_sshd_sshd_config_ORIG tags: - sshd-config - name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config' - command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG + ansible.builtin.command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG when: etc_sshd_sshd_config_ORIG.stat.exists == False tags: - sshd-config - - name: (sshd.yml) Create new sshd_config from template sshd_config.j2 - template: + ansible.builtin.template: src: etc/ssh/sshd_config.j2 dest: /etc/ssh/sshd_config owner: root group: root - mode: 0644 - validate: 'sshd -f %s -T' + mode: "0644" + validate: "sshd -f %s -T" #backup: yes notify: "Restart ssh" when: @@ -86,15 +83,14 @@ tags: - sshd-config - - name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2 - template: + ansible.builtin.template: src: etc/ssh/sshd_config.j2 dest: /etc/ssh/sshd_config owner: root group: root - mode: 0644 - validate: 'sshd -f %s -T' + mode: "0644" + validate: "sshd -f %s -T" notify: "Restart ssh" when: - create_sftp_group is undefined or create_sftp_group is defined and not create_sftp_group @@ -104,13 +100,13 @@ - sshd-config - name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2 - template: + ansible.builtin.template: src: etc/ssh/sshd_config.j2 dest: /etc/ssh/sshd_config owner: root group: root - mode: 0644 - validate: 'sshd -f %s -T -C user=sftp_users' + mode: "0644" + validate: "sshd -f %s -T -C user=sftp_users" notify: "Restart ssh" when: - create_sftp_group is defined and create_sftp_group @@ -119,23 +115,22 @@ tags: - sshd-config - - name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'.. - lineinfile: + ansible.builtin.lineinfile: path: /etc/ssh/sshd_config - regexp: '^Subsystem\s+sftp(.+)$' + regexp: "^Subsystem\\s+sftp(.+)$" state: absent - check_mode: yes + check_mode: true changed_when: false register: sshd_config_sftp tags: - sshd-config - name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists - file: + ansible.builtin.file: path: /etc/ssh/sshd_config.d state: directory - mode: 0755 + mode: "0755" group: root owner: root when: @@ -145,12 +140,12 @@ - sshd-config - name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2 - template: + ansible.builtin.template: src: etc/ssh/sshd_config.j2 dest: /etc/ssh/sshd_config.d/50-sshd-local.conf owner: root group: root - mode: 0644 + mode: "0644" notify: "Restart ssh" when: - ansible_facts['distribution'] == "Debian" diff --git a/roles/common/tasks/sudoers.yml b/roles/common/tasks/sudoers.yml index dfabfed..5b6cd26 100644 --- a/roles/common/tasks/sudoers.yml +++ b/roles/common/tasks/sudoers.yml @@ -1,6 +1,5 @@ --- - -#- name: (sudoers.yml) include variables +# - name: (sudoers.yml) include variables # include_vars: "{{ item }}" # with_first_found: # - "sudoers-{{ inventory_hostname }}.yml" @@ -11,28 +10,28 @@ # - sudoers-remove # - sudoers-file-configuration # - sudoers-global-configuration - + - name: (sudoers.yml) Remove user entries in file /etc/sudoers - lineinfile: + ansible.builtin.lineinfile: dest: /etc/sudoers state: absent - regexp: '^{{ item }}' + regexp: "^{{ item }}" owner: root group: root - mode: 0440 + mode: "0440" validate: visudo -cf %s - with_items: '{{ sudoers_remove_user }}' + with_items: "{{ sudoers_remove_user }}" tags: - sudoers-remove - name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/) - template: + ansible.builtin.template: src: etc/sudoers.d/50-user.j2 dest: /etc/sudoers.d/50-user #validate: visudo -cf %s owner: root group: root - mode: 0440 + mode: "0440" tags: - sudoers-file-configuration @@ -48,10 +47,10 @@ # - sudoers-global-configuration - name: (sudoers.yml) Ensure all sudo_users are in sudo group - user: + ansible.builtin.user: name: "{{ item }}" groups: sudo - append: yes + append: true with_items: "{{ sudo_users }}" tags: - sudo-users diff --git a/roles/common/tasks/symlink_files.yml b/roles/common/tasks/symlink_files.yml index 4dc4567..af3ba11 100644 --- a/roles/common/tasks/symlink_files.yml +++ b/roles/common/tasks/symlink_files.yml @@ -1,16 +1,15 @@ --- - - name: (symlink_files.yml) Symlink files - file: - src: '{{ item.src_path }}' - dest: '{{ item.dest_path }}' + ansible.builtin.file: + src: "{{ item.src_path }}" + dest: "{{ item.dest_path }}" owner: root group: root state: link loop: "{{ symlink_files }}" loop_control: - label: 'dest: {{ item.name }}' - when: + label: "dest: {{ item.name }}" + when: - symlink_files is defined - symlink_files|length > 0 tags: diff --git a/roles/common/tasks/systemd-resolved.yml b/roles/common/tasks/systemd-resolved.yml index fc7062b..365dc6b 100644 --- a/roles/common/tasks/systemd-resolved.yml +++ b/roles/common/tasks/systemd-resolved.yml @@ -1,41 +1,38 @@ --- - # --- # Set some facts # --- - name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list) - set_fact: - fact_resolved_nameserver: "{{ resolved_nameserver | join (' ') }}" + ansible.builtin.set_fact: + fact_resolved_nameserver: "{{ resolved_nameserver | join(' ') }}" when: - resolved_nameserver is defined and resolved_nameserver | length > 0 tags: - systemd-resolved - name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list) - set_fact: - fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join (' ') }}" + ansible.builtin.set_fact: + fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join(' ') }}" when: - resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0 tags: - systemd-resolved - name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list) - set_fact: - fact_resolved_domains: "{{ resolved_domains | join (' ') }}" + ansible.builtin.set_fact: + fact_resolved_domains: "{{ resolved_domains | join(' ') }}" when: - resolved_domains is defined and resolved_domains | length > 0 tags: - systemd-resolved - - # --- # Install/Enable systemd-resolved package # --- - name: (systemd-resolved.yml) Ensure systemd-resolved package is installed. - package: + ansible.builtin.package: pkg: systemd-resolved state: present when: @@ -44,7 +41,7 @@ - systemd-resolved - name: (systemd-services.yml) Enable service - systemd: + ansible.builtin.systemd: name: systemd-resolved enabled: true when: @@ -52,31 +49,27 @@ tags: - systemd-resolved - - # --- # Create configuration for systemd-resolved # --- - name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists - file: + ansible.builtin.file: path: /etc/systemd/resolved.conf.d state: directory - mode: 0755 + mode: "0755" group: root owner: root - name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2 - template: + ansible.builtin.template: src: etc/systemd/resolved.conf.d/50-resolved-local.conf dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf owner: root group: root - mode: 0644 + mode: "0644" - name: Restart systemd-resolved service ansible.builtin.service: name: systemd-resolved state: restarted - - diff --git a/roles/common/tasks/systemd-services_debian_based_OS.yml b/roles/common/tasks/systemd-services_debian_based_OS.yml index dc0fa15..80312d2 100644 --- a/roles/common/tasks/systemd-services_debian_based_OS.yml +++ b/roles/common/tasks/systemd-services_debian_based_OS.yml @@ -1,61 +1,58 @@ --- - - name: (systemd-services.yml) Check if Service Exists (Debian based OS) - shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";' + ansible.builtin.shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";' changed_when: "service_exists.rc > 1" failed_when: "service_exists.rc > 1" register: service_exists - with_items: + with_items: - "{{ debian_services_active_and_started }}" #- debug: msg="{{ service_exists.results }}" - name: (systemd-services.yml) Check if Service is disabled (Debian based OS) - shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";' + ansible.builtin.shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";' register: service_is_enabled changed_when: "service_is_enabled.rc == 0" failed_when: "service_is_enabled.rc > 1" - with_items: + with_items: - "{{ service_exists.results }}" loop_control: - label: '{{ item.item }}' - when: - - item.rc == 0 + label: "{{ item.item }}" + when: + - item.rc == 0 #- debug: msg="{{ service_is_enabled.results }}" - name: (systemd-services.yml) Enable service - systemd: + ansible.builtin.systemd: name: "{{ item.item.item }}.service" enabled: true with_items: - "{{ service_is_enabled.results }}" loop_control: - label: '{{ item.item.item }}' + label: "{{ item.item.item }}" when: - item.changed - name: (systemd-services.yml) Check if Service is active - shell: 'systemctl is-active {{ item.item }}.service' + ansible.builtin.command: "systemctl is-active {{ item.item }}.service" register: service_is_active changed_when: 'service_is_active.stdout == "inactive"' - failed_when: 'service_is_active.rc > 3' + failed_when: "service_is_active.rc > 3" with_items: - "{{ service_exists.results }}" loop_control: - label: '{{ item.item }}' + label: "{{ item.item }}" when: - item.rc == 0 - - - name: (systemd-services.yml) Start service - systemd: + ansible.builtin.systemd: name: "{{ item.item.item }}.service" state: started with_items: - "{{ service_is_active.results }}" loop_control: - label: '{{ item.item.item }}' + label: "{{ item.item.item }}" when: - item.changed diff --git a/roles/common/tasks/systemd-services_redhat_based_OS.yml b/roles/common/tasks/systemd-services_redhat_based_OS.yml index 7b4122e..023b40d 100644 --- a/roles/common/tasks/systemd-services_redhat_based_OS.yml +++ b/roles/common/tasks/systemd-services_redhat_based_OS.yml @@ -1,64 +1,61 @@ --- - - name: (systemd-services.yml) Check if Service Exists (RedHat based OS) - shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";' + ansible.builtin.shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";' changed_when: "service_exists.rc > 1" failed_when: "service_exists.rc > 1" register: service_exists - with_items: + with_items: - "{{ redhat_services_active_and_started }}" - when: + when: - ansible_facts.os_family == "RedHat" #- debug: msg="{{ service_exists.results }}" - name: (systemd-services.yml) Check if Service is disabled (RedHat based OS) - shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";' + ansible.builtin.shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";' register: service_is_enabled changed_when: "service_is_enabled.rc == 0" failed_when: "service_is_enabled.rc > 1" - with_items: + with_items: - "{{ service_exists.results }}" loop_control: - label: '{{ item.item }}' - when: - - item.rc == 0 + label: "{{ item.item }}" + when: + - item.rc == 0 - ansible_facts.os_family == "RedHat" #- debug: msg="{{ service_is_enabled.results }}" - name: (systemd-services.yml) Enable service - systemd: + ansible.builtin.systemd: name: "{{ item.item.item }}.service" enabled: true with_items: - "{{ service_is_enabled.results }}" loop_control: - label: '{{ item.item.item }}' + label: "{{ item.item.item }}" when: - item.changed - name: (systemd-services.yml) Check if Service is active - shell: 'systemctl is-active {{ item.item }}.service' + ansible.builtin.command: "systemctl is-active {{ item.item }}.service" register: service_is_active changed_when: 'service_is_active.stdout == "inactive"' - failed_when: 'service_is_active.rc > 3' + failed_when: "service_is_active.rc > 3" with_items: - "{{ service_exists.results }}" loop_control: - label: '{{ item.item }}' + label: "{{ item.item }}" when: - item.rc == 0 - - - name: (systemd-services.yml) Start service - systemd: + ansible.builtin.systemd: name: "{{ item.item.item }}.service" state: started with_items: - "{{ service_is_active.results }}" loop_control: - label: '{{ item.item.item }}' + label: "{{ item.item.item }}" when: - item.changed diff --git a/roles/common/tasks/tor.yml b/roles/common/tasks/tor.yml index 96e7702..bc3759b 100644 --- a/roles/common/tasks/tor.yml +++ b/roles/common/tasks/tor.yml @@ -1,7 +1,6 @@ --- - - name: (tor.yml) Ensure tor is installed. - apt: + ansible.builtin.apt: name: - tor state: present @@ -10,23 +9,21 @@ tags: - tor-service - -- name: (tor.yml) Ensure tor servive is enabled and started - service: +- name: (tor.yml) Ensure tor servive is enabled and started + ansible.builtin.service: name: tor - enabled: yes + enabled: true state: started tags: - tor-service - - name: (tor.yml) Adjust configuration /etc/tor/torrc using template torrc.j2 - template: + ansible.builtin.template: src: etc/tor/torrc.j2 - dest: '{{ torrc_path }}' + dest: "{{ torrc_path }}" owner: root group: root - mode: '0644' + mode: "0644" notify: "Restart tor service" when: - torrc_path is defined diff --git a/roles/common/tasks/users-systemfiles.yml b/roles/common/tasks/users-systemfiles.yml index 5877ee2..2b88fb1 100644 --- a/roles/common/tasks/users-systemfiles.yml +++ b/roles/common/tasks/users-systemfiles.yml @@ -1,42 +1,42 @@ --- - # --- # Check if local template directories exists # --- # default_users - name: (users-systemfiles.yml) Check if local template directory exists for default users - local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }} + ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/{{ item.name }} + delegate_to: localhost with_items: "{{ default_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" register: local_template_dir_default_user # root - name: (users-systemfiles.yml) Check if local template directory exists for root - local_action: stat path={{ inventory_dir }}/files/homedirs/root + ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/root + delegate_to: localhost register: local_template_dir_root - # -- # Copy .bashrc # --- - name: (users-systemfiles.yml) Check if users file '.bashrc.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.bashrc.ORIG" register: bashrc_user_orig_exists loop: "{{ default_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - bash - name: (users-systemfiles.yml) Backup existing users .bashrc file - command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG + ansible.builtin.command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG loop: "{{ bashrc_user_orig_exists.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: item.stat.exists == False tags: - bash @@ -50,7 +50,7 @@ loop: "{{ default_user }}" register: bashrc_stats loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" # 2. Falls vorhanden, Datei kopieren - name: (users-systemfiles.yml) copy .bashrc if it exists @@ -59,7 +59,7 @@ dest: "~{{ user.name }}/.bashrc" owner: "{{ user.name }}" group: "{{ user.name }}" - mode: '0644' + mode: "0644" loop: "{{ default_user | zip(bashrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" @@ -76,20 +76,20 @@ # -- - name: (users-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists - stat: + ansible.builtin.stat: path: /root/.bashrc.ORIG register: bashrc_root_orig_exists tags: - bash - name: (users-systemfiles.yml) Backup /root/.bashrc file - command: cp /root/.bashrc /root/.bashrc.ORIG - when: bashrc_root_orig_exists.stat.exists == False + ansible.builtin.command: cp /root/.bashrc /root/.bashrc.ORIG + when: bashrc_root_orig_exists.stat.exists == False tags: - bash # 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert -- name: stat root _bashrc on control node +- name: Stat root _bashrc on control node ansible.builtin.stat: path: "{{ inventory_dir }}/files/homedirs/root/_bashrc" delegate_to: localhost @@ -97,47 +97,45 @@ register: bashrc_root_stat # 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost -- name: copy root .bashrc if it exists +- name: Copy root .bashrc if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/homedirs/root/_bashrc" dest: /root/.bashrc owner: root group: root - mode: '0644' + mode: "0644" become: true when: bashrc_root_stat.stat.exists tags: - bash - # -- # Copy .profile (Debian System) # --- - name: (users-systemfiles.yml) Check if users file '.profile.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.profile.ORIG" register: profile_user_orig_exists loop: "{{ default_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: - ansible_facts['distribution'] == "Debian" tags: - profile - name: (users-systemfiles.yml) Backup existing users .profile file - command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG + ansible.builtin.command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG loop: "{{ profile_user_orig_exists.