ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor Ansible tasks to use fully qualified module names and improve code consistency

Browse Source 
- Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity.
- Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems.
- Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation.
- Removed unnecessary comments and whitespace to enhance readability.
- Ensured that conditions and loops are consistently formatted across all tasks.
This commit is contained in:
Christoph
2026-07-20 23:09:30 +02:00
parent bc330beebf
commit 81398e847e
33 changed files with 745 additions and 844 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/common/tasks/apt-gateway.yml
+3 -7
View File
@@ -1,31 +1,27 @@
--- ---
- name: (apt-gateway.yml) Install gateway related packages - name: (apt-gateway.yml) Install gateway related packages
ansible.builtin.apt: ansible.builtin.apt:
name: "{{ apt_gateway_host_pkgs }}" name: "{{ apt_gateway_host_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
- name: (apt-gateway.yml) Check if file '/etc/logrotate.d/speedtest' exists - name: (apt-gateway.yml) Check if file '/etc/logrotate.d/speedtest' exists
ansible.builtin.stat: ansible.builtin.stat:
path: /etc/logrotate.d/speedtest path: /etc/logrotate.d/speedtest
register: common_logrotate_speedtest_exists register: common_logrotate_speedtest_exists
- name: (apt-gateway.yml) Ensure file /etc/logrotate.d/speedtest exists - name: (apt-gateway.yml) Ensure file /etc/logrotate.d/speedtest exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ role_path + '/files/etc/logrotate.d/speedtest' }}" src: "{{ role_path + '/files/etc/logrotate.d/speedtest' }}"
dest: /etc/logrotate.d/speedtest dest: /etc/logrotate.d/speedtest
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
when: when:
- not common_logrotate_speedtest_exists.stat.exists - not common_logrotate_speedtest_exists.stat.exists
- name: (apt-gateway.yml) Set crontab entry for nightly speedtests - name: (apt-gateway.yml) Set crontab entry for nightly speedtests
ansible.builtin.cron: ansible.builtin.cron:
name: 'Speedtest' name: "Speedtest"
minute: 13 minute: 13
hour: 0-8 hour: 0-8
job: '/root/bin/admin-stuff/speedtest.sh' job: "/root/bin/admin-stuff/speedtest.sh"
roles/common/tasks/apt.yml
+47 -48
View File
@@ -1,6 +1,6 @@
--- ---
- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list' - name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
state: absent state: absent
with_items: with_items:
@@ -10,12 +10,12 @@
- apt-configuration - apt-configuration
- name: (apt.yml) update configuration file - /etc/apt/sources.list - name: (apt.yml) update configuration file - /etc/apt/sources.list
template: ansible.builtin.template:
src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2" src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2"
dest: /etc/apt/sources.list dest: /etc/apt/sources.list
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
register: apt_config_updated register: apt_config_updated
when: when:
- apt_manage_sources_list|bool - apt_manage_sources_list|bool
@@ -25,7 +25,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13) - name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
apt: ansible.builtin.apt:
name: debian-archive-keyring name: debian-archive-keyring
state: present state: present
when: when:
@@ -37,7 +37,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) check if legacy /etc/apt/sources.list exists (Debian >= 13) - name: (apt.yml) check if legacy /etc/apt/sources.list exists (Debian >= 13)
stat: ansible.builtin.stat:
path: /etc/apt/sources.list path: /etc/apt/sources.list
register: apt_sources_list_stat register: apt_sources_list_stat
when: when:
@@ -48,7 +48,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13) - name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
copy: ansible.builtin.copy:
src: /etc/apt/sources.list src: /etc/apt/sources.list
dest: /etc/apt/sources.list.before-deb822 dest: /etc/apt/sources.list.before-deb822
remote_src: true remote_src: true
@@ -66,7 +66,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13) - name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
copy: ansible.builtin.copy:
dest: /etc/apt/sources.list dest: /etc/apt/sources.list
content: | content: |
# {{ ansible_managed }} # {{ ansible_managed }}
@@ -85,7 +85,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) configure deb822 Debian repository (Debian >= 13) - name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
template: ansible.builtin.template:
src: "etc/apt/deb822/debian.sources.j2" src: "etc/apt/deb822/debian.sources.j2"
dest: /etc/apt/sources.list.d/debian.sources dest: /etc/apt/sources.list.d/debian.sources
owner: root owner: root
@@ -100,7 +100,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) configure deb822 security repository (Debian >= 13) - name: (apt.yml) configure deb822 security repository (Debian >= 13)
template: ansible.builtin.template:
src: "etc/apt/deb822/security.sources.j2" src: "etc/apt/deb822/security.sources.j2"
dest: /etc/apt/sources.list.d/security.sources dest: /etc/apt/sources.list.d/security.sources
owner: root owner: root
@@ -115,7 +115,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) configure deb822 backports repository (Debian >= 13) - name: (apt.yml) configure deb822 backports repository (Debian >= 13)
template: ansible.builtin.template:
src: "etc/apt/deb822/backports.sources.j2" src: "etc/apt/deb822/backports.sources.j2"
dest: /etc/apt/sources.list.d/backports.sources dest: /etc/apt/sources.list.d/backports.sources
owner: root owner: root
@@ -133,7 +133,7 @@
# If 'backports' was enabled in a previous run but is now disabled. # If 'backports' was enabled in a previous run but is now disabled.
# #
- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13) - name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
file: ansible.builtin.file:
path: /etc/apt/sources.list.d/backports.sources path: /etc/apt/sources.list.d/backports.sources
state: absent state: absent
register: apt_config_removed_backports_sources register: apt_config_removed_backports_sources
@@ -148,7 +148,7 @@
# Collect change states from all Debian >=13 deb822 source tasks so apt update # Collect change states from all Debian >=13 deb822 source tasks so apt update
# can force a fresh cache refresh when repository files changed. # can force a fresh cache refresh when repository files changed.
- name: (apt.yml) aggregate deb822 source changes (Debian >= 13) - name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
set_fact: ansible.builtin.set_fact:
apt_config_updated: apt_config_updated:
changed: >- changed: >-
{{ {{
@@ -166,7 +166,7 @@
- apt-configuration - apt-configuration
- name: (apt.yml) apt update - name: (apt.yml) apt update
apt: ansible.builtin.apt:
update_cache: true update_cache: true
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
when: apt_update|bool when: apt_update|bool
@@ -193,7 +193,7 @@
- apt-webserver-pkgs - apt-webserver-pkgs
- name: (apt.yml) apt upgrade - name: (apt.yml) apt upgrade
apt: ansible.builtin.apt:
upgrade: "{{ apt_upgrade_type }}" upgrade: "{{ apt_upgrade_type }}"
update_cache: true update_cache: true
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
@@ -206,7 +206,7 @@
- apt-webserver-pkgs - apt-webserver-pkgs
- name: (apt.yml) Initial install debian packages (stretch) - name: (apt.yml) Initial install debian packages (stretch)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_stretch }}" name: "{{ apt_initial_install_stretch }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -217,7 +217,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (buster) - name: (apt.yml) Initial install debian packages (buster)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_buster }}" name: "{{ apt_initial_install_buster }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -230,7 +230,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (bullseye) - name: (apt.yml) Initial install debian packages (bullseye)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_bullseye }}" name: "{{ apt_initial_install_bullseye }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -243,7 +243,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (bookworm) - name: (apt.yml) Initial install debian packages (bookworm)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_bookworm }}" name: "{{ apt_initial_install_bookworm }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -256,7 +256,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install debian packages (trixie) - name: (apt.yml) Initial install debian packages (trixie)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_trixie }}" name: "{{ apt_initial_install_trixie }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -269,7 +269,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (bionic) - name: (apt.yml) Initial install ubuntu packages (bionic)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_bionic }}" name: "{{ apt_initial_install_bionic }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -281,7 +281,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (xenial) - name: (apt.yml) Initial install ubuntu packages (xenial)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_xenial }}" name: "{{ apt_initial_install_xenial }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -293,7 +293,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (jammy) - name: (apt.yml) Initial install ubuntu packages (jammy)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_jammy }}" name: "{{ apt_initial_install_jammy }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -305,7 +305,7 @@
- apt-initial-install - apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (noble) - name: (apt.yml) Initial install ubuntu packages (noble)
apt: ansible.builtin.apt:
name: "{{ apt_initial_install_ubuntu_noble }}" name: "{{ apt_initial_install_ubuntu_noble }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
environment: environment:
@@ -321,7 +321,7 @@
# --- # ---
- name: (apt.yml) Ensure we have CPU microcode from backports (debian stretch) - name: (apt.yml) Ensure we have CPU microcode from backports (debian stretch)
apt: ansible.builtin.apt:
name: "{{ microcode_package }}" name: "{{ microcode_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}-backports" default_release: "{{ ansible_facts['distribution_release'] }}-backports"
@@ -334,20 +334,21 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie) - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
apt: ansible.builtin.apt:
name: "{{ microcode_package }}" name: "{{ microcode_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13" - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or ansible_facts['distribution_major_version']
== "12" or ansible_facts['distribution_major_version'] == "13"
- ansible_facts['processor']|string is search("Intel") - ansible_facts['processor']|string is search("Intel")
tags: tags:
- apt-initial-install - apt-initial-install
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode (ubuntu bionic) - name: (apt.yml) Install CPU microcode (ubuntu bionic)
apt: ansible.builtin.apt:
name: "{{ microcode_package }}" name: "{{ microcode_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -360,7 +361,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode (ubuntu xenial) - name: (apt.yml) Install CPU microcode (ubuntu xenial)
apt: ansible.builtin.apt:
name: "{{ microcode_package }}" name: "{{ microcode_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -373,7 +374,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install CPU microcode (ubuntu jammy) - name: (apt.yml) Install CPU microcode (ubuntu jammy)
apt: ansible.builtin.apt:
name: "{{ microcode_package }}" name: "{{ microcode_package }}"
state: present state: present
default_release: "{{ ansible_facts['distribution_release'] }}" default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -386,7 +387,7 @@
- apt-microcode - apt-microcode
- name: (apt.yml) Install lxc_host related packages - name: (apt.yml) Install lxc_host related packages
apt: ansible.builtin.apt:
name: "{{ apt_lxc_host_pkgs }}" name: "{{ apt_lxc_host_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -395,7 +396,7 @@
- apt-lxc-hosts-pkgs - apt-lxc-hosts-pkgs
- name: (apt.yml) Install docker related packages - name: (apt.yml) Install docker related packages
apt: ansible.builtin.apt:
name: "{{ apt_docker_host_pkgs }}" name: "{{ apt_docker_host_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -404,7 +405,7 @@
- apt-docker-hosts-pkgs - apt-docker-hosts-pkgs
- name: (apt.yml) Install kvm_host related packages - name: (apt.yml) Install kvm_host related packages
apt: ansible.builtin.apt:
name: "{{ apt_kvm_host_pkgs }}" name: "{{ apt_kvm_host_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -413,7 +414,7 @@
- apt-kvm-hosts-pkgs - apt-kvm-hosts-pkgs
- name: (apt.yml) Install kvm_host related packages only debian 10 (buster) - name: (apt.yml) Install kvm_host related packages only debian 10 (buster)
apt: ansible.builtin.apt:
name: "{{ apt_kvm_host_buster_pkgs }}" name: "{{ apt_kvm_host_buster_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -424,7 +425,7 @@
- apt-kvm-hosts-pkgs - apt-kvm-hosts-pkgs
- name: (apt.yml) Install compiler related packages - name: (apt.yml) Install compiler related packages
apt: ansible.builtin.apt:
name: "{{ apt_compiler_pkgs }}" name: "{{ apt_compiler_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: install_compiler_pkgs|bool when: install_compiler_pkgs|bool
@@ -432,7 +433,7 @@
- apt-compiler-pkgs - apt-compiler-pkgs
- name: (apt.yml) Install postgresql_server related packages - name: (apt.yml) Install postgresql_server related packages
apt: ansible.builtin.apt:
name: "{{ apt_postgresql_pkgs }}" name: "{{ apt_postgresql_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: install_postgresql_pkgs|bool when: install_postgresql_pkgs|bool
@@ -440,7 +441,7 @@
- apt-postgresql-server-pkgs - apt-postgresql-server-pkgs
- name: (apt.yml) Install webserver related packages (Debian <= 12) - name: (apt.yml) Install webserver related packages (Debian <= 12)
apt: ansible.builtin.apt:
name: "{{ apt_webserver_pkgs }}" name: "{{ apt_webserver_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -451,7 +452,7 @@
- apt-webserver-pkgs - apt-webserver-pkgs
- name: (apt.yml) Install webserver related packages (Debian >= 13) - name: (apt.yml) Install webserver related packages (Debian >= 13)
apt: ansible.builtin.apt:
name: "{{ apt_webserver_pkgs_trixie }}" name: "{{ apt_webserver_pkgs_trixie }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: when:
@@ -462,7 +463,7 @@
- apt-webserver-pkgs - apt-webserver-pkgs
- name: (apt.yml) Install samba related packages - name: (apt.yml) Install samba related packages
package: ansible.builtin.package:
pkg: "{{ apt_install_server_samba }}" pkg: "{{ apt_install_server_samba }}"
state: present state: present
when: when:
@@ -471,7 +472,7 @@
- samba-server - samba-server
- name: (apt.yml) Install extra packages - name: (apt.yml) Install extra packages
apt: ansible.builtin.apt:
name: "{{ apt_extra_pkgs }}" name: "{{ apt_extra_pkgs }}"
state: "{{ apt_install_state }}" state: "{{ apt_install_state }}"
when: apt_install_extra_pkgs|bool when: apt_install_extra_pkgs|bool
@@ -479,7 +480,7 @@
- apt-extra-pkgs - apt-extra-pkgs
- name: (apt.yml) Remove unwanted packages - name: (apt.yml) Remove unwanted packages
apt: ansible.builtin.apt:
name: "{{ apt_remove }}" name: "{{ apt_remove }}"
state: absent state: absent
purge: "{{ apt_remove_purge }}" purge: "{{ apt_remove_purge }}"
@@ -487,7 +488,7 @@
- apt-remove - apt-remove
- name: (apt.yml) autoremove - name: (apt.yml) autoremove
apt: ansible.builtin.apt:
autoremove: true autoremove: true
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
when: apt_autoremove|bool when: apt_autoremove|bool
@@ -514,7 +515,7 @@
- name: (apt.yml) autoclean cache - name: (apt.yml) autoclean cache
ansible.builtin.apt: ansible.builtin.apt:
autoclean: yes autoclean: true
when: apt_clean | bool when: apt_clean | bool
tags: tags:
- apt-clean - apt-clean
@@ -528,11 +529,10 @@
# link '/etc/mysql/my.cnf' in case mysql/mariadb was installed from source # link '/etc/mysql/my.cnf' in case mysql/mariadb was installed from source
# #
- name: (apt.yml) Check if file '/usr/local/mysql/etc/my.cnf' exists - name: (apt.yml) Check if file '/usr/local/mysql/etc/my.cnf' exists
stat: ansible.builtin.stat:
path: /usr/local/mysql/etc/my.cnf path: /usr/local/mysql/etc/my.cnf
register: usr_local_mysql_etc_my_cnf register: usr_local_mysql_etc_my_cnf
when: groups['mysql_server']|string is search(inventory_hostname) or when: groups['mysql_server']|string is search(inventory_hostname) or groups['apache2_webserver']|string is search(inventory_hostname) or
groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nextcloud_server']|string is search(inventory_hostname) groups['nextcloud_server']|string is search(inventory_hostname)
tags: tags:
- apt-webserver-pkgs - apt-webserver-pkgs
@@ -548,15 +548,14 @@
# - check_mysql_cnf # - check_mysql_cnf
- name: (apt.yml) Create a symbolic link /etc/my.cnf -> /usr/local/mysql/etc/my.cnf - name: (apt.yml) Create a symbolic link /etc/my.cnf -> /usr/local/mysql/etc/my.cnf
file: ansible.builtin.file:
src: /usr/local/mysql/etc/my.cnf src: /usr/local/mysql/etc/my.cnf
dest: /etc/mysql/my.cnf dest: /etc/mysql/my.cnf
owner: root owner: root
group: root group: root
state: link state: link
when: when:
- (groups['mysql_server']|string is search(inventory_hostname) or - (groups['mysql_server']|string is search(inventory_hostname) or groups['apache2_webserver']|string is search(inventory_hostname) or
groups['apache2_webserver']|string is search(inventory_hostname) or
groups['nextcloud_server']|string is search(inventory_hostname)) groups['nextcloud_server']|string is search(inventory_hostname))
- usr_local_mysql_etc_my_cnf.stat.exists - usr_local_mysql_etc_my_cnf.stat.exists
tags: tags:
roles/common/tasks/basic.yml
+27 -33
View File
@@ -1,5 +1,4 @@
--- ---
- name: Ensure util-linux-extra is installed on Debian - name: Ensure util-linux-extra is installed on Debian
ansible.builtin.apt: ansible.builtin.apt:
name: util-linux-extra name: util-linux-extra
@@ -15,7 +14,6 @@
tags: tags:
- timezone - timezone
- name: (basic.yml) Ensure locales are present - name: (basic.yml) Ensure locales are present
community.general.locale_gen: community.general.locale_gen:
name: "{{ item }}" name: "{{ item }}"
@@ -36,7 +34,6 @@
tags: tags:
- symlink-sh - symlink-sh
# ---------- # ----------
# security limit (maybe DEPRECATED see systemd settings) # security limit (maybe DEPRECATED see systemd settings)
# ---------- # ----------
@@ -45,7 +42,7 @@
ansible.builtin.file: ansible.builtin.file:
path: /etc/security/limits.d path: /etc/security/limits.d
state: directory state: directory
mode: '0755' mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -57,14 +54,14 @@
- name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists - name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists
ansible.builtin.copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_security_limits }}" loop: "{{ copy_plain_files_security_limits }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server'] - inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
- copy_plain_files_security_limits is defined - copy_plain_files_security_limits is defined
@@ -72,7 +69,6 @@
tags: tags:
- systemd-config - systemd-config
# ---------- # ----------
# systemd stuff # systemd stuff
# ---------- # ----------
@@ -81,7 +77,7 @@
ansible.builtin.file: ansible.builtin.file:
path: /etc/systemd/system.conf.d path: /etc/systemd/system.conf.d
state: directory state: directory
mode: '0755' mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -97,14 +93,14 @@
- name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists - name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
ansible.builtin.copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_systemd }}" loop: "{{ copy_plain_files_systemd }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- >- - >-
inventory_hostname not in groups['lxc_guest'] or inventory_hostname not in groups['lxc_guest'] or
@@ -120,7 +116,7 @@
ansible.builtin.file: ansible.builtin.file:
path: /etc/systemd/journald.conf.d path: /etc/systemd/journald.conf.d
state: directory state: directory
mode: '0755' mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -131,14 +127,14 @@
- name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists - name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists
ansible.builtin.copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_journald }}" loop: "{{ copy_plain_files_journald }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
notify: "Restart systemd-journald" notify: "Restart systemd-journald"
when: when:
- copy_plain_files_journald is defined - copy_plain_files_journald is defined
@@ -146,7 +142,6 @@
tags: tags:
- systemd-config - systemd-config
# ---------- # ----------
# kernel parameter # kernel parameter
# ---------- # ----------
@@ -155,7 +150,7 @@
ansible.builtin.file: ansible.builtin.file:
path: etc/sysctl.d path: etc/sysctl.d
state: directory state: directory
mode: '0755' mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -167,14 +162,14 @@
- name: (basic.yml) Ensure files /etc/sysctl.d/*.conf exists - name: (basic.yml) Ensure files /etc/sysctl.d/*.conf exists
ansible.builtin.copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_sysctl }}" loop: "{{ copy_plain_files_sysctl }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server'] - inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
- copy_plain_files_sysctl is defined - copy_plain_files_sysctl is defined
@@ -184,14 +179,14 @@
- name: (basic.yml) Additional Kernel Parameters (files /etc/sysctl.d/*.conf) - name: (basic.yml) Additional Kernel Parameters (files /etc/sysctl.d/*.conf)
ansible.builtin.copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_additional_plain_files_sysctl }}" loop: "{{ copy_additional_plain_files_sysctl }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server'] - inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
- copy_additional_plain_files_sysctl is defined - copy_additional_plain_files_sysctl is defined
@@ -199,7 +194,6 @@
tags: tags:
- systctl-config - systctl-config
# ---------- # ----------
# unattended upgrades # unattended upgrades
# ---------- # ----------
@@ -246,7 +240,7 @@
creates: /etc/apt/apt.conf.d/20auto-upgrades creates: /etc/apt/apt.conf.d/20auto-upgrades
environment: environment:
DEBIAN_FRONTEND: noninteractive DEBIAN_FRONTEND: noninteractive
DEBCONF_NONINTERACTIVE_SEEN: 'true' DEBCONF_NONINTERACTIVE_SEEN: "true"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- not common_ua_enabled.stat.exists - not common_ua_enabled.stat.exists
@@ -259,7 +253,7 @@
dest: /etc/apt/listchanges.conf dest: /etc/apt/listchanges.conf
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
@@ -272,7 +266,7 @@
backup: true backup: true
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
roles/common/tasks/caching-nameserver.yml
+20 -26
View File
@@ -1,12 +1,11 @@
--- ---
# --- # ---
# Install 'bind' apt based OS # Install 'bind' apt based OS
# --- # ---
- name: (caching-nameserver.yml) update - name: (caching-nameserver.yml) update
apt: ansible.builtin.apt:
update_cache: true update_cache: true
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
when: when:
@@ -26,9 +25,8 @@
tags: tags:
- apt-caching-nameserver - apt-caching-nameserver
- name: (caching-nameserver.yml) upgrade - name: (caching-nameserver.yml) upgrade
apt: ansible.builtin.apt:
upgrade: "{{ apt_upgrade_type }}" upgrade: "{{ apt_upgrade_type }}"
update_cache: true update_cache: true
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
@@ -38,9 +36,8 @@
tags: tags:
- apt-caching-nameserver - apt-caching-nameserver
- name: (caching-nameserver.yml) Install bind packages (using apt) - name: (caching-nameserver.yml) Install bind packages (using apt)
apt: ansible.builtin.apt:
name: "{{ apt_bind_pkgs }}" name: "{{ apt_bind_pkgs }}"
state: present state: present
when: when:
@@ -54,10 +51,10 @@
# --- # ---
- name: (yum.yml) Install system updates for centos systems - name: (yum.yml) Install system updates for centos systems
yum: ansible.builtin.dnf:
name: '*' name: "*"
state: latest state: latest
update_cache: yes update_cache: true
#cache_valid_time: 3600 #cache_valid_time: 3600
when: when:
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
@@ -66,7 +63,7 @@
- yum-update - yum-update
- name: (yum.yml) Install bind packages (using yum) - name: (yum.yml) Install bind packages (using yum)
yum: ansible.builtin.dnf:
name: "{{ yum_bind_pks }}" name: "{{ yum_bind_pks }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -80,24 +77,23 @@
# -- # --
- name: (caching-nameserver.yml) Create directory /var/log/named if it does not exist - name: (caching-nameserver.yml) Create directory /var/log/named if it does not exist
file: ansible.builtin.file:
path: /var/log/named path: /var/log/named
state: directory state: directory
owner: bind owner: bind
group: bind group: bind
mode: '0755' mode: "0755"
when: when:
- ansible_facts["distribution"] == "Debian" - ansible_facts["distribution"] == "Debian"
- name: (caching-nameserver.yml) update named.conf.options configuration file (normal server) - name: (caching-nameserver.yml) update named.conf.options configuration file (normal server)
template: ansible.builtin.template:
src: etc/bind/named.conf.options.j2 src: etc/bind/named.conf.options.j2
dest: /etc/bind/named.conf.options dest: /etc/bind/named.conf.options
backup: yes backup: true
owner: root owner: root
group: bind group: bind
mode: 0644 mode: "0644"
#validate: visudo -cf %s #validate: visudo -cf %s
notify: Reload bind9 notify: Reload bind9
tags: tags:
@@ -112,18 +108,18 @@
# In case of gateway gateway servers ONLY if bind ption file NOT exists # In case of gateway gateway servers ONLY if bind ption file NOT exists
# #
- name: Check if file '/etc/bind/named.conf.options' exists - name: Check if file '/etc/bind/named.conf.options' exists
stat: ansible.builtin.stat:
path: /etc/bind/named.conf.options path: /etc/bind/named.conf.options
register: file_named_conf_options register: file_named_conf_options
- name: (caching-nameserver.yml) update named.conf.options configuration file (gateway server) - name: (caching-nameserver.yml) update named.conf.options configuration file (gateway server)
template: ansible.builtin.template:
src: etc/bind/named.conf.options.gateway.j2 src: etc/bind/named.conf.options.gateway.j2
dest: /etc/bind/named.conf.options dest: /etc/bind/named.conf.options
backup: yes backup: true
owner: root owner: root
group: bind group: bind
mode: 0644 mode: "0644"
#validate: visudo -cf %s #validate: visudo -cf %s
notify: Reload bind9 notify: Reload bind9
tags: tags:
@@ -136,20 +132,18 @@
# -------------------- # --------------------
- name: (caching-nameserver.yml) Add 127.0.0.1 as first nameserver entry to /etc/resolv.conf - name: (caching-nameserver.yml) Add 127.0.0.1 as first nameserver entry to /etc/resolv.conf
lineinfile: ansible.builtin.lineinfile:
path: /etc/resolv.conf path: /etc/resolv.conf
line: nameserver 127.0.0.1 line: nameserver 127.0.0.1
firstmatch: yes firstmatch: true
insertbefore: '^nameserver' insertbefore: "^nameserver"
state: present state: present
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
tags: tags:
- apt-caching-nameserver - apt-caching-nameserver
when: when:
- ansible_facts["distribution"] == "Debian" - ansible_facts["distribution"] == "Debian"
- not systemd_resolved - not systemd_resolved
roles/common/tasks/config_files_mailsystem_scripts.yml
+5 -6
View File
@@ -1,15 +1,14 @@
--- ---
- name: (config_files_mailsystem_scripts.yml) Copy config file templates mailsystem scripts - name: (config_files_mailsystem_scripts.yml) Copy config file templates mailsystem scripts
template: ansible.builtin.template:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ template_files_mailsystem_script }}" loop: "{{ template_files_mailsystem_script }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- template_files_mailsystem_script is defined - template_files_mailsystem_script is defined
- template_files_mailsystem_script|length > 0 - template_files_mailsystem_script|length > 0
roles/common/tasks/copy_files.yml
+35 -37
View File
@@ -1,16 +1,15 @@
--- ---
# --- # ---
# Some Checks # Some Checks
# --- # ---
- name: Check if file '/etc/postfix/relay_domains' exists - name: Check if file '/etc/postfix/relay_domains' exists
stat: ansible.builtin.stat:
path: /etc/postfix/relay_domains path: /etc/postfix/relay_domains
register: relay_domains_actual register: relay_domains_actual
- name: (copy_files.yml) Get checksum of '/etc/postfix/relay_domains' - name: (copy_files.yml) Get checksum of '/etc/postfix/relay_domains'
set_fact: ansible.builtin.set_fact:
relay_domains_sha1: "{{ relay_domains_actual.stat.checksum }}" relay_domains_sha1: "{{ relay_domains_actual.stat.checksum }}"
when: when:
- relay_domains_actual.stat.exists - relay_domains_actual.stat.exists
@@ -20,15 +19,15 @@
# --- # ---
- name: (copy_files.yml) Copy plain files - name: (copy_files.yml) Copy plain files
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files }}" loop: "{{ copy_plain_files }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- copy_plain_files is defined - copy_plain_files is defined
- copy_plain_files|length > 0 - copy_plain_files|length > 0
@@ -37,15 +36,15 @@
- copy-plain-files - copy-plain-files
- name: (copy_files.yml) Copy plain files Postfix (/etc/postfix) - name: (copy_files.yml) Copy plain files Postfix (/etc/postfix)
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_postfix }}" loop: "{{ copy_plain_files_postfix }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname in groups['mail_server'] - inventory_hostname in groups['mail_server']
- copy_plain_files_postfix is defined - copy_plain_files_postfix is defined
@@ -56,15 +55,15 @@
notify: "Reload postfwd" notify: "Reload postfwd"
- name: (copy_files.yml) Copy host specific plain files Postfix (/etc/postfix) - name: (copy_files.yml) Copy host specific plain files Postfix (/etc/postfix)
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_postfix_host_specific }}" loop: "{{ copy_plain_files_postfix_host_specific }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname in groups['mail_server'] - inventory_hostname in groups['mail_server']
- copy_plain_files_postfix_host_specific is defined - copy_plain_files_postfix_host_specific is defined
@@ -75,15 +74,15 @@
notify: "Reload postfwd" notify: "Reload postfwd"
- name: (copy_files.yml) Copy plain files Postfix Firewall (postfwd) - name: (copy_files.yml) Copy plain files Postfix Firewall (postfwd)