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - ansible_facts['distribution'] == "Debian" - item.stat.exists == False tags: - profile - # 1. Prüfen, ob für jeden User ein lokales _profile existiert - name: (users-systemfiles.yml) stat user _profile ansible.builtin.stat: @@ -147,7 +145,7 @@ loop: "{{ default_user }}" register: profile_stats loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" # 2. Falls vorhanden, Datei kopieren - name: (users-systemfiles.yml) copy .profile if it exists @@ -156,7 +154,7 @@ dest: "~{{ user.name }}/.profile" owner: "{{ user.name }}" group: "{{ user.name }}" - mode: '0644' + mode: "0644" loop: "{{ default_user | zip(profile_stats.results) | list }}" loop_control: label: "{{ user.name }}" @@ -173,7 +171,7 @@ # -- - name: (users-systemfiles.yml) Check if file '/root/.profile.ORIG' exists - stat: + ansible.builtin.stat: path: /root/.profile.ORIG register: profile_root_orig_exists when: @@ -182,16 +180,15 @@ - profile - name: (users-systemfiles.yml) Backup existing users .profile file - command: cp -a /root/.profile /root/.profile.ORIG + ansible.builtin.command: cp -a /root/.profile /root/.profile.ORIG when: - ansible_facts['distribution'] == "Debian" - profile_root_orig_exists.stat.exists == False tags: - profile - # 1) Prüfen ob die _profile für root auf dem Control-Node existiert -- name: stat root _profile on control node +- name: Stat root _profile on control node ansible.builtin.stat: path: "{{ inventory_dir }}/files/homedirs/root/_profile" delegate_to: localhost @@ -199,13 +196,13 @@ register: profile_root_stat # 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost -- name: copy root .profile if it exists +- name: Copy root .profile if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/homedirs/root/_profile" dest: /root/.profile owner: root group: root - mode: '0644' + mode: "0644" become: true when: profile_root_stat.stat.exists tags: @@ -216,28 +213,27 @@ # --- - name: (users-systemfiles.yml) Check if users file '.bash_profile.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.bash_profile.ORIG" register: bash_profile_user_orig_exists loop: "{{ default_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: - ansible_facts['distribution'] == "CentOS" tags: - profile - name: (users-systemfiles.yml) Backup existing users .bash_profile file - command: cp -a ~{{ item.item.name }}/.bash_profile ~{{ item.item.name }}/.bash_profile.ORIG + ansible.builtin.command: cp -a ~{{ item.item.name }}/.bash_profile ~{{ item.item.name }}/.bash_profile.ORIG loop: "{{ bash_profile_user_orig_exists.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - ansible_facts['distribution'] == "CentOS" - item.stat.exists == False tags: - profile - # 1. Prüfen, ob für jeden User ein lokales _bash_profile existiert - name: (users-systemfiles.yml) stat user _bash_profile @@ -248,7 +244,7 @@ loop: "{{ default_user }}" register: bash_profile_stats loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: - ansible_facts['distribution'] == "CentOS" @@ -259,7 +255,7 @@ dest: "~{{ user.name }}/.bash_profile" owner: "{{ user.name }}" group: "{{ user.name }}" - mode: '0644' + mode: "0644" loop: "{{ default_user | zip(bash_profile_stats.results) | list }}" loop_control: label: "{{ user.name }}" @@ -277,7 +273,7 @@ # -- - name: (users-systemfiles.yml) Check if file '/root/.bash_profile.ORIG' exists - stat: + ansible.builtin.stat: path: /root/.bash_profile.ORIG register: profile_root_orig_exists when: @@ -286,16 +282,15 @@ - profile - name: (users-systemfiles.yml) Backup existing users .bash_profile file - command: cp -a /root/.bash_profile /root/.bash_profile.ORIG + ansible.builtin.command: cp -a /root/.bash_profile /root/.bash_profile.ORIG when: - ansible_facts['distribution'] == "CentOS" - profile_root_orig_exists.stat.exists == False tags: - profile - # 1) Prüfen ob die _bash_profile für root auf dem Control-Node existiert -- name: stat root _bash_profile on control node +- name: Stat root _bash_profile on control node ansible.builtin.stat: path: "{{ inventory_dir }}/files/homedirs/root/_bash_profile" delegate_to: localhost @@ -305,20 +300,19 @@ - ansible_facts['distribution'] == "CentOS" # 2) Wenn vorhanden, kopieren wir sie nach /root/.bash_profile auf dem Zielhost -- name: copy root .bash_profile if it exists +- name: Copy root .bash_profile if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/homedirs/root/_bash_profile" dest: /root/.bash_profile owner: root group: root - mode: '0644' + mode: "0644" become: true when: - ansible_facts['distribution'] == "CentOS" - bash_profile_root_stat.stat.exists tags: - bash - # -- # Copy .vimrc @@ -333,7 +327,7 @@ loop: "{{ default_user }}" register: vimrc_stats loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" # 2. Falls vorhanden, Datei kopieren - name: (users-systemfiles.yml) copy .vimrc if it exists @@ -342,7 +336,7 @@ dest: "~{{ user.name }}/.vimrc" owner: "{{ user.name }}" group: "{{ user.name }}" - mode: '0644' + mode: "0644" loop: "{{ default_user | zip(vimrc_stats.results) | list }}" loop_control: label: "{{ user.name }}" @@ -371,7 +365,7 @@ # Wichtig: KEINE verschachtelten {{ ... }} im String src: "{{ inventory_dir }}/files/homedirs/{{ user.name }}/.vim" dest: "~{{ user.name }}/" - mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch + mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch become: true loop: "{{ default_user | zip(dotvim_stats.results) | list }}" loop_control: @@ -408,7 +402,7 @@ # -- # 1) Prüfen ob die _vimrc für root auf dem Control-Node existiert -- name: stat root _vimrc on control node +- name: Stat root _vimrc on control node ansible.builtin.stat: path: "{{ inventory_dir }}/files/homedirs/root/_vimrc" delegate_to: localhost @@ -416,13 +410,13 @@ register: vimrc_root_stat # 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost -- name: copy root .vimrc if it exists +- name: Copy root .vimrc if it exists ansible.builtin.copy: src: "{{ inventory_dir }}/files/homedirs/root/_vimrc" dest: /root/.vimrc owner: root group: root - mode: '0644' + mode: "0644" become: true when: - vimrc_root_stat.stat.exists @@ -443,7 +437,7 @@ ansible.builtin.copy: src: "{{ inventory_dir }}/files/homedirs/root/.vim" dest: "/root/" - mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen + mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen become: true when: - root_dotvim_stat.stat.exists | bool diff --git a/roles/common/tasks/users.yml b/roles/common/tasks/users.yml index a6f38e4..963656a 100644 --- a/roles/common/tasks/users.yml +++ b/roles/common/tasks/users.yml @@ -1,5 +1,4 @@ --- - # --- # - Set base home directory # --- @@ -7,8 +6,8 @@ - name: HOME in /etc/default/useradd setzen oder hinter Kommentar einfügen ansible.builtin.lineinfile: path: /etc/default/useradd - regexp: '^HOME=' - insertafter: '^#\s*HOME=' + regexp: "^HOME=" + insertafter: "^#\\s*HOME=" line: "HOME={{ base_home }}" backup: true when: @@ -18,43 +17,43 @@ - name: DHOME in /etc/adduser.conf setzen oder hinter Kommentar einfügen ansible.builtin.lineinfile: path: /etc/adduser.conf - regexp: '^DHOME=' - insertafter: '^#\s*DHOME=' + regexp: "^DHOME=" + insertafter: "^#\\s*DHOME=" line: "DHOME={{ base_home }}" backup: true when: - - base_home is defined - - base_home != '/home' + - base_home is defined + - base_home != '/home' # --- # - default user/groups # --- - name: (users.yml) Ensure default groups exists - group: - name: '{{ item.name }}' + ansible.builtin.group: + name: "{{ item.name }}" state: present - gid: '{{ item.group_id | default(omit) }}' + gid: "{{ item.group_id | default(omit) }}" loop: "{{ default_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: item.group_id is defined tags: - groups-exists - name: (users.yml) Ensure default users exists - user: - name: '{{ item.name }}' + ansible.builtin.user: + name: "{{ item.name }}" state: present - uid: '{{ item.user_id | default(omit) }}' - group: '{{ item.group | default(omit) }}' + uid: "{{ item.user_id | default(omit) }}" + group: "{{ item.group | default(omit) }}" home: "{{ item.home | default('/home/' ~ item.name) }}" - shell: '{{ item.shell|d("/bin/bash") }}' + shell: '{{ item.shell | d("/bin/bash") }}' password: "{{ item.password }}" update_password: on_create loop: "{{ default_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: item.name != ansible_user tags: - users-exists @@ -65,7 +64,7 @@ key: "{{ item.1 }}" state: present with_subelements: - - '{{ default_user }}' + - "{{ default_user }}" - ssh_keys loop_control: label: "{{ item.0.name }}" @@ -77,31 +76,31 @@ # --- - name: (users.yml) Ensure extra groups exists - group: - name: '{{ item.name }}' + ansible.builtin.group: + name: "{{ item.name }}" state: present - gid: '{{ item.group_id | default(omit) }}' + gid: "{{ item.group_id | default(omit) }}" loop: "{{ extra_user }}" loop_control: - label: '{{ item.name }}' - when: + label: "{{ item.name }}" + when: - extra_user is defined and extra_user|length > 0 tags: - groups-exists - name: (users.yml) Ensure extra users exists - user: - name: '{{ item.name }}' + ansible.builtin.user: + name: "{{ item.name }}" state: present - uid: '{{ item.user_id | default(omit) }}' - group: '{{ item.name | default(omit) }}' - home: '{{ item.home | default(omit) }}' - shell: '{{ item.shell|d("/bin/bash") }}' + uid: "{{ item.user_id | default(omit) }}" + group: "{{ item.name | default(omit) }}" + home: "{{ item.home | default(omit) }}" + shell: '{{ item.shell | d("/bin/bash") }}' password: "{{ item.password }}" update_password: on_create loop: "{{ extra_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: extra_user is defined and extra_user|length > 0 tags: - users-exists @@ -112,7 +111,7 @@ key: "{{ item.1 }}" state: present with_subelements: - - '{{ extra_user }}' + - "{{ extra_user }}" - ssh_keys loop_control: label: "{{ item.0.name }}" @@ -129,20 +128,19 @@ loop_control: label: "{{ item.user }}" when: - - entries_authorized_key is defined - - entries_authorized_key|length > 0 - + - entries_authorized_key is defined + - entries_authorized_key|length > 0 # --- # - extra system groups # --- - name: (users.yml) Extra system group sftp_users - group: - name: 'sftp_users' + ansible.builtin.group: + name: "sftp_users" state: present - system: yes - when: + system: true + when: - create_sftp_group is defined and create_sftp_group > 0 tags: - groups-exists @@ -152,21 +150,20 @@ # --- - name: (users.yml) extra system user exists? - user: - name: '{{ item.name }}' + ansible.builtin.user: + name: "{{ item.name }}" state: present - system: yes - home: '{{ item.home }}' - shell: '{{ item.shell|d("/usr/sbin/nologin") }}' - groups: '{{ item.groups | default(omit) }}' + system: true + home: "{{ item.home }}" + shell: '{{ item.shell | d("/usr/sbin/nologin") }}' + groups: "{{ item.groups | default(omit) }}" loop: "{{ extra_system_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" when: extra_system_user is defined and extra_system_user|length > 0 tags: - user-exists - # --- # - Take care backup host has rsa key to connect via ssh to the other hosts # --- @@ -224,47 +221,46 @@ # - authorized_key # - keypair-backup-server - # --- # - Allow connection via ssh to backup host # --- - name: Ensure root's .ssh directory exists - file: + ansible.builtin.file: path: /root/.ssh state: directory - name: (users.yml) Copy (backup) ed25519 ssh private key to user root - copy: - src: '{{ item.priv_key_src }}' - dest: '{{ item.priv_key_dest }}' + ansible.builtin.copy: + src: "{{ item.priv_key_src }}" + dest: "{{ item.priv_key_dest }}" owner: root group: root - mode: '0600' - when: + mode: "0600" + when: - insert_keypair_backup_client|bool - ssh_keypair_backup_client is defined - ssh_keypair_backup_client|length > 0 loop: "{{ ssh_keypair_backup_client }}" loop_control: - label: 'dest: {{ item.priv_key_dest }}' + label: "dest: {{ item.priv_key_dest }}" tags: - insert_ssh_keypair_backup_server - name: (users.yml) Copy (backup) ed25519 ssh public key to user root - copy: - src: '{{ item.pub_key_src }}' - dest: '{{ item.pub_key_dest }}' + ansible.builtin.copy: + src: "{{ item.pub_key_src }}" + dest: "{{ item.pub_key_dest }}" owner: root group: root - mode: '0644' - when: + mode: "0644" + when: - insert_keypair_backup_client|bool - ssh_keypair_backup_client is defined - ssh_keypair_backup_client|length > 0 loop: "{{ ssh_keypair_backup_client }}" loop_control: - label: 'dest: {{ item.pub_key_dest }}' + label: "dest: {{ item.pub_key_dest }}" tags: - insert_ssh_keypair_backup_server @@ -275,7 +271,7 @@ state: present loop: "{{ ssh_keypair_backup_client }}" loop_control: - label: 'authorized_keys - user: root' + label: "authorized_keys - user: root" when: - inventory_hostname == item.target - ssh_keypair_backup_client is defined @@ -284,18 +280,17 @@ - authorized_key - ssh-keypair-backup-server - - name: (users.yml) Copy further ssh private key(s) to user root - copy: - src: '{{ item.priv_key_src }}' - dest: '{{ item.priv_key_dest }}' + ansible.builtin.copy: + src: "{{ item.priv_key_src }}" + dest: "{{ item.priv_key_dest }}" owner: root group: root - mode: '0600' + mode: "0600" loop: "{{ root_ssh_keypair }}" loop_control: - label: 'dest: {{ item.priv_key_dest }}' - when: + label: "dest: {{ item.priv_key_dest }}" + when: - insert_root_ssh_keypair|bool - root_ssh_keypair is defined - root_ssh_keypair|length > 0 @@ -304,20 +299,19 @@ - root-defaut-ssh-keypair - name: (users.yml) Copy further ssh public key(s) to user root - copy: - src: '{{ item.pub_key_src }}' - dest: '{{ item.pub_key_dest }}' + ansible.builtin.copy: + src: "{{ item.pub_key_src }}" + dest: "{{ item.pub_key_dest }}" owner: root group: root - mode: '0644' + mode: "0644" loop: "{{ root_ssh_keypair }}" loop_control: - label: 'dest: {{ item.pub_key_dest }}' - when: + label: "dest: {{ item.pub_key_dest }}" + when: - insert_root_ssh_keypair|bool - root_ssh_keypair is defined - root_ssh_keypair|length > 0 tags: - insert_root_ssh_keypair - root-defaut-ssh-keypair - diff --git a/roles/common/tasks/webadmin-user.yml b/roles/common/tasks/webadmin-user.yml index eb5170c..78dd1a3 100644 --- a/roles/common/tasks/webadmin-user.yml +++ b/roles/common/tasks/webadmin-user.yml @@ -1,39 +1,38 @@ --- - # --- # - webadmin user/group # --- - name: (webadmin-user.yml) Ensure webadmin group exists - group: - name: '{{ item.name }}' + ansible.builtin.group: + name: "{{ item.name }}" state: present - gid: '{{ item.group_id | default(omit) }}' - with_items: '{{ webadmin_user }}' + gid: "{{ item.group_id | default(omit) }}" + with_items: "{{ webadmin_user }}" loop_control: label: "{{ item.name }}" - when: + when: - groups['webadmin']|string is search(inventory_hostname) - - webadmin_user is defined + - webadmin_user is defined - item.group_id is defined tags: - webadmin - groups-exists - name: (webadmin-user.yml) Ensure webadmin user exists - user: - name: '{{ item.name }}' + ansible.builtin.user: + name: "{{ item.name }}" state: present - uid: '{{ item.user_id | default(omit) }}' - group: '{{ item.name | default(omit) }}' - home: '{{ item.home | default(omit) }}' - shell: '{{ item.shell|d("/bin/bash") }}' + uid: "{{ item.user_id | default(omit) }}" + group: "{{ item.name | default(omit) }}" + home: "{{ item.home | default(omit) }}" + shell: '{{ item.shell | d("/bin/bash") }}' password: "{{ item.password }}" update_password: on_create - with_items: '{{ webadmin_user }}' + with_items: "{{ webadmin_user }}" loop_control: label: "{{ item.name }}" - when: + when: - groups['webadmin']|string is search(inventory_hostname) - webadmin_user is defined tags: @@ -46,12 +45,12 @@ key: "{{ item.1 }}" state: present with_subelements: - - '{{ webadmin_user }}' + - "{{ webadmin_user }}" - ssh_keys loop_control: label: "{{ item.0.name }} key: {{ idx + 1 }}" index_var: idx - when: + when: - groups['webadmin']|string is search(inventory_hostname) - webadmin_user is defined tags: @@ -59,46 +58,46 @@ - authorized_key - name: (webadmin-user.yml) Copy default ed25519 ssh private key to user webadmin - copy: - src: '{{ item.priv_key_src }}' - dest: '{{ item.priv_key_dest }}' - owner: '{{ item.login }}' - group: '{{ item.login }}' - mode: '0600' + ansible.builtin.copy: + src: "{{ item.priv_key_src }}" + dest: "{{ item.priv_key_dest }}" + owner: "{{ item.login }}" + group: "{{ item.login }}" + mode: "0600" #when: groups['oopen_server']|string is search(inventory_hostname) - when: + when: - insert_webadmin_ssh_keypair|bool - with_items: '{{ webadmin_ssh_keypair }}' + with_items: "{{ webadmin_ssh_keypair }}" loop_control: - label: 'dest: {{ item.priv_key_dest }}' + label: "dest: {{ item.priv_key_dest }}" tags: - webadmin - webadmin-defaut-ssh-keypair - name: (webadmin-user.yml) Copy default ssh key ed25519 public key to user webadmin - copy: - src: '{{ item.pub_key_src }}' - dest: '{{ item.pub_key_dest }}' - owner: '{{ item.login }}' - group: '{{ item.login }}' - mode: '0644' - with_items: '{{ webadmin_ssh_keypair }}' + ansible.builtin.copy: + src: "{{ item.pub_key_src }}" + dest: "{{ item.pub_key_dest }}" + owner: "{{ item.login }}" + group: "{{ item.login }}" + mode: "0644" + with_items: "{{ webadmin_ssh_keypair }}" loop_control: - label: 'dest: {{ item.pub_key_dest }}' - when: + label: "dest: {{ item.pub_key_dest }}" + when: - insert_webadmin_ssh_keypair|bool tags: - webadmin - webadmin-defaut-ssh-keypair - name: (webadmin-user.yml) Ensure .ssh/config of user webadmin is up-to-date - template: + ansible.builtin.template: src: var/www/.ssh/config.j2 - dest: '~webadmin/.ssh/config' + dest: "~webadmin/.ssh/config" owner: webadmin group: webadmin - mode: '0644' - when: + mode: "0644" + when: - insert_webadmin_ssh_keypair|bool tags: - webadmin @@ -112,29 +111,27 @@ user: "{{ item.login }}" key: "{{ lookup('file', item.pub_key_src) }}" state: present - with_items: '{{ webadmin_ssh_keypair }}' + with_items: "{{ webadmin_ssh_keypair }}" loop_control: - label: 'authorized_keys - webadmin: root' + label: "authorized_keys - webadmin: root" when: inventory_hostname == item.target tags: - webadmin - authorized_key - insert_webadmin_ssh_public_key - # --- # Check if local template directories exists # --- - name: (users-systemfiles.yml) Check if local template directory exists for webadmin - local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }} + ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/{{ item.name }} + delegate_to: localhost with_items: "{{ webadmin_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" register: local_template_dir_webadmin - - # -- # Copy .bashrc # --- @@ -164,37 +161,37 @@ # - bash - name: (webadmin-user.yml) Check if webadmin's file '.bashrc.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.bashrc.ORIG" register: bashrc_webadmin_orig_exists with_items: "{{ webadmin_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - webadmin - bash - name: (webadmin-user.yml) Backup existing webadmin's .bashrc file - command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG + ansible.builtin.command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG loop: "{{ bashrc_webadmin_orig_exists.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - item.stat.exists == False tags: - webadmin - bash - + - name: (webadmin-user.yml) copy new .bashrc for webadmin if it exists - copy: + ansible.builtin.copy: src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') }}" dest: "~{{ item.item.name }}/.bashrc" owner: "{{ item.item.name }}" group: "{{ item.item.name }}" - mode: 0644 + mode: "0644" with_items: "{{ local_template_dir_webadmin.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - item.stat.exists - lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') != '' @@ -207,58 +204,58 @@ # --- - name: (webadmin-user.yml) Check if webadmin's file '.profile.ORIG' exists - stat: + ansible.builtin.stat: path: "~{{ item.name }}/.profile.ORIG" register: profile_webadmin_orig_exists with_items: "{{ webadmin_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" tags: - webadmin - profile - name: (webadmin-user.yml) Backup existing users .profile file - command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG + ansible.builtin.command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG with_items: "{{ profile_webadmin_orig_exists.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - - item.stat.exists == False + - item.stat.exists == False tags: - webadmin - profile - + - name: (webadmin-user.yml) copy .profile for user webadmin if it exists - copy: + ansible.builtin.copy: src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') }}" dest: "~{{ item.item.name }}/.profile" owner: "{{ item.item.name }}" group: "{{ item.item.name }}" - mode: 0644 + mode: "0644" with_items: "{{ local_template_dir_webadmin.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - item.stat.exists - lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') != '' tags: - webadmin - profile - + # -- # Copy .vimrc # --- - name: (webadmin-user.yml) copy .vimrc for user webadmin if it exists - copy: + ansible.builtin.copy: src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') }}" dest: "~{{ item.item.name }}/.vimrc" owner: "{{ item.item.name }}" group: "{{ item.item.name }}" - mode: 0644 + mode: "0644" with_items: "{{ local_template_dir_webadmin.