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_postfwd }}" loop: "{{ copy_plain_files_postfwd }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname in groups['mail_server'] - inventory_hostname in groups['mail_server']
- copy_plain_files_postfwd is defined - copy_plain_files_postfwd is defined
@@ -94,15 +93,15 @@
notify: "Reload postfwd" notify: "Reload postfwd"
- name: (copy_files.yml) Copy host specific plain files Postfix Firewall (postfwd) - name: (copy_files.yml) Copy host specific plain files Postfix Firewall (postfwd)
copy: ansible.builtin.copy:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_plain_files_postfwd_host_specific }}" loop: "{{ copy_plain_files_postfwd_host_specific }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- inventory_hostname in groups['mail_server'] - inventory_hostname in groups['mail_server']
- copy_plain_files_postfwd_host_specific is defined - copy_plain_files_postfwd_host_specific is defined
@@ -112,17 +111,16 @@
- copy-plain-files - copy-plain-files
notify: "Reload postfwd" notify: "Reload postfwd"
- name: (copy_files.yml) Copy template files - name: (copy_files.yml) Copy template files
template: ansible.builtin.template:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ copy_template_files }}" loop: "{{ copy_template_files }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- copy_template_files is defined - copy_template_files is defined
- copy_template_files|length > 0 - copy_template_files|length > 0
@@ -135,18 +133,18 @@
# --- # ---
- name: Get checksum oif (possible upodated) file '/etc/postfix/relay_domains' exists - name: Get checksum oif (possible upodated) file '/etc/postfix/relay_domains' exists
stat: ansible.builtin.stat:
path: /etc/postfix/relay_domains path: /etc/postfix/relay_domains
register: relay_domains_new register: relay_domains_new
- name: (copy_files.yml) Get checksum of '/etc/postfix/relay_domains' - name: (copy_files.yml) Get checksum of '/etc/postfix/relay_domains'
set_fact: ansible.builtin.set_fact:
relay_domains_sha1_new: "{{ relay_domains_new.stat.checksum }}" relay_domains_sha1_new: "{{ relay_domains_new.stat.checksum }}"
when: when:
- relay_domains_new.stat.exists - relay_domains_new.stat.exists
- name: (copy_files.yml) Renew database /etc/postfix/relay_domains.db - name: (copy_files.yml) Renew database /etc/postfix/relay_domains.db
shell: '/usr/sbin/postmap btree:/etc/postfix/relay_domains' ansible.builtin.command: "/usr/sbin/postmap btree:/etc/postfix/relay_domains"
when: when:
- relay_domains_actual.stat.exists - relay_domains_actual.stat.exists
- relay_domains_new.stat.exists - relay_domains_new.stat.exists
roles/common/tasks/cron.yml
+3 -3
View File
@@ -77,7 +77,7 @@
- user_crontab - user_crontab
- name: (cron.yml) Set env entries in user crontabs - name: (cron.yml) Set env entries in user crontabs
cron: ansible.builtin.cron:
name: "{{ item.name }}" name: "{{ item.name }}"
env: "yes" env: "yes"
user: '{{ item.user | default("root") }}' user: '{{ item.user | default("root") }}'
@@ -91,7 +91,7 @@
- user_crontab - user_crontab
- name: (cron.yml) Set special time entries in user crontabs - name: (cron.yml) Set special time entries in user crontabs
cron: ansible.builtin.cron:
name: "{{ item.name }}" name: "{{ item.name }}"
special_time: "{{ item.special_time }}" special_time: "{{ item.special_time }}"
user: '{{ item.user | default("root") }}' user: '{{ item.user | default("root") }}'
@@ -105,7 +105,7 @@
- user_crontab - user_crontab
- name: (cron.yml) Set normal entries in user crontabs - name: (cron.yml) Set normal entries in user crontabs
cron: ansible.builtin.cron:
name: "{{ item.name }}" name: "{{ item.name }}"
minute: "{{ item.minute | default(omit) }}" minute: "{{ item.minute | default(omit) }}"
hour: "{{ item.hour | default(omit) }}" hour: "{{ item.hour | default(omit) }}"
roles/common/tasks/extrepo.yml
+6 -7
View File
@@ -1,5 +1,4 @@
--- ---
- name: (extrepo.yml) Install extrepo package - name: (extrepo.yml) Install extrepo package
ansible.builtin.apt: ansible.builtin.apt:
name: extrepo name: extrepo
@@ -10,17 +9,17 @@
- name: (extrepo.yml) Enable contrib policy in /etc/extrepo/config.yaml - name: (extrepo.yml) Enable contrib policy in /etc/extrepo/config.yaml
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/extrepo/config.yaml path: /etc/extrepo/config.yaml
regexp: '^(#\s*)?-\s*contrib$' regexp: "^(#\\s*)?-\\s*contrib$"
insertafter: '^- main$' insertafter: "^- main$"
line: '- contrib' line: "- contrib"
tags: tags:
- extrepo - extrepo
- name: (extrepo.yml) Enable non-free policy in /etc/extrepo/config.yaml - name: (extrepo.yml) Enable non-free policy in /etc/extrepo/config.yaml
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/extrepo/config.yaml path: /etc/extrepo/config.yaml
regexp: '^(#\s*)?-\s*non-free$' regexp: "^(#\\s*)?-\\s*non-free$"
insertafter: '^- contrib$' insertafter: "^- contrib$"
line: '- non-free' line: "- non-free"
tags: tags:
- extrepo - extrepo
roles/common/tasks/first-run.yml
-2
View File
@@ -1,9 +1,7 @@
--- ---
- hosts: o25.oopen.de - hosts: o25.oopen.de
tasks: tasks:
- name: Ensure aptitude is present - name: Ensure aptitude is present
raw: test -e /usr/bin/aptitude || apt-get install aptitude -y raw: test -e /usr/bin/aptitude || apt-get install aptitude -y
roles/common/tasks/git.yml
+78 -101
View File
@@ -1,6 +1,5 @@
--- ---
# - name: (git.yml) include variables
#- name: (git.yml) include variables
# include_vars: "{{ item }}" # include_vars: "{{ item }}"
# with_first_found: # with_first_found:
# - "git-{{ inventory_hostname }}.yml" # - "git-{{ inventory_hostname }}.yml"
@@ -21,15 +20,12 @@
# - git-mailservers-repositories # - git-mailservers-repositories
# - git-sympa-repositories # - git-sympa-repositories
# - git-other-repositories # - git-other-repositories
# --- # ---
# Firewall repository # Firewall repository
# --- # ---
- name: (git.yml) Install/Update firewall repository - name: (git.yml) Install/Update firewall repository
git: ansible.builtin.git:
repo: "{{ git_firewall_repository.repo }}" repo: "{{ git_firewall_repository.repo }}"
dest: "{{ git_firewall_repository.dest }}" dest: "{{ git_firewall_repository.dest }}"
when: git_firewall_repository is defined and git_firewall_repository | length > 0 when: git_firewall_repository is defined and git_firewall_repository | length > 0
@@ -41,275 +37,257 @@
# --- # ---
- name: (git.yml) Install/Update default repositories - name: (git.yml) Install/Update default repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_default_repositories }}' with_items: "{{ git_default_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
tags: tags:
- git-default-repositories - git-default-repositories
# --- # ---
# Group [oopen_server] reposotories # Group [oopen_server] reposotories
# --- # ---
- name: (git.yml) Install/Update oopen_server repositories - name: (git.yml) Install/Update oopen_server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_oopen_server_repositories }}' with_items: "{{ git_oopen_server_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['oopen_server']|string is search(inventory_hostname)" when: "groups['oopen_server']|string is search(inventory_hostname)"
tags: tags:
- git-oopen-server-repositories - git-oopen-server-repositories
# --- # ---
# Group [warenform_server] reposotories # Group [warenform_server] reposotories
# --- # ---
- name: (git.yml) Install/Update warenform_server repositories - name: (git.yml) Install/Update warenform_server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_warenform_server_repositories }}' with_items: "{{ git_warenform_server_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['warenform_server']|string is search(inventory_hostname)" when: "groups['warenform_server']|string is search(inventory_hostname)"
tags: tags:
- git-warenform-server-repositories - git-warenform-server-repositories
# --- # ---
# Group [lxc_guest] reposotories # Group [lxc_guest] reposotories
# --- # ---
- name: (git.yml) Install/Update lxc_guest repositories - name: (git.yml) Install/Update lxc_guest repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_lxc_guest_repositories }}' with_items: "{{ git_lxc_guest_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['lxc_guest']|string is search(inventory_hostname)" when: "groups['lxc_guest']|string is search(inventory_hostname)"
tags: tags:
- git-lxc-guest-repositories - git-lxc-guest-repositories
# --- # ---
# Group [lxc_host] reposotories # Group [lxc_host] reposotories
# --- # ---
- name: (git.yml) Install/Update lxc_host repositories - name: (git.yml) Install/Update lxc_host repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_lxc_host_repositories }}' with_items: "{{ git_lxc_host_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['lxc_host']|string is search(inventory_hostname)" when: "groups['lxc_host']|string is search(inventory_hostname)"
tags: tags:
- git-lxc-host-repositories - git-lxc-host-repositories
# --- # ---
# Group [gateway_server] reposotories # Group [gateway_server] reposotories
# --- # ---
- name: (git.yml) Install/Update gateway repositories - name: (git.yml) Install/Update gateway repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_gateway_repositories }}' with_items: "{{ git_gateway_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['gateway_server']|string is search(inventory_hostname)" when: "groups['gateway_server']|string is search(inventory_hostname)"
tags: tags:
- git-gateway-server-repositories - git-gateway-server-repositories
# --- # ---
# Group [apache2_webserver] reposotories # Group [apache2_webserver] reposotories
# --- # ---
- name: (git.yml) Install/Update apache2 repositories - name: (git.yml) Install/Update apache2 repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_apache2_repositories }}' with_items: "{{ git_apache2_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['apache2_webserver']|string is search(inventory_hostname)" when: "groups['apache2_webserver']|string is search(inventory_hostname)"
tags: tags:
- git-apache2-repositories - git-apache2-repositories
# --- # ---
# Group [nginx_webserver] reposotories # Group [nginx_webserver] reposotories
# --- # ---
- name: (git.yml) Install/Update nginx repositories - name: (git.yml) Install/Update nginx repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_nginx_repositories }}' with_items: "{{ git_nginx_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['nginx_webserver']|string is search(inventory_hostname)" when: "groups['nginx_webserver']|string is search(inventory_hostname)"
tags: tags:
- git-nginx-repositories - git-nginx-repositories
# --- # ---
# Group [mysql_server] reposotories # Group [mysql_server] reposotories
# --- # ---
- name: (git.yml) Install/Update mysql server repositories - name: (git.yml) Install/Update mysql server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_mysql_repositories }}' with_items: "{{ git_mysql_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['mysql_server']|string is search(inventory_hostname)" when: "groups['mysql_server']|string is search(inventory_hostname)"
tags: tags:
- git-mysql-server-repositories - git-mysql-server-repositories
# --- # ---
# Group [postgresql_server] reposotories # Group [postgresql_server] reposotories
# --- # ---
- name: (git.yml) Install/Update postgresql-server repositories - name: (git.yml) Install/Update postgresql-server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_postgresql_repositories }}' with_items: "{{ git_postgresql_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['postgresql_server']|string is search(inventory_hostname)" when: "groups['postgresql_server']|string is search(inventory_hostname)"
tags: tags:
- git-postgresql-server-repositories - git-postgresql-server-repositories
# --- # ---
# Group [nextcloud_server] reposotories # Group [nextcloud_server] reposotories
# --- # ---
- name: (git.yml) Install/Update nextcloud server repositories - name: (git.yml) Install/Update nextcloud server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_nextcloud_repositories }}' with_items: "{{ git_nextcloud_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['nextcloud_server']|string is search(inventory_hostname)" when: "groups['nextcloud_server']|string is search(inventory_hostname)"
tags: tags:
- git-nextcloud-server-repositories - git-nextcloud-server-repositories
# --- # ---
# Group [dns_server] reposotories # Group [dns_server] reposotories
# --- # ---
- name: (git.yml) Install/Update dns server repositories - name: (git.yml) Install/Update dns server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_dns_repositories }}' with_items: "{{ git_dns_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['dns_server']|string is search(inventory_hostname)" when: "groups['dns_server']|string is search(inventory_hostname)"
tags: tags:
- git-dns-server-repositories - git-dns-server-repositories
# --- # ---
# Group [backup_server] reposotories # Group [backup_server] reposotories
# --- # ---
- name: (git.yml) Install/Update backup server repositories - name: (git.yml) Install/Update backup server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_backup_repositories }}' with_items: "{{ git_backup_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['backup_server']|string is search(inventory_hostname)" when: "groups['backup_server']|string is search(inventory_hostname)"
ignore_errors: True ignore_errors: true
tags: tags:
- git-backup-server-repositories - git-backup-server-repositories
# --- # ---
# Group [samba_server] reposotories # Group [samba_server] reposotories
# --- # ---
- name: (git.yml) Install/Update samba server repositories - name: (git.yml) Install/Update samba server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_samba_repositories }}' with_items: "{{ git_samba_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['samba_server']|string is search(inventory_hostname)" when: "groups['samba_server']|string is search(inventory_hostname)"
ignore_errors: True ignore_errors: true
tags: tags:
- git-samba-server-repositories - git-samba-server-repositories
# --- # ---
# Group [mail_server] reposotories # Group [mail_server] reposotories
# --- # ---
- name: (git.yml) Install/Update mail server repositories - name: (git.yml) Install/Update mail server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_mailserver_repositories }}' with_items: "{{ git_mailserver_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['mail_server']|string is search(inventory_hostname)" when: "groups['mail_server']|string is search(inventory_hostname)"
tags: tags:
- git-mailservers-repositories - git-mailservers-repositories
# --- # ---
# Group [sympa_list_servers] reposotories # Group [sympa_list_servers] reposotories
# --- # ---
- name: (git.yml) Install/Update sympa server repositories - name: (git.yml) Install/Update sympa server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_sympa_repositories }}' with_items: "{{ git_sympa_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['sympa_list_server']|string is search(inventory_hostname)" when: "groups['sympa_list_server']|string is search(inventory_hostname)"
tags: tags:
- git-sympa-repositories - git-sympa-repositories
# --- # ---
# Group [jitsi_meet_server] reposotories # Group [jitsi_meet_server] reposotories
# --- # ---
- name: (git.yml) Install/Update sympa server repositories - name: (git.yml) Install/Update sympa server repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
with_items: '{{ git_jitsi_meet_repositories }}' with_items: "{{ git_jitsi_meet_repositories }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: "groups['jitsi_meet_server']|string is search(inventory_hostname)" when: "groups['jitsi_meet_server']|string is search(inventory_hostname)"
tags: tags:
- git-jitsi_meet-repositories - git-jitsi_meet-repositories
# --- # ---
# Group [so36_server_dehydrated] reposotories # Group [so36_server_dehydrated] reposotories
# --- # ---
@@ -325,32 +303,31 @@
# tags: # tags:
# - git-so36-dehydrated-repositories # - git-so36-dehydrated-repositories
# --- # ---
# Other (host specific) repositories # Other (host specific) repositories
# --- # ---
# Read in host specific vars file if exists # Read in host specific vars file if exists
- name: (git.yml) Check for host specific git vars file - name: (git.yml) Check for host specific git vars file
stat: ansible.builtin.stat:
path: "vars/git-{{ inventory_hostname }}.yml" path: "vars/git-{{ inventory_hostname }}.yml"
register: git_host_vars_file register: git_host_vars_file
tags: tags:
- git-other-repositories - git-other-repositories
- name: (git.yml) Include only files matching git-<hostname>.yml (2.2) - name: (git.yml) Include only files matching git-<hostname>.yml (2.2)
include_vars: ansible.builtin.include_vars:
file: "vars/git-{{ inventory_hostname }}.yml" file: "vars/git-{{ inventory_hostname }}.yml"
when: git_host_vars_file.stat.exists when: git_host_vars_file.stat.exists
tags: tags:
- git-other-repositories - git-other-repositories
- name: (git.yml) Install/Update other repositories - name: (git.yml) Install/Update other repositories
git: ansible.builtin.git:
repo: '{{ item.repo }}' repo: "{{ item.repo }}"
dest: '{{ item.dest }}' dest: "{{ item.dest }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
with_items: '{{ git_other_repositories }}' with_items: "{{ git_other_repositories }}"
tags: tags:
- git-other-repositories - git-other-repositories
roles/common/tasks/main.yml
+64 -32
View File
@@ -1,5 +1,6 @@
--- ---
- import_tasks: show.yml - name: (main.yml) Import show.yml tasks
ansible.builtin.import_tasks: show.yml
tags: tags:
- show - show
@@ -8,7 +9,8 @@
# timezone # timezone
# locales # locales
# systemd-nofiles # systemd-nofiles
- import_tasks: basic.yml - name: (main.yml) Import basic.yml tasks
ansible.builtin.import_tasks: basic.yml
tags: tags:
- basic - basic
@@ -27,7 +29,8 @@
# apt-remove # apt-remove
# apt-autoremove # apt-autoremove
# apt-clean # apt-clean
- import_tasks: apt.yml - name: (main.yml) Import apt.yml tasks
ansible.builtin.import_tasks: apt.yml
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: apt tags: apt
@@ -35,7 +38,8 @@
# tags supported inside extrepo.yml # tags supported inside extrepo.yml
# #
# extrepo # extrepo
- import_tasks: extrepo.yml - name: (main.yml) Import extrepo.yml tasks
ansible.builtin.import_tasks: extrepo.yml
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- (ansible_facts['distribution_major_version'] | int) >= 12 - (ansible_facts['distribution_major_version'] | int) >= 12
@@ -45,7 +49,8 @@
# tags supported inside apt-gateway.yml: # tags supported inside apt-gateway.yml:
# #
# #
- import_tasks: apt-gateway.yml - name: (main.yml) Import apt-gateway.yml tasks
ansible.builtin.import_tasks: apt-gateway.yml
when: inventory_hostname in groups['gateway_server'] when: inventory_hostname in groups['gateway_server']
tags: tags:
- apt - apt
@@ -55,7 +60,8 @@
# yum-update # yum-update
# yum-base-install # yum-base-install
# yum-initial-install # yum-initial-install
- import_tasks: yum.yml - name: (main.yml) Import yum.yml tasks
ansible.builtin.import_tasks: yum.yml
when: when:
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
- ansible_facts.distribution == "CentOS" or ansible_facts.distribution == "Fedora" - ansible_facts.distribution == "CentOS" or ansible_facts.distribution == "Fedora"
@@ -66,14 +72,16 @@
# apt-caching-nameserver # apt-caching-nameserver
# yum-caching-nameserver # yum-caching-nameserver
# #
- import_tasks: caching-nameserver.yml - name: (main.yml) Import caching-nameserver.yml tasks
ansible.builtin.import_tasks: caching-nameserver.yml
when: groups['caching_nameserver']|string is search(inventory_hostname) when: groups['caching_nameserver']|string is search(inventory_hostname)
tags: caching-nameserver tags: caching-nameserver
# tags supported inside systemd-resolved.yml # tags supported inside systemd-resolved.yml
# #
# systemd-resolved # systemd-resolved
- import_tasks: systemd-resolved.yml - name: (main.yml) Import systemd-resolved.yml tasks
ansible.builtin.import_tasks: systemd-resolved.yml
tags: tags:
- systemd-resolved - systemd-resolved
when: when:
@@ -81,14 +89,16 @@
- ansible_facts['distribution_major_version'] > "11" - ansible_facts['distribution_major_version'] > "11"
- systemd_resolved is defined and systemd_resolved|bool - systemd_resolved is defined and systemd_resolved|bool
- import_tasks: tor.yml - name: (main.yml) Import tor.yml tasks
ansible.builtin.import_tasks: tor.yml
when: when:
- inventory_hostname in groups['mail_server'] - inventory_hostname in groups['mail_server']
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- tor-service - tor-service
- import_tasks: cron.yml - name: (main.yml) Import cron.yml tasks
ansible.builtin.import_tasks: cron.yml
tags: tags:
- cron - cron
@@ -97,7 +107,8 @@
# vim-config # vim-config
# zsh-config # zsh-config
# #
- import_tasks: shell.yml - name: (main.yml) Import shell.yml tasks
ansible.builtin.import_tasks: shell.yml
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
@@ -115,7 +126,8 @@
# keypair-backup-server # keypair-backup-server
# root-defaut-ssh-keypair # root-defaut-ssh-keypair
# insert_root_ssh_public_key # insert_root_ssh_public_key
- import_tasks: users.yml - name: (main.yml) Import users.yml tasks
ansible.builtin.import_tasks: users.yml
tags: tags:
- users - users
@@ -124,7 +136,8 @@
# bash # bash
# profile # profile
# vim # vim
- import_tasks: users-systemfiles.yml - name: (main.yml) Import users-systemfiles.yml tasks
ansible.builtin.import_tasks: users-systemfiles.yml
tags: tags:
- users - users
- users-systemfiles - users-systemfiles
@@ -137,7 +150,8 @@
# sudo-users # sudo-users
# webadmin-defaut-ssh-keypair # webadmin-defaut-ssh-keypair
# insert_webadmin_ssh_public_key # insert_webadmin_ssh_public_key
- import_tasks: webadmin-user.yml - name: (main.yml) Import webadmin-user.yml tasks
ansible.builtin.import_tasks: webadmin-user.yml
when: groups['webadmin']|string is search(inventory_hostname) when: groups['webadmin']|string is search(inventory_hostname)
tags: tags:
- users - users
@@ -147,7 +161,8 @@
# tags supported inside sshd.yml # tags supported inside sshd.yml
# #
# sshd-config # sshd-config
- import_tasks: sshd.yml - name: (main.yml) Import sshd.yml tasks
ansible.builtin.import_tasks: sshd.yml
tags: sshd tags: sshd
# tags supported inside sudoers.yml: # tags supported inside sudoers.yml:
@@ -155,16 +170,19 @@
# sudoers-remove # sudoers-remove
# sudoers-file-configuration # sudoers-file-configuration
# sudoers-global-configuration # sudoers-global-configuration
- import_tasks: sudoers.yml - name: (main.yml) Import sudoers.yml tasks
ansible.builtin.import_tasks: sudoers.yml
tags: sudoers tags: sudoers
- import_tasks: motd.yml - name: (main.yml) Import motd.yml tasks
ansible.builtin.import_tasks: motd.yml
tags: motd tags: motd
# tags supported inside ntp.yml: # tags supported inside ntp.yml:
# #
# ntp-server # ntp-server
- import_tasks: ntp.yml - name: (main.yml) Import ntp.yml tasks
ansible.builtin.import_tasks: ntp.yml
tags: tags:
- ntp - ntp
when: when:
@@ -189,21 +207,24 @@
# git-mailservers-repositories # git-mailservers-repositories
# git-sympa-repositories # git-sympa-repositories
# git-other-repositories # git-other-repositories
- import_tasks: git.yml - name: (main.yml) Import git.yml tasks
ansible.builtin.import_tasks: git.yml
tags: git tags: git
# tags supported inside nfs.yml: # tags supported inside nfs.yml:
# #
# nfs-server # nfs-server
# nfs-client # nfs-client
- import_tasks: nfs.yml - name: (main.yml) Import nfs.yml tasks
ansible.builtin.import_tasks: nfs.yml
tags: tags:
- nfs - nfs
# tags supported inside x2go-server.yml: # tags supported inside x2go-server.yml:
# #
# x2go-server # x2go-server
- import_tasks: x2go-server.yml - name: (main.yml) Import x2go-server.yml tasks
ansible.builtin.import_tasks: x2go-server.yml
when: inventory_hostname in groups['x2go_server'] when: inventory_hostname in groups['x2go_server']
tags: tags:
- x2go - x2go
@@ -213,20 +234,23 @@
# copy-files # copy-files
# copy-plain-files # copy-plain-files
# copy-template-files # copy-template-files
- import_tasks: copy_files.yml - name: (main.yml) Import copy_files.yml tasks
ansible.builtin.import_tasks: copy_files.yml
tags: tags:
- copy-files - copy-files
# tags supported inside symlink_files.yml: # tags supported inside symlink_files.yml:
# #
# symlink-files # symlink-files
- import_tasks: symlink_files.yml - name: (main.yml) Import symlink_files.yml tasks
ansible.builtin.import_tasks: symlink_files.yml
tags: tags:
- symlink-files - symlink-files
# tags supported inside config_files_mailsystem_scripts.yml: # tags supported inside config_files_mailsystem_scripts.yml:
# #
- import_tasks: config_files_mailsystem_scripts.yml - name: (main.yml) Import config_files_mailsystem_scripts.yml tasks
ansible.builtin.import_tasks: config_files_mailsystem_scripts.yml
tags: tags:
- config-files-mailsystem - config-files-mailsystem
@@ -236,7 +260,8 @@
# samba-user # samba-user
# system-user # system-user
# #
- import_tasks: samba-user.yml - name: (main.yml) Import samba-user.yml tasks
ansible.builtin.import_tasks: samba-user.yml
when: inventory_hostname in groups['samba_server'] when: inventory_hostname in groups['samba_server']
tags: tags:
- samba-server - samba-server
@@ -248,7 +273,8 @@
# samba-server # samba-server
# samba-cron # samba-cron
# #
- import_tasks: samba-config-server.yml - name: (main.yml) Import samba-config-server.yml tasks
ansible.builtin.import_tasks: samba-config-server.yml
when: inventory_hostname in groups['samba_server'] when: inventory_hostname in groups['samba_server']
tags: tags:
- samba-server - samba-server
@@ -259,37 +285,43 @@
# samba-user # samba-user
# system-user # system-user
# #
- import_tasks: samba-remove-user.yml - name: (main.yml) Import samba-remove-user.yml tasks
ansible.builtin.import_tasks: samba-remove-user.yml
when: inventory_hostname in groups['samba_server'] when: inventory_hostname in groups['samba_server']
tags: tags:
- samba-server - samba-server
- remove-samba-user - remove-samba-user
- import_tasks: redis-server.yml - name: (main.yml) Import redis-server.yml tasks
ansible.builtin.import_tasks: redis-server.yml
when: inventory_hostname in groups['nextcloud_server'] or when: inventory_hostname in groups['nextcloud_server'] or
inventory_hostname in groups['apache2_webserver'] or inventory_hostname in groups['apache2_webserver'] or
inventory_hostname in groups['nginx_webserver'] inventory_hostname in groups['nginx_webserver']
tags: tags:
- redis-server - redis-server
- import_tasks: mysql.yml - name: (main.yml) Import mysql.yml tasks
ansible.builtin.import_tasks: mysql.yml
when: groups['mysql_server']|string is search(inventory_hostname) when: groups['mysql_server']|string is search(inventory_hostname)
tags: tags:
- mysql - mysql
- mariadb - mariadb
- import_tasks: apache2.yml - name: (main.yml) Import apache2.yml tasks
ansible.builtin.import_tasks: apache2.yml
when: groups['apache2_webserver']|string is search(inventory_hostname) when: groups['apache2_webserver']|string is search(inventory_hostname)
tags: tags:
- apache2 - apache2
- import_tasks: systemd-services_debian_based_OS.yml - name: (main.yml) Import systemd-services_debian_based_OS.yml tasks
ansible.builtin.import_tasks: systemd-services_debian_based_OS.yml
when: when:
- ansible_facts.os_family == "Debian" - ansible_facts.os_family == "Debian"
tags: tags:
- services - services
- import_tasks: systemd-services_redhat_based_OS.yml - name: (main.yml) Import systemd-services_redhat_based_OS.yml tasks
ansible.builtin.import_tasks: systemd-services_redhat_based_OS.yml
when: when:
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
tags: tags:
roles/common/tasks/motd.yml
+4 -6
View File
@@ -1,26 +1,24 @@
--- ---
# ---------- # ----------
# /etc/motd # /etc/motd
# ---------- # ----------
- name: (motd.yml) Check if /etc/motd.ORIG exist - name: (motd.yml) Check if /etc/motd.ORIG exist
stat: ansible.builtin.stat:
path: /etc/motd.ORIG path: /etc/motd.ORIG
register: motd_orig_exist register: motd_orig_exist
- name: (motd.yml) Check if /etc/motd exist - name: (motd.yml) Check if /etc/motd exist
stat: ansible.builtin.stat:
path: /etc/motd path: /etc/motd
register: motd_exist register: motd_exist
- name: (motd.yml) Backup existing file /etc/motd - name: (motd.yml) Backup existing file /etc/motd
command: cp -a /etc/motd /etc/motd.ORIG ansible.builtin.command: cp -a /etc/motd /etc/motd.ORIG
when: when:
- motd_exist.stat.exists == True - motd_exist.stat.exists == True
- motd_orig_exist.stat.exists == False - motd_orig_exist.stat.exists == False
- name: (motd.yml) create /etc/motd - name: (motd.yml) create /etc/motd
shell: figlet {{ ansible_hostname }} > /etc/motd ansible.builtin.shell: figlet {{ ansible_hostname }} > /etc/motd
when: motd_orig_exist.stat.exists == False when: motd_orig_exist.stat.exists == False
roles/common/tasks/mysql.yml
+7 -11
View File
@@ -1,5 +1,4 @@
--- ---
# --- # ---
# MySQL / MariaDB Server # MySQL / MariaDB Server
# --- # ---
@@ -7,31 +6,28 @@
- name: Populate service facts - name: Populate service facts
ansible.builtin.service_facts: ansible.builtin.service_facts:
#- name: Print service facts # - name: Print service facts
# ansible.builtin.debug: # ansible.builtin.debug:
# var: ansible_facts.services # var: ansible_facts.services
# when: # when:
# - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' # - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'
- name: (mysql.yml) Ensure directory '/etc/systemd/system/mariadb.service.d' is present - name: (mysql.yml) Ensure directory '/etc/systemd/system/mariadb.service.d' is present
file: ansible.builtin.file:
path: /etc/systemd/system/mariadb.service.d path: /etc/systemd/system/mariadb.service.d
state: directory state: directory
owner: root owner: root
group: root group: root
mode: '0755' mode: "0755"
when: when:
- ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'
- name: (mysql.yml) Ensure file '/etc/systemd/system/mariadb.service.d/limits.conf' exists - name: (mysql.yml) Ensure file '/etc/systemd/system/mariadb.service.d/limits.conf' exists
copy: ansible.builtin.copy:
src: 'etc/systemd/system/mariadb.service.d/limits.conf' src: "etc/systemd/system/mariadb.service.d/limits.conf"
dest: '/etc/systemd/system/mariadb.service.d/limits.conf' dest: "/etc/systemd/system/mariadb.service.d/limits.conf"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
notify: "Restart mariadb" notify: "Restart mariadb"
when: when:
- ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'
roles/common/tasks/nfs.yml
+20 -26
View File
@@ -1,11 +1,10 @@
--- ---
# --- # ---
# NFS Server # NFS Server
# --- # ---
- name: (nfs.yml) Ensure NFS utilities (server) are installed. - name: (nfs.yml) Ensure NFS utilities (server) are installed.