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - item.stat.exists - lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') != '' @@ -267,22 +264,23 @@ - vim - name: (webadmin-user.yml) Check if local template directory .vim exists for webadmin - local_action: stat path={{ inventory_dir }}/files/homedirs/webadmin/.vim + ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/webadmin/.vim + delegate_to: localhost register: local_template_dir_vim_webadmin with_items: "{{ webadmin_user }}" loop_control: - label: '{{ item.name }}' + label: "{{ item.name }}" - name: (webadmin-user.yml) copy .vim directory for user webadmin if it exists - copy: + ansible.builtin.copy: src: "{{ inventory_dir + '/files/homedirs/' + item.item.name + '/.vim' }}" dest: "~{{ item.item.name }}" owner: "{{ item.item.name }}" group: "{{ item.item.name }}" - mode: 0644 + mode: "0644" with_items: "{{ local_template_dir_vim_webadmin.results }}" loop_control: - label: '{{ item.item.name }}' + label: "{{ item.item.name }}" when: - item.stat.exists tags: diff --git a/roles/common/tasks/x2go-server.yml b/roles/common/tasks/x2go-server.yml index c68429d..b5071c3 100644 --- a/roles/common/tasks/x2go-server.yml +++ b/roles/common/tasks/x2go-server.yml @@ -1,11 +1,10 @@ --- - # --- # NFS Server # --- - name: (x2g-server.yml) Ensure X2Go server packages are installed. - apt: + ansible.builtin.apt: name: - x2goserver - x2goserver-xsession @@ -17,6 +16,3 @@ - "groups['x2go_server']|string is search(inventory_hostname)" tags: - x2g--server - - - diff --git a/roles/common/tasks/yum.yml b/roles/common/tasks/yum.yml index 54cc67b..c8c5d6a 100644 --- a/roles/common/tasks/yum.yml +++ b/roles/common/tasks/yum.yml @@ -1,10 +1,9 @@ --- - - name: (yum.yml) Install system updates for redhat (centos/fedora) systems - yum: - name: '*' + ansible.builtin.dnf: + name: "*" state: latest - update_cache: yes + update_cache: true #cache_valid_time: 3600 when: - ansible_facts.os_family == "RedHat" @@ -12,19 +11,17 @@ tags: - yum-update - - name: Install the EPEL Repository in CentOS 7 - yum: + ansible.builtin.dnf: name: epel-release state: latest when: - ansible_facts.os_family == "RedHat" - ansible_facts.distribution == "CentOS" - # Its more eficient to in - name: (yum.yml) Base install CentOS packages (CentOS 7) - yum: + ansible.builtin.dnf: name: "{{ yum_base_install_centos_7 }}" state: "{{ yum_install_state }}" when: @@ -35,7 +32,7 @@ - yum-base-install - name: (yum.yml) Initial install CentOS packages (CentOS 7) - yum: + ansible.builtin.dnf: name: "{{ yum_initial_install_centos_7 }}" state: "{{ yum_install_state }}" when: @@ -45,10 +42,9 @@ tags: - yum-initial-install - # Its more eficient to in - name: (yum.yml) Base install Fedira packages (Fedora 38) - yum: + ansible.builtin.dnf: name: "{{ yum_base_install_fedora_38 }}" state: "{{ yum_install_state }}" when: @@ -59,7 +55,7 @@ - yum-base-install - name: (yum.yml) Initial install Fedora packages (Fedora 38) - yum: + ansible.builtin.dnf: name: "{{ yum_initial_install_fedora_38 }}" state: "{{ yum_install_state }}" when: @@ -69,9 +65,8 @@ tags: - yum-initial-install - - name: (yum.yml) Install lxc_host related packages CentOS systems - yum: + ansible.builtin.dnf: name: "{{ yum_lxc_host_pkgs_centos }}" state: "{{ yum_install_state }}" when: @@ -82,7 +77,7 @@ - yum-lxc-hosts-pkgs - name: (yum.yml) Install lxc_host related packages Fedora systems - yum: + ansible.builtin.dnf: name: "{{ yum_lxc_host_pkgs_fedora }}" state: "{{ yum_install_state }}" when: @@ -92,9 +87,8 @@ tags: - yum-lxc-hosts-pkgs - - name: (yum.yml) Install postgresql server related packages CentOS systems - yum: + ansible.builtin.dnf: name: "{{ yum_postgresql_pkgs_centos }}" state: "{{ yum_install_state }}" when: @@ -105,7 +99,7 @@ - apt-postgresql-server-pkgs - name: (yum.yml) Install postgresql server related packages Fedora systems - yum: + ansible.builtin.dnf: name: "{{ yum_postgresql_pkgs_fedora }}" state: "{{ yum_install_state }}" when: @@ -115,9 +109,8 @@ tags: - apt-postgresql-server-pkgs - - name: (yum.yml) Install compile related packages CentOS systems - yum: + ansible.builtin.dnf: name: "{{ yum_compiler_pkgs_centos }}" state: "{{ yum_install_state }}" when: @@ -128,7 +121,7 @@ - yum-compiler-pkgs - name: (yum.yml) Install compile related packages Fedora systems - yum: + ansible.builtin.dnf: name: "{{ yum_compiler_pkgs_fedora }}" state: "{{ yum_install_state }}" when: @@ -139,10 +132,10 @@ - yum-compiler-pkgs - name: (yum.yml) Install webserver related packages CentOS systems - yum: + ansible.builtin.dnf: name: "{{ yum_webserver_pkgs_centos }}" state: "{{ yum_install_state }}" - when: + when: - ansible_facts.os_family == "RedHat" - ansible_facts.distribution == "CentOS" - install_webserver_pkgs|bool @@ -150,10 +143,10 @@ - yum-webserver-pkgs - name: (yum.yml) Install webserver related packages Fedora systems - yum: + ansible.builtin.dnf: name: "{{ yum_webserver_pkgs_fedora }}" state: "{{ yum_install_state }}" - when: + when: - ansible_facts.os_family == "RedHat" - ansible_facts.distribution == "Fedora" - install_webserver_pkgs|bool