apt: ansible.builtin.apt:
name: name:
- nfs-common - nfs-common
- nfs-kernel-server - nfs-kernel-server
@@ -17,27 +16,27 @@
- nfs-server - nfs-server
- name: (nfs.yml) Ensure directories to export exist - name: (nfs.yml) Ensure directories to export exist
file: ansible.builtin.file:
path: '{{ item.src.split(":")[1] }}' path: '{{ item.src.split(":")[1] }}'
owner: root owner: root
group: root group: root
mode: '0755' mode: "0755"
state: directory state: directory
with_items: "{{ nfs_exports }}" with_items: "{{ nfs_exports }}"
loop_control: loop_control:
label: '{{ item.path }}' label: "{{ item.path }}"
when: when:
- "groups['nfs_server']|string is search(inventory_hostname)" - "groups['nfs_server']|string is search(inventory_hostname)"
tags: tags:
- nfs-server - nfs-server
- name: (nfs.yml) Copy exports file. - name: (nfs.yml) Copy exports file.
template: ansible.builtin.template:
src: etc/exports.j2 src: etc/exports.j2
dest: /etc/exports dest: /etc/exports
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
when: when:
- "groups['nfs_server']|string is search(inventory_hostname)" - "groups['nfs_server']|string is search(inventory_hostname)"
notify: Reload nfs notify: Reload nfs
@@ -45,15 +44,15 @@
- nfs-server - nfs-server
- name: Enable service rpc-statd and ensure it is not masked - name: Enable service rpc-statd and ensure it is not masked
systemd: ansible.builtin.systemd:
name: rpc-statd name: rpc-statd
enabled: yes enabled: true
masked: no masked: false
when: when:
- "groups['nfs_server']|string is search(inventory_hostname)" - "groups['nfs_server']|string is search(inventory_hostname)"
- name: Make sure service rpc-statd is running - name: Make sure service rpc-statd is running
systemd: ansible.builtin.systemd:
state: started state: started
name: rpc-statd name: rpc-statd
when: when:
@@ -66,7 +65,7 @@
# --- # ---
- name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists - name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/default/nfs-kernel-server path: /etc/default/nfs-kernel-server
register: default_nfs_kernel_server_exists register: default_nfs_kernel_server_exists
when: when:
@@ -75,7 +74,7 @@
- nfs-server - nfs-server
- name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server - name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server
command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG ansible.builtin.command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG
when: when:
- "groups['nfs_server']|string is search(inventory_hostname)" - "groups['nfs_server']|string is search(inventory_hostname)"
- default_nfs_kernel_server_exists.stat.exists == False - default_nfs_kernel_server_exists.stat.exists == False
@@ -83,9 +82,9 @@
- nfs-server - nfs-server
- name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server) - name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server)
replace: ansible.builtin.replace:
path: /etc/default/nfs-kernel-server path: /etc/default/nfs-kernel-server
regexp: '^RPCNFSDCOUNT=.*' regexp: "^RPCNFSDCOUNT=.*"
replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}" replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}"
when: when:
- "groups['nfs_server']|string is search(inventory_hostname)" - "groups['nfs_server']|string is search(inventory_hostname)"
@@ -97,10 +96,10 @@
# --- # ---
- name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists - name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists
file: ansible.builtin.file:
path: /etc/nfs.conf.d path: /etc/nfs.conf.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -108,27 +107,25 @@
tags: tags:
- nfs-server - nfs-server
- name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2' - name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2'
template: ansible.builtin.template:
src: etc/nfs.conf.d/20-start_servers.conf.j2 src: etc/nfs.conf.d/20-start_servers.conf.j2
dest: /etc/nfs.conf.d/20-start_servers.conf dest: /etc/nfs.conf.d/20-start_servers.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: "Restart nfs-kernel-server" notify: "Restart nfs-kernel-server"
when: when:
- inventory_hostname in groups['nfs_server'] - inventory_hostname in groups['nfs_server']
tags: tags:
- nfs-server - nfs-server
# --- # ---
# NFS clients # NFS clients
# --- # ---
- name: (nfs.yml) Ensure NFS utilities (clients) are installed. - name: (nfs.yml) Ensure NFS utilities (clients) are installed.
apt: ansible.builtin.apt:
pkg: nfs-common pkg: nfs-common
state: present state: present
when: when:
@@ -148,11 +145,8 @@
state: mounted state: mounted
loop: "{{ nfs_exports }}" loop: "{{ nfs_exports }}"
loop_control: loop_control:
label: '{{ item.src }}' label: "{{ item.src }}"
when: when:
- "groups['nfs_client']|string is search(inventory_hostname)" - "groups['nfs_client']|string is search(inventory_hostname)"
tags: tags:
- nfs-client - nfs-client
roles/common/tasks/ntp.yml
+7 -11
View File
@@ -1,11 +1,10 @@
--- ---
# --- # ---
# NTP Server # NTP Server
# --- # ---
- name: (ntp.yml) Ensure ntpsec package is installed. - name: (ntp.yml) Ensure ntpsec package is installed.
apt: ansible.builtin.apt:
name: name:
- ntpsec - ntpsec
state: present state: present
@@ -15,7 +14,7 @@
- ntp-server - ntp-server
- name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists - name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/ntpsec/ntp.conf.ORIG path: /etc/ntpsec/ntp.conf.ORIG
register: etc_ntpsec_conf_ORIG register: etc_ntpsec_conf_ORIG
when: when:
@@ -23,20 +22,18 @@
tags: tags:
- ntp-server - ntp-server
- name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present - name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present
file: ansible.builtin.file:
path: /var/log/ntpsec path: /var/log/ntpsec
state: directory state: directory
owner: ntpsec owner: ntpsec
group: ntpsec group: ntpsec
mode: '0755' mode: "0755"
when: when:
- ansible_facts.distribution == "Debian" - ansible_facts.distribution == "Debian"
- name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf' - name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf'
command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG ansible.builtin.command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG
when: when:
- groups['oopen_office_server']|string is search(inventory_hostname) - groups['oopen_office_server']|string is search(inventory_hostname)
- etc_ntpsec_conf_ORIG.stat.exists == False - etc_ntpsec_conf_ORIG.stat.exists == False
@@ -45,16 +42,15 @@
- ntp-server - ntp-server
- name: (ntp.yml) Update '/etc/ntpsec/ntp.conf' - name: (ntp.yml) Update '/etc/ntpsec/ntp.conf'
template: ansible.builtin.template:
src: "etc/ntpsec/ntp.conf.j2" src: "etc/ntpsec/ntp.conf.j2"
dest: /etc/ntpsec/ntp.conf dest: /etc/ntpsec/ntp.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: Restart ntp notify: Restart ntp
when: when:
- groups['oopen_office_server']|string is search(inventory_hostname) - groups['oopen_office_server']|string is search(inventory_hostname)
- local_ntp_service is defined and local_ntp_service|bool - local_ntp_service is defined and local_ntp_service|bool
tags: tags:
- ntp-server - ntp-server
roles/common/tasks/redis-server.yml
+24 -27
View File
@@ -1,12 +1,11 @@
--- ---
- name: (redis-server.yml) Set var '_redis_conf' - name: (redis-server.yml) Set var '_redis_conf'
set_fact: ansible.builtin.set_fact:
_redis_conf: "{{ '/etc/redis.conf' if ansible_facts['distribution'] == 'CentOS' else '/etc/redis/redis.conf' }}" _redis_conf: "{{ '/etc/redis.conf' if ansible_facts['distribution'] == 'CentOS' else '/etc/redis/redis.conf' }}"
- name: (redis-server.yml) update - name: (redis-server.yml) update
apt: ansible.builtin.apt:
update_cache: true update_cache: true
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}" cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
when: when:
@@ -26,9 +25,8 @@
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) upgrade - name: (redis-server.yml) upgrade
apt: ansible.builtin.apt:
upgrade: "{{ apt_upgrade_type }}" upgrade: "{{ apt_upgrade_type }}"
update_cache: true update_cache: true
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}" dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
@@ -38,9 +36,8 @@
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) Install redis-server packages (debian system) - name: (redis-server.yml) Install redis-server packages (debian system)
apt: ansible.builtin.apt:
name: redis-server name: redis-server
state: present state: present
when: when:
@@ -49,10 +46,10 @@
- redis-server - redis-server
- name: (redis-server.yml) Install redis packages (centos / fedora system) - name: (redis-server.yml) Install redis packages (centos / fedora system)
yum: ansible.builtin.dnf:
name: redis name: redis
state: latest state: latest
update_cache: yes update_cache: true
when: when:
- ansible_facts["os_family"] == "RedHat" - ansible_facts["os_family"] == "RedHat"
- ansible_distribution == "CentOS" or ansible_distribution == "Fedora" - ansible_distribution == "CentOS" or ansible_distribution == "Fedora"
@@ -60,72 +57,72 @@
- redis-server - redis-server
- name: (redis-server.yml) Determine available users - name: (redis-server.yml) Determine available users
getent: ansible.builtin.getent:
database: passwd database: passwd
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) Determine available groups - name: (redis-server.yml) Determine available groups
getent: ansible.builtin.getent:
database: group database: group
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) Add user 'www-data' to group 'redis' - name: (redis-server.yml) Add user 'www-data' to group 'redis'
user: ansible.builtin.user:
name: www-data name: www-data
groups: redis groups: redis
append: yes append: true
when: when:
- "'www-data' in my_users" - "'www-data' in my_users"
- "'redis' in my_groups" - "'redis' in my_groups"
vars: vars:
my_users: "{{ ansible_facts.getent_passwd.keys()|list }}" my_users: "{{ ansible_facts.getent_passwd.keys() | list }}"
my_groups: "{{ ansible_facts.getent_group.keys()|list }}" my_groups: "{{ ansible_facts.getent_group.keys() | list }}"
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) Add user 'webadmin' to group 'redis' - name: (redis-server.yml) Add user 'webadmin' to group 'redis'
user: ansible.builtin.user:
name: webadmin name: webadmin
groups: redis groups: redis
append: yes append: true
when: when:
- "'webadmin' in my_users" - "'webadmin' in my_users"
- "'redis' in my_groups" - "'redis' in my_groups"
vars: vars:
my_users: "{{ ansible_facts.getent_passwd.keys()|list }}" my_users: "{{ ansible_facts.getent_passwd.keys() | list }}"
my_groups: "{{ ansible_facts.getent_group.keys()|list }}" my_groups: "{{ ansible_facts.getent_group.keys() | list }}"
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) Check if redis configuration file exists - name: (redis-server.yml) Check if redis configuration file exists
stat: ansible.builtin.stat:
path: "{{ _redis_conf }}.ORIG" path: "{{ _redis_conf }}.ORIG"
register: redis_conf_exists register: redis_conf_exists
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) Backup existing redis configuration file. - name: (redis-server.yml) Backup existing redis configuration file.
command: cp -a "{{ _redis_conf }}" "{{ _redis_conf }}".ORIG ansible.builtin.command: cp -a "{{ _redis_conf }}" "{{ _redis_conf }}".ORIG
when: when:
- redis_conf_exists.stat.exists == False - redis_conf_exists.stat.exists == False
tags: tags:
- redis-server - redis-server
- name: (redis-server.yml) adjust redis configuration - name: (redis-server.yml) adjust redis configuration
lineinfile: ansible.builtin.lineinfile:
dest: "{{ _redis_conf }}" dest: "{{ _redis_conf }}"
regexp: "{{ item.regexp }}" regexp: "{{ item.regexp }}"
insertafter: "{{ item.insertafter }}" insertafter: "{{ item.insertafter }}"
line: "{{ item.key }} {{ item.val }}" line: "{{ item.key }} {{ item.val }}"
state: present state: present
loop: loop:
- { regexp: '^bind\s+', key: 'bind', val: '127.0.0.1 ::1', insertafter: '^#\s*bind\s+' } - { regexp: "^bind\\s+", key: "bind", val: "127.0.0.1 ::1", insertafter: "^#\\s*bind\\s+" }
- { regexp: '^port\s+', key: 'port', val: '6379', insertafter: '^#\s*port\s+' } - { regexp: "^port\\s+", key: "port", val: "6379", insertafter: "^#\\s*port\\s+" }
- { regexp: '^unixsocket\s+', key: 'unixsocket', val: '/run/redis/redis-server.sock', insertafter: '^#\s*unixsocketperm' } - { regexp: "^unixsocket\\s+", key: "unixsocket", val: "/run/redis/redis-server.sock", insertafter: "^#\\s*unixsocketperm" }
- { regexp: '^unixsocketperm', key: 'unixsocketperm', val: '770', insertafter: '^unixsocket\s+' } - { regexp: "^unixsocketperm", key: "unixsocketperm", val: "770", insertafter: "^unixsocket\\s+" }
- { regexp: '^logfile', key: 'logfile', val: '/var/log/redis/redis-server.log', insertafter: '^#\s+logfile\s+' } - { regexp: "^logfile", key: "logfile", val: "/var/log/redis/redis-server.log", insertafter: "^#\\s+logfile\\s+" }
notify: "Restart redis-server" notify: "Restart redis-server"
tags: tags:
- redis-server - redis-server
roles/common/tasks/samba-config-server.yml
+31 -35
View File
@@ -4,7 +4,7 @@
# --- # ---
- name: (samba-config-server.yml) Ensure samba packages server are installed. - name: (samba-config-server.yml) Ensure samba packages server are installed.
package: ansible.builtin.package:
pkg: "{{ apt_install_server_samba }}" pkg: "{{ apt_install_server_samba }}"
state: present state: present
when: when:
@@ -13,7 +13,7 @@
- samba-server - samba-server
- name: (samba-config-server.yml) Ensure quarantine directory exists - name: (samba-config-server.yml) Ensure quarantine directory exists
file: ansible.builtin.file:
path: /data/samba/QUARANTINE path: /data/samba/QUARANTINE
owner: root owner: root
group: root group: root
@@ -27,13 +27,13 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure samba share directories exists - name: (samba-config-server.yml) Ensure samba share directories exists
file: ansible.builtin.file:
path: "{{ item.path }}" path: "{{ item.path }}"
owner: "root" owner: "root"
group: "{{ item.group_write_list | default('root', true) }}" group: "{{ item.group_write_list | default('root', true) }}"
mode: "{{ item.dir_create_mask | default('2770', true) }}" mode: "{{ item.dir_create_mask | default('2770', true) }}"
state: directory state: directory
recurse: no recurse: false
with_items: "{{ samba_shares }}" with_items: "{{ samba_shares }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -47,7 +47,7 @@
# --- # ---
- name: (samba-config-server.yml) Ensure virusfilter (ClamAV) packages are installed - name: (samba-config-server.yml) Ensure virusfilter (ClamAV) packages are installed
package: ansible.builtin.package:
pkg: "{{ apt_install_server_samba_virusfilter }}" pkg: "{{ apt_install_server_samba_virusfilter }}"
state: present state: present
when: when:
@@ -58,7 +58,7 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Check if ClamAV virus databases are present - name: (samba-config-server.yml) Check if ClamAV virus databases are present
find: ansible.builtin.find:
paths: /var/lib/clamav paths: /var/lib/clamav
patterns: patterns:
- "*.cvd" - "*.cvd"
@@ -72,7 +72,7 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download - name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download
service: ansible.builtin.service:
name: clamav-freshclam name: clamav-freshclam
state: stopped state: stopped
failed_when: false failed_when: false
@@ -85,10 +85,10 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update - name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update
service: ansible.builtin.service:
name: clamav-daemon name: clamav-daemon
state: started state: started
enabled: yes enabled: true
failed_when: false failed_when: false
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
@@ -98,7 +98,7 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam - name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam
command: freshclam ansible.builtin.command: freshclam
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -108,10 +108,10 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started - name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started
service: ansible.builtin.service:
name: clamav-daemon name: clamav-daemon
state: started state: started
enabled: yes enabled: true
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -120,10 +120,10 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started - name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started
service: ansible.builtin.service:
name: clamav-freshclam name: clamav-freshclam
state: started state: started
enabled: yes enabled: true
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -132,27 +132,26 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav user is member of all Samba groups - name: (samba-config-server.yml) Ensure clamav user is member of all Samba groups
user: ansible.builtin.user:
name: clamav name: clamav
groups: "{{ item.name }}" groups: "{{ item.name }}"
append: yes append: true
loop: "{{ samba_groups }}" loop: "{{ samba_groups }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
- samba_groups | length > 0 - samba_groups | length > 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure clamav user is member of all Samba user groups (homes virusfilter) - name: (samba-config-server.yml) Ensure clamav user is member of all Samba user groups (homes virusfilter)
user: ansible.builtin.user:
name: clamav name: clamav
groups: "{{ item.name }}" groups: "{{ item.name }}"
append: yes append: true
loop: "{{ samba_user }}" loop: "{{ samba_user }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
@@ -181,7 +180,7 @@
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter) - name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter)
file: ansible.builtin.file:
path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}" path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}"
mode: "0750" mode: "0750"
state: directory state: directory
@@ -196,9 +195,8 @@
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths) - name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths)
template: ansible.builtin.template:
src: etc/apparmor.d/local/usr.sbin.clamd.j2 src: etc/apparmor.d/local/usr.sbin.clamd.j2
dest: /etc/apparmor.d/local/usr.sbin.clamd dest: /etc/apparmor.d/local/usr.sbin.clamd
owner: root owner: root
@@ -209,14 +207,13 @@
- Restart clamav-daemon - Restart clamav-daemon
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
- name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf - name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
lineinfile: ansible.builtin.lineinfile:
path: /etc/clamav/clamd.conf path: /etc/clamav/clamd.conf
regexp: "^#?\\s*AllowAllMatchScan\\s" regexp: "^#?\\s*AllowAllMatchScan\\s"
line: "AllowAllMatchScan true" line: "AllowAllMatchScan true"
@@ -224,8 +221,7 @@
notify: Restart clamav-daemon notify: Restart clamav-daemon
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
@@ -235,7 +231,7 @@
# --- # ---
- name: (samba-config-server.yml) Check if file '/etc/samba/smb.conf.ORIG exists' - name: (samba-config-server.yml) Check if file '/etc/samba/smb.conf.ORIG exists'
stat: ansible.builtin.stat:
path: /etc/samba/smb.conf.ORIG path: /etc/samba/smb.conf.ORIG
register: smb_conf_exists register: smb_conf_exists
when: when:
@@ -244,7 +240,7 @@
- samba-server - samba-server
- name: (samba-config-server.yml) Backup existing file /etc/samba/smb.conf - name: (samba-config-server.yml) Backup existing file /etc/samba/smb.conf
command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG ansible.builtin.command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- smb_conf_exists.stat.exists == False - smb_conf_exists.stat.exists == False
@@ -252,12 +248,12 @@
- samba-server - samba-server
- name: (samba-config-server.yml) /etc/samba/smb.conf - name: (samba-config-server.yml) /etc/samba/smb.conf
template: ansible.builtin.template:
dest: /etc/samba/smb.conf dest: /etc/samba/smb.conf
src: etc/samba/smb.conf.j2 src: etc/samba/smb.conf.j2
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
notify: notify:
@@ -267,12 +263,12 @@
- samba-server - samba-server
- name: (samba-config-server.yml) Ensure file /etc/samba/users.map exists - name: (samba-config-server.yml) Ensure file /etc/samba/users.map exists
copy: ansible.builtin.copy:
src: "{{ role_path + '/files/etc/samba/users.map' }}" src: "{{ role_path + '/files/etc/samba/users.map' }}"
dest: /etc/samba/users.map dest: /etc/samba/users.map
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
notify: notify:
@@ -296,7 +292,7 @@
- samba-cron - samba-cron
- name: (samba-config-server.yml) Adjust configuration for script 'clean_samba_trash.sh' - name: (samba-config-server.yml) Adjust configuration for script 'clean_samba_trash.sh'
template: ansible.builtin.template:
dest: /root/bin/samba/conf/clean_samba_trash.conf dest: /root/bin/samba/conf/clean_samba_trash.conf
src: root/bin/samba/conf/clean_samba_trash.conf.j2 src: root/bin/samba/conf/clean_samba_trash.conf.j2
when: when:
roles/common/tasks/samba-remove-user.yml
+9 -15
View File
@@ -1,32 +1,27 @@
--- ---
# --- # ---
# - Remove unwanted users # - Remove unwanted users
# --- # ---
- name: "(samba-remove-user.yml) Check if samba user exists for removable system user" - name: "(samba-remove-user.yml) Check if samba user exists for removable system user"
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -q '{{ item.name }}' ansible.builtin.shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -q '{{ item.name }}'
register: samba_remove_system_users_present register: samba_remove_system_users_present
changed_when: "samba_remove_system_users_present.rc == 0" changed_when: "samba_remove_system_users_present.rc == 0"
failed_when: "samba_remove_system_users_present.rc > 1" failed_when: "samba_remove_system_users_present.rc > 1"
with_items: with_items:
- "{{ remove_samba_users }}" - "{{ remove_samba_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- system-user - system-user
- samba-user - samba-user
- name: (samba-remove-user.yml) Remove (old) system users from samba - name: (samba-remove-user.yml) Remove (old) system users from samba
shell: > ansible.builtin.shell: >
smbpasswd -s -x {{ item.item.name }} smbpasswd -s -x {{ item.item.name }}
with_items: with_items:
- "{{ samba_remove_system_users_present.results }}" - "{{ samba_remove_system_users_present.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.changed - item.changed
tags: tags:
@@ -34,26 +29,25 @@
- samba-user - samba-user
- name: (samba-remove-user.yml) Remove users from system - name: (samba-remove-user.yml) Remove users from system
user: ansible.builtin.user:
name: '{{ item.name }}' name: "{{ item.name }}"
state: absent state: absent
with_items: with_items:
- "{{ remove_samba_users }}" - "{{ remove_samba_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- system-user - system-user
- samba-user - samba-user
- name: (samba-remove-user.yml) Remove home directory from deleted users - name: (samba-remove-user.yml) Remove home directory from deleted users
file: ansible.builtin.file:
path: "{{ base_home | default('/home', true) }}/{{ item.name }}" path: "{{ base_home | default('/home', true) }}/{{ item.name }}"
state: absent state: absent
with_items: with_items:
- "{{ remove_samba_users }}" - "{{ remove_samba_users }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- system-user - system-user
- samba-user - samba-user
roles/common/tasks/samba-user.yml
+24 -29
View File
@@ -1,5 +1,4 @@
--- ---
# --- # ---
# - default user/groups # - default user/groups
# --- # ---
@@ -7,13 +6,13 @@
# To be precise, samba groups are system groups. # To be precise, samba groups are system groups.
# #
- name: (samba-user.yml) Ensure samba groups exists - name: (samba-user.yml) Ensure samba groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: "{{ item.group_id | default(omit) }}"
loop: "{{ samba_groups }}" loop: "{{ samba_groups }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: item.group_id is defined when: item.group_id is defined
tags: tags:
- samba-server - samba-server
@@ -26,21 +25,20 @@
# the result ist avalable in variable getent_passwd # the result ist avalable in variable getent_passwd
# #
- name: (samba_user.yml) Get database of (system) users - name: (samba_user.yml) Get database of (system) users
getent: ansible.builtin.getent:
database: passwd database: passwd
tags: tags:
- samba-server - samba-server
- samba-user - samba-user
- system-user - system-user
# Samba users mut be also system users # Samba users mut be also system users
# #
- name: (samba_user.yml) Add (system) users if not yet exists.. - name: (samba_user.yml) Add (system) users if not yet exists..
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'" ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
loop: "{{ samba_user }}" loop: "{{ samba_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- ansible_facts.getent_passwd is defined - ansible_facts.getent_passwd is defined
- item.name not in ansible_facts.getent_passwd - item.name not in ansible_facts.getent_passwd
@@ -50,54 +48,51 @@
- system-user - system-user
- name: (samba_user.yml) Ensure samba users exists in system with given group membership - name: (samba_user.yml) Ensure samba users exists in system with given group membership
user: ansible.builtin.user:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: "{{ item.user_id | default(omit) }}"
#group: '{{ item.0.name | default(omit) }}' #group: '{{ item.0.name | default(omit) }}'
groups: "{{ item.groups|join(', ') }}" groups: "{{ item.groups | join(', ') }}"
password: "{{ item.password | password_hash('sha512') }}" password: "{{ item.password | password_hash('sha512') }}"
update_password: on_create update_password: on_create
append: yes append: true
loop: "{{ samba_user }}" loop: "{{ samba_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- samba-server - samba-server
- samba-user - samba-user
- system-user - system-user
- name: (samba-user.yml) Check if samba user exists - name: (samba-user.yml) Check if samba user exists
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}" ansible.builtin.shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
register: samba_user_present register: samba_user_present
changed_when: "samba_user_present.rc == 1" changed_when: "samba_user_present.rc == 1"
failed_when: "samba_user_present.rc > 1" failed_when: "samba_user_present.rc > 1"
loop: "{{ samba_user }}" loop: "{{ samba_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- samba-server - samba-server
- samba-user - samba-user
- name: (samba-user.yml) Add user to samba (with system users password) - name: (samba-user.yml) Add user to samba (with system users password)
shell: > ansible.builtin.shell: >
(echo '{{ item.item.password }}'; echo '{{ item.item.password }}') (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') | smbpasswd -s -a {{ item.item.name }}
| smbpasswd -s -a {{ item.item.name }}
loop: "{{ samba_user_present.results }}" loop: "{{ samba_user_present.results }}"
when: item.changed when: item.changed
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
tags: tags:
- samba-server - samba-server
- samba-user - samba-user
# Only on fileservers: # Only on fileservers:
# zapata.opp.netz # zapata.opp.netz
- name: (samba_user.yml) Check if folder '/data/backup' exists using file module - name: (samba_user.yml) Check if folder '/data/backup' exists using file module
stat: ansible.builtin.stat:
path: /data/backup path: /data/backup
register: data_backup_dir register: data_backup_dir
when: when:
@@ -108,15 +103,15 @@
- system-user - system-user
- name: (samba_user.yml) Ensure folder /data/backup/<user-name> exists for all (samba) users on host zapata - name: (samba_user.yml) Ensure folder /data/backup/<user-name> exists for all (samba) users on host zapata
file: ansible.builtin.file:
path: '/data/backup/{{ item.name }}' path: "/data/backup/{{ item.name }}"
state: directory state: directory
owner: '{{ item.name }}' owner: "{{ item.name }}"
group: '{{ item.name }}' group: "{{ item.name }}"
mode: "2770" mode: "2770"
loop: "{{ samba_user }}" loop: "{{ samba_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- inventory_hostname == 'zapata.opp.netz' - inventory_hostname == 'zapata.opp.netz'
- data_backup_dir.stat.isdir is defined and data_backup_dir.stat.isdir - data_backup_dir.stat.isdir is defined and data_backup_dir.stat.isdir
roles/common/tasks/shell.yml
+4 -6
View File
@@ -1,30 +1,28 @@
--- ---
- name: (shell.yml) Set default VIM configuration - file /etc/vim/vimrc exists - name: (shell.yml) Set default VIM configuration - file /etc/vim/vimrc exists
copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
dest: /etc/vim/vimrc dest: /etc/vim/vimrc
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
with_fileglob: "etc/vim/vimrc" with_fileglob: "etc/vim/vimrc"
tags: tags:
- shell-config - shell-config
- vim-config - vim-config
- name: (shell.yml) Set default VIM configuration - file /etc/vim/vimrc.local exists - name: (shell.yml) Set default VIM configuration - file /etc/vim/vimrc.local exists
copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
dest: /etc/vim/vimrc.local dest: /etc/vim/vimrc.local
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
with_fileglob: "etc/vim/vimrc.local" with_fileglob: "etc/vim/vimrc.local"
tags: tags:
- shell-config - shell-config
- vim-config - vim-config
#- name: (shell.yml) Set default ZSH configuration - file /etc/zsh/zshrc #- name: (shell.yml) Set default ZSH configuration - file /etc/zsh/zshrc
# copy: # copy:
# src: "{{ item }}" # src: "{{ item }}"
roles/common/tasks/show.yml
+3 -4
View File
@@ -1,7 +1,6 @@
--- ---
- name: Show hostname - name: Show hostname
debug: ansible.builtin.debug:
msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] }}.{{ ansible_facts.fqdn.split('.')[1] | default('NONE') }}.{{ ansible_facts.fqdn.split('.')[2] | default('NONE') }}" msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] }}.{{ ansible_facts.fqdn.split('.')[1] | default('NONE') }}.{{
ansible_facts.fqdn.split('.')[2] | default('NONE') }}"
# msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] | join( '.') }} | {{ join ( ansible_facts.fqdn.split('.')[1] ) }}" # msg: "Host: {{ ansible_facts.fqdn | split('.') | first }} FQDN: {{ ansible_facts.fqdn.split('.')[0] | join( '.') }} | {{ join ( ansible_facts.fqdn.split('.')[1] ) }}"
roles/common/tasks/sshd.yml
+30 -35
View File
@@ -1,53 +1,51 @@
--- ---
# --- # ---
# Set some facts # Set some facts
# --- # ---
- name: (sshd.yml) Set fact_sshd_pubkey_accepted_algorithms (comma separated list) - name: (sshd.yml) Set fact_sshd_pubkey_accepted_algorithms (comma separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_pubkey_accepted_algorithms: "{{ sshd_pubkey_accepted_algorithms | join (',') }}" fact_sshd_pubkey_accepted_algorithms: "{{ sshd_pubkey_accepted_algorithms | join(',') }}"
when: when:
- sshd_pubkey_accepted_algorithms is defined and sshd_pubkey_accepted_algorithms | length > 0 - sshd_pubkey_accepted_algorithms is defined and sshd_pubkey_accepted_algorithms | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list) - name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}" fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}"
when: when:
- sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0 - sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_ciphers (comma separated list) - name: (sshd.yml) Set fact_sshd_ciphers (comma separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}" fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}"
when: when:
- sshd_ciphers is defined and sshd_ciphers | length > 0 - sshd_ciphers is defined and sshd_ciphers | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_macs - name: (sshd.yml) Set fact_sshd_macs
set_fact: ansible.builtin.set_fact:
fact_sshd_macs: "{{ sshd_macs | join (',') }}" fact_sshd_macs: "{{ sshd_macs | join(',') }}"
when: when:
- sshd_macs is defined and sshd_macs | length > 0 - sshd_macs is defined and sshd_macs | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list) - name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}" fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}"
when: when:
- sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0 - sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list) - name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}" fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}"
when: when:
- sshd_allowed_users is defined and sshd_allowed_users | length > 0 - sshd_allowed_users is defined and sshd_allowed_users | length > 0
tags: tags:
@@ -58,27 +56,26 @@
# --- # ---
- name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists - name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
stat: ansible.builtin.stat:
path: /etc/ssh/sshd_config.ORIG path: /etc/ssh/sshd_config.ORIG
register: etc_sshd_sshd_config_ORIG register: etc_sshd_sshd_config_ORIG
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config' - name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG ansible.builtin.command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
when: etc_sshd_sshd_config_ORIG.stat.exists == False when: etc_sshd_sshd_config_ORIG.stat.exists == False
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Create new sshd_config from template sshd_config.j2 - name: (sshd.yml) Create new sshd_config from template sshd_config.j2
template: ansible.builtin.template:
src: etc/ssh/sshd_config.j2 src: etc/ssh/sshd_config.j2
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
validate: 'sshd -f %s -T' validate: "sshd -f %s -T"
#backup: yes #backup: yes
notify: "Restart ssh" notify: "Restart ssh"
when: when:
@@ -86,15 +83,14 @@
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2 - name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2
template: ansible.builtin.template:
src: etc/ssh/sshd_config.j2 src: etc/ssh/sshd_config.j2
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
validate: 'sshd -f %s -T' validate: "sshd -f %s -T"
notify: "Restart ssh" notify: "Restart ssh"
when: when:
- create_sftp_group is undefined or create_sftp_group is defined and not create_sftp_group - create_sftp_group is undefined or create_sftp_group is defined and not create_sftp_group
@@ -104,13 +100,13 @@
- sshd-config - sshd-config
- name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2 - name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2
template: ansible.builtin.template:
src: etc/ssh/sshd_config.j2 src: etc/ssh/sshd_config.j2
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
validate: 'sshd -f %s -T -C user=sftp_users' validate: "sshd -f %s -T -C user=sftp_users"
notify: "Restart ssh" notify: "Restart ssh"
when: when:
- create_sftp_group is defined and create_sftp_group - create_sftp_group is defined and create_sftp_group
@@ -119,23 +115,22 @@
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'.. - name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
lineinfile: ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^Subsystem\s+sftp(.+)$' regexp: "^Subsystem\\s+sftp(.+)$"
state: absent state: absent
check_mode: yes check_mode: true
changed_when: false changed_when: false
register: sshd_config_sftp register: sshd_config_sftp
tags: tags:
- sshd-config - sshd-config
- name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists - name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
file: ansible.builtin.file:
path: /etc/ssh/sshd_config.d path: /etc/ssh/sshd_config.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
when: when:
@@ -145,12 +140,12 @@
- sshd-config - sshd-config
- name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2 - name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2
template: ansible.builtin.template:
src: etc/ssh/sshd_config.j2 src: etc/ssh/sshd_config.j2
dest: /etc/ssh/sshd_config.d/50-sshd-local.conf dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: "Restart ssh" notify: "Restart ssh"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
roles/common/tasks/sudoers.yml
+9 -10
View File
@@ -1,6 +1,5 @@
--- ---
# - name: (sudoers.yml) include variables
#- name: (sudoers.yml) include variables
# include_vars: "{{ item }}" # include_vars: "{{ item }}"
# with_first_found: # with_first_found:
# - "sudoers-{{ inventory_hostname }}.yml" # - "sudoers-{{ inventory_hostname }}.yml"
@@ -13,26 +12,26 @@
# - sudoers-global-configuration # - sudoers-global-configuration
- name: (sudoers.yml) Remove user entries in file /etc/sudoers - name: (sudoers.yml) Remove user entries in file /etc/sudoers
lineinfile: ansible.builtin.lineinfile:
dest: /etc/sudoers dest: /etc/sudoers
state: absent state: absent
regexp: '^{{ item }}' regexp: "^{{ item }}"
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
validate: visudo -cf %s validate: visudo -cf %s
with_items: '{{ sudoers_remove_user }}' with_items: "{{ sudoers_remove_user }}"
tags: tags:
- sudoers-remove - sudoers-remove
- name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/) - name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/)
template: ansible.builtin.template:
src: etc/sudoers.d/50-user.j2 src: etc/sudoers.d/50-user.j2
dest: /etc/sudoers.d/50-user dest: /etc/sudoers.d/50-user
#validate: visudo -cf %s #validate: visudo -cf %s
owner: root owner: root
group: root group: root
mode: 0440 mode: "0440"
tags: tags:
- sudoers-file-configuration - sudoers-file-configuration
@@ -48,10 +47,10 @@
# - sudoers-global-configuration # - sudoers-global-configuration
- name: (sudoers.yml) Ensure all sudo_users are in sudo group - name: (sudoers.yml) Ensure all sudo_users are in sudo group
user: ansible.builtin.user:
name: "{{ item }}" name: "{{ item }}"
groups: sudo groups: sudo
append: yes append: true
with_items: "{{ sudo_users }}" with_items: "{{ sudo_users }}"
tags: tags:
- sudo-users - sudo-users
roles/common/tasks/symlink_files.yml
+4 -5
View File
@@ -1,15 +1,14 @@
--- ---
- name: (symlink_files.yml) Symlink files - name: (symlink_files.yml) Symlink files
file: ansible.builtin.file:
src: '{{ item.src_path }}' src: "{{ item.src_path }}"
dest: '{{ item.dest_path }}' dest: "{{ item.dest_path }}"
owner: root owner: root
group: root group: root
state: link state: link
loop: "{{ symlink_files }}" loop: "{{ symlink_files }}"
loop_control: loop_control:
label: 'dest: {{ item.name }}' label: "dest: {{ item.name }}"
when: when:
- symlink_files is defined - symlink_files is defined
- symlink_files|length > 0 - symlink_files|length > 0
roles/common/tasks/systemd-resolved.yml
+12 -19
View File
@@ -1,41 +1,38 @@
--- ---
# --- # ---
# Set some facts # Set some facts
# --- # ---
- name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list) - name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_resolved_nameserver: "{{ resolved_nameserver | join (' ') }}" fact_resolved_nameserver: "{{ resolved_nameserver | join(' ') }}"
when: when:
- resolved_nameserver is defined and resolved_nameserver | length > 0 - resolved_nameserver is defined and resolved_nameserver | length > 0
tags: tags:
- systemd-resolved - systemd-resolved
- name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list) - name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join (' ') }}" fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join(' ') }}"
when: when:
- resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0 - resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0
tags: tags:
- systemd-resolved - systemd-resolved
- name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list) - name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list)
set_fact: ansible.builtin.set_fact:
fact_resolved_domains: "{{ resolved_domains | join (' ') }}" fact_resolved_domains: "{{ resolved_domains | join(' ') }}"
when: when:
- resolved_domains is defined and resolved_domains | length > 0 - resolved_domains is defined and resolved_domains | length > 0
tags: tags:
- systemd-resolved - systemd-resolved
# --- # ---
# Install/Enable systemd-resolved package # Install/Enable systemd-resolved package
# --- # ---
- name: (systemd-resolved.yml) Ensure systemd-resolved package is installed. - name: (systemd-resolved.yml) Ensure systemd-resolved package is installed.
package: ansible.builtin.package:
pkg: systemd-resolved pkg: systemd-resolved
state: present state: present
when: when:
@@ -44,7 +41,7 @@
- systemd-resolved - systemd-resolved
- name: (systemd-services.yml) Enable service - name: (systemd-services.yml) Enable service
systemd: ansible.builtin.systemd:
name: systemd-resolved name: systemd-resolved
enabled: true enabled: true
when: when:
@@ -52,31 +49,27 @@
tags: tags:
- systemd-resolved - systemd-resolved
# --- # ---
# Create configuration for systemd-resolved # Create configuration for systemd-resolved
# --- # ---
- name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists - name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists
file: ansible.builtin.file:
path: /etc/systemd/resolved.conf.d path: /etc/systemd/resolved.conf.d
state: directory state: directory
mode: 0755 mode: "0755"
group: root group: root
owner: root owner: root
- name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2 - name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2
template: ansible.builtin.template:
src: etc/systemd/resolved.conf.d/50-resolved-local.conf src: etc/systemd/resolved.conf.d/50-resolved-local.conf
dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
- name: Restart systemd-resolved service - name: Restart systemd-resolved service
ansible.builtin.service: ansible.builtin.service:
name: systemd-resolved name: systemd-resolved
state: restarted state: restarted
roles/common/tasks/systemd-services_debian_based_OS.yml
+10 -13
View File
@@ -1,7 +1,6 @@
--- ---
- name: (systemd-services.yml) Check if Service Exists (Debian based OS) - name: (systemd-services.yml) Check if Service Exists (Debian based OS)
shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";' ansible.builtin.shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";'
changed_when: "service_exists.rc > 1" changed_when: "service_exists.rc > 1"
failed_when: "service_exists.rc > 1" failed_when: "service_exists.rc > 1"
register: service_exists register: service_exists
@@ -11,51 +10,49 @@
#- debug: msg="{{ service_exists.results }}" #- debug: msg="{{ service_exists.results }}"
- name: (systemd-services.yml) Check if Service is disabled (Debian based OS) - name: (systemd-services.yml) Check if Service is disabled (Debian based OS)
shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";' ansible.builtin.shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";'
register: service_is_enabled register: service_is_enabled
changed_when: "service_is_enabled.rc == 0" changed_when: "service_is_enabled.rc == 0"
failed_when: "service_is_enabled.rc > 1" failed_when: "service_is_enabled.rc > 1"
with_items: with_items:
- "{{ service_exists.results }}" - "{{ service_exists.results }}"
loop_control: loop_control:
label: '{{ item.item }}' label: "{{ item.item }}"
when: when:
- item.rc == 0 - item.rc == 0
#- debug: msg="{{ service_is_enabled.results }}" #- debug: msg="{{ service_is_enabled.results }}"
- name: (systemd-services.yml) Enable service - name: (systemd-services.yml) Enable service
systemd: ansible.builtin.systemd:
name: "{{ item.item.item }}.service" name: "{{ item.item.item }}.service"
enabled: true enabled: true
with_items: with_items:
- "{{ service_is_enabled.results }}" - "{{ service_is_enabled.results }}"
loop_control: loop_control:
label: '{{ item.item.item }}' label: "{{ item.item.item }}"
when: when:
- item.changed - item.changed
- name: (systemd-services.yml) Check if Service is active - name: (systemd-services.yml) Check if Service is active
shell: 'systemctl is-active {{ item.item }}.service' ansible.builtin.command: "systemctl is-active {{ item.item }}.service"
register: service_is_active register: service_is_active
changed_when: 'service_is_active.stdout == "inactive"' changed_when: 'service_is_active.stdout == "inactive"'
failed_when: 'service_is_active.rc > 3' failed_when: "service_is_active.rc > 3"
with_items: with_items:
- "{{ service_exists.results }}" - "{{ service_exists.results }}"
loop_control: loop_control:
label: '{{ item.item }}' label: "{{ item.item }}"
when: when:
- item.rc == 0 - item.rc == 0
- name: (systemd-services.yml) Start service - name: (systemd-services.yml) Start service
systemd: ansible.builtin.systemd:
name: "{{ item.item.item }}.service" name: "{{ item.item.item }}.service"
state: started state: started
with_items: with_items:
- "{{ service_is_active.results }}" - "{{ service_is_active.results }}"
loop_control: loop_control:
label: '{{ item.item.item }}' label: "{{ item.item.item }}"
when: when:
- item.changed - item.changed
roles/common/tasks/systemd-services_redhat_based_OS.yml
+10 -13
View File
@@ -1,7 +1,6 @@
--- ---
- name: (systemd-services.yml) Check if Service Exists (RedHat based OS) - name: (systemd-services.yml) Check if Service Exists (RedHat based OS)
shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";' ansible.builtin.shell: 'systemctl list-unit-files | grep -q -e "^{{ item }}.service";'
changed_when: "service_exists.rc > 1" changed_when: "service_exists.rc > 1"
failed_when: "service_exists.rc > 1" failed_when: "service_exists.rc > 1"
register: service_exists register: service_exists
@@ -13,14 +12,14 @@
#- debug: msg="{{ service_exists.results }}" #- debug: msg="{{ service_exists.results }}"
- name: (systemd-services.yml) Check if Service is disabled (RedHat based OS) - name: (systemd-services.yml) Check if Service is disabled (RedHat based OS)
shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";' ansible.builtin.shell: 'systemctl list-unit-files | grep -e "^{{ item.item }}.service" | grep -q "disabled";'
register: service_is_enabled register: service_is_enabled
changed_when: "service_is_enabled.rc == 0" changed_when: "service_is_enabled.rc == 0"
failed_when: "service_is_enabled.rc > 1" failed_when: "service_is_enabled.rc > 1"
with_items: with_items:
- "{{ service_exists.results }}" - "{{ service_exists.results }}"
loop_control: loop_control:
label: '{{ item.item }}' label: "{{ item.item }}"
when: when:
- item.rc == 0 - item.rc == 0
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
@@ -28,37 +27,35 @@
#- debug: msg="{{ service_is_enabled.results }}" #- debug: msg="{{ service_is_enabled.results }}"
- name: (systemd-services.yml) Enable service - name: (systemd-services.yml) Enable service
systemd: ansible.builtin.systemd:
name: "{{ item.item.item }}.service" name: "{{ item.item.item }}.service"
enabled: true enabled: true
with_items: with_items:
- "{{ service_is_enabled.results }}" - "{{ service_is_enabled.results }}"
loop_control: loop_control:
label: '{{ item.item.item }}' label: "{{ item.item.item }}"
when: when:
- item.changed - item.changed
- name: (systemd-services.yml) Check if Service is active - name: (systemd-services.yml) Check if Service is active
shell: 'systemctl is-active {{ item.item }}.service' ansible.builtin.command: "systemctl is-active {{ item.item }}.service"
register: service_is_active register: service_is_active
changed_when: 'service_is_active.stdout == "inactive"' changed_when: 'service_is_active.stdout == "inactive"'
failed_when: 'service_is_active.rc > 3' failed_when: "service_is_active.rc > 3"
with_items: with_items:
- "{{ service_exists.results }}" - "{{ service_exists.results }}"
loop_control: loop_control:
label: '{{ item.item }}' label: "{{ item.item }}"
when: when:
- item.rc == 0 - item.rc == 0
- name: (systemd-services.yml) Start service - name: (systemd-services.yml) Start service
systemd: ansible.builtin.systemd:
name: "{{ item.item.item }}.service" name: "{{ item.item.item }}.service"
state: started state: started
with_items: with_items:
- "{{ service_is_active.results }}" - "{{ service_is_active.results }}"
loop_control: loop_control:
label: '{{ item.item.item }}' label: "{{ item.item.item }}"
when: when:
- item.changed - item.changed
roles/common/tasks/tor.yml
+6 -9
View File
@@ -1,7 +1,6 @@
--- ---
- name: (tor.yml) Ensure tor is installed. - name: (tor.yml) Ensure tor is installed.
apt: ansible.builtin.apt:
name: name:
- tor - tor
state: present state: present
@@ -10,23 +9,21 @@
tags: tags:
- tor-service - tor-service
- name: (tor.yml) Ensure tor servive is enabled and started - name: (tor.yml) Ensure tor servive is enabled and started
service: ansible.builtin.service:
name: tor name: tor
enabled: yes enabled: true
state: started state: started
tags: tags:
- tor-service - tor-service
- name: (tor.yml) Adjust configuration /etc/tor/torrc using template torrc.j2 - name: (tor.yml) Adjust configuration /etc/tor/torrc using template torrc.j2
template: ansible.builtin.template:
src: etc/tor/torrc.j2 src: etc/tor/torrc.j2
dest: '{{ torrc_path }}' dest: "{{ torrc_path }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
notify: "Restart tor service" notify: "Restart tor service"
when: when:
- torrc_path is defined - torrc_path is defined
roles/common/tasks/users-systemfiles.yml
+43 -49
View File
@@ -1,42 +1,42 @@
--- ---
# --- # ---
# Check if local template directories exists # Check if local template directories exists
# --- # ---
# default_users # default_users
- name: (users-systemfiles.yml) Check if local template directory exists for default users - name: (users-systemfiles.yml) Check if local template directory exists for default users
local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }} ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/{{ item.name }}
delegate_to: localhost
with_items: "{{ default_user }}" with_items: "{{ default_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
register: local_template_dir_default_user register: local_template_dir_default_user
# root # root
- name: (users-systemfiles.yml) Check if local template directory exists for root - name: (users-systemfiles.yml) Check if local template directory exists for root
local_action: stat path={{ inventory_dir }}/files/homedirs/root ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/root
delegate_to: localhost
register: local_template_dir_root register: local_template_dir_root
# -- # --
# Copy .bashrc # Copy .bashrc
# --- # ---
- name: (users-systemfiles.yml) Check if users file '.bashrc.ORIG' exists - name: (users-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.bashrc.ORIG" path: "~{{ item.name }}/.bashrc.ORIG"
register: bashrc_user_orig_exists register: bashrc_user_orig_exists
loop: "{{ default_user }}" loop: "{{ default_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- bash - bash
- name: (users-systemfiles.yml) Backup existing users .bashrc file - name: (users-systemfiles.yml) Backup existing users .bashrc file
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG ansible.builtin.command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
loop: "{{ bashrc_user_orig_exists.results }}" loop: "{{ bashrc_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: item.stat.exists == False when: item.stat.exists == False
tags: tags:
- bash - bash
@@ -50,7 +50,7 @@
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: bashrc_stats register: bashrc_stats
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
# 2. Falls vorhanden, Datei kopieren # 2. Falls vorhanden, Datei kopieren
- name: (users-systemfiles.yml) copy .bashrc if it exists - name: (users-systemfiles.yml) copy .bashrc if it exists
@@ -59,7 +59,7 @@
dest: "~{{ user.name }}/.bashrc" dest: "~{{ user.name }}/.bashrc"
owner: "{{ user.name }}" owner: "{{ user.name }}"
group: "{{ user.name }}" group: "{{ user.name }}"
mode: '0644' mode: "0644"
loop: "{{ default_user | zip(bashrc_stats.results) | list }}" loop: "{{ default_user | zip(bashrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
@@ -76,20 +76,20 @@
# -- # --
- name: (users-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists - name: (users-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists
stat: ansible.builtin.stat:
path: /root/.bashrc.ORIG path: /root/.bashrc.ORIG
register: bashrc_root_orig_exists register: bashrc_root_orig_exists
tags: tags:
- bash - bash
- name: (users-systemfiles.yml) Backup /root/.bashrc file - name: (users-systemfiles.yml) Backup /root/.bashrc file
command: cp /root/.bashrc /root/.bashrc.ORIG ansible.builtin.command: cp /root/.bashrc /root/.bashrc.ORIG
when: bashrc_root_orig_exists.stat.exists == False when: bashrc_root_orig_exists.stat.exists == False
tags: tags:
- bash - bash
# 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert # 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert
- name: stat root _bashrc on control node - name: Stat root _bashrc on control node
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/homedirs/root/_bashrc" path: "{{ inventory_dir }}/files/homedirs/root/_bashrc"
delegate_to: localhost delegate_to: localhost
@@ -97,47 +97,45 @@
register: bashrc_root_stat register: bashrc_root_stat
# 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost
- name: copy root .bashrc if it exists - name: Copy root .bashrc if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/homedirs/root/_bashrc" src: "{{ inventory_dir }}/files/homedirs/root/_bashrc"
dest: /root/.bashrc dest: /root/.bashrc
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
become: true become: true
when: bashrc_root_stat.stat.exists when: bashrc_root_stat.stat.exists
tags: tags:
- bash - bash
# -- # --
# Copy .profile (Debian System) # Copy .profile (Debian System)
# --- # ---
- name: (users-systemfiles.yml) Check if users file '.profile.ORIG' exists - name: (users-systemfiles.yml) Check if users file '.profile.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.profile.ORIG" path: "~{{ item.name }}/.profile.ORIG"
register: profile_user_orig_exists register: profile_user_orig_exists
loop: "{{ default_user }}" loop: "{{ default_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
tags: tags:
- profile - profile
- name: (users-systemfiles.yml) Backup existing users .profile file - name: (users-systemfiles.yml) Backup existing users .profile file
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG ansible.builtin.command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
loop: "{{ profile_user_orig_exists.results }}" loop: "{{ profile_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- item.stat.exists == False - item.stat.exists == False
tags: tags:
- profile - profile
# 1. Prüfen, ob für jeden User ein lokales _profile existiert # 1. Prüfen, ob für jeden User ein lokales _profile existiert
- name: (users-systemfiles.yml) stat user _profile - name: (users-systemfiles.yml) stat user _profile
ansible.builtin.stat: ansible.builtin.stat:
@@ -147,7 +145,7 @@
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: profile_stats register: profile_stats
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
# 2. Falls vorhanden, Datei kopieren # 2. Falls vorhanden, Datei kopieren
- name: (users-systemfiles.yml) copy .profile if it exists - name: (users-systemfiles.yml) copy .profile if it exists
@@ -156,7 +154,7 @@
dest: "~{{ user.name }}/.profile" dest: "~{{ user.name }}/.profile"
owner: "{{ user.name }}" owner: "{{ user.name }}"
group: "{{ user.name }}" group: "{{ user.name }}"
mode: '0644' mode: "0644"
loop: "{{ default_user | zip(profile_stats.results) | list }}" loop: "{{ default_user | zip(profile_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
@@ -173,7 +171,7 @@
# -- # --
- name: (users-systemfiles.yml) Check if file '/root/.profile.ORIG' exists - name: (users-systemfiles.yml) Check if file '/root/.profile.ORIG' exists
stat: ansible.builtin.stat:
path: /root/.profile.ORIG path: /root/.profile.ORIG
register: profile_root_orig_exists register: profile_root_orig_exists
when: when:
@@ -182,16 +180,15 @@
- profile - profile
- name: (users-systemfiles.yml) Backup existing users .profile file - name: (users-systemfiles.yml) Backup existing users .profile file
command: cp -a /root/.profile /root/.profile.ORIG ansible.builtin.command: cp -a /root/.profile /root/.profile.ORIG
when: when:
- ansible_facts['distribution'] == "Debian" - ansible_facts['distribution'] == "Debian"
- profile_root_orig_exists.stat.exists == False - profile_root_orig_exists.stat.exists == False
tags: tags:
- profile - profile
# 1) Prüfen ob die _profile für root auf dem Control-Node existiert # 1) Prüfen ob die _profile für root auf dem Control-Node existiert
- name: stat root _profile on control node - name: Stat root _profile on control node
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/homedirs/root/_profile" path: "{{ inventory_dir }}/files/homedirs/root/_profile"
delegate_to: localhost delegate_to: localhost
@@ -199,13 +196,13 @@
register: profile_root_stat register: profile_root_stat
# 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost
- name: copy root .profile if it exists - name: Copy root .profile if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/homedirs/root/_profile" src: "{{ inventory_dir }}/files/homedirs/root/_profile"
dest: /root/.profile dest: /root/.profile
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
become: true become: true
when: profile_root_stat.stat.exists when: profile_root_stat.stat.exists
tags: tags:
@@ -216,29 +213,28 @@
# --- # ---
- name: (users-systemfiles.yml) Check if users file '.bash_profile.ORIG' exists - name: (users-systemfiles.yml) Check if users file '.bash_profile.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.bash_profile.ORIG" path: "~{{ item.name }}/.bash_profile.ORIG"
register: bash_profile_user_orig_exists register: bash_profile_user_orig_exists
loop: "{{ default_user }}" loop: "{{ default_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- ansible_facts['distribution'] == "CentOS" - ansible_facts['distribution'] == "CentOS"
tags: tags:
- profile - profile
- name: (users-systemfiles.yml) Backup existing users .bash_profile file - name: (users-systemfiles.yml) Backup existing users .bash_profile file
command: cp -a ~{{ item.item.name }}/.bash_profile ~{{ item.item.name }}/.bash_profile.ORIG ansible.builtin.command: cp -a ~{{ item.item.name }}/.bash_profile ~{{ item.item.name }}/.bash_profile.ORIG
loop: "{{ bash_profile_user_orig_exists.results }}" loop: "{{ bash_profile_user_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- ansible_facts['distribution'] == "CentOS" - ansible_facts['distribution'] == "CentOS"
- item.stat.exists == False - item.stat.exists == False
tags: tags:
- profile - profile
# 1. Prüfen, ob für jeden User ein lokales _bash_profile existiert # 1. Prüfen, ob für jeden User ein lokales _bash_profile existiert
- name: (users-systemfiles.yml) stat user _bash_profile - name: (users-systemfiles.yml) stat user _bash_profile
ansible.builtin.stat: ansible.builtin.stat:
@@ -248,7 +244,7 @@
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: bash_profile_stats register: bash_profile_stats
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- ansible_facts['distribution'] == "CentOS" - ansible_facts['distribution'] == "CentOS"
@@ -259,7 +255,7 @@
dest: "~{{ user.name }}/.bash_profile" dest: "~{{ user.name }}/.bash_profile"
owner: "{{ user.name }}" owner: "{{ user.name }}"
group: "{{ user.name }}" group: "{{ user.name }}"
mode: '0644' mode: "0644"
loop: "{{ default_user | zip(bash_profile_stats.results) | list }}" loop: "{{ default_user | zip(bash_profile_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
@@ -277,7 +273,7 @@
# -- # --
- name: (users-systemfiles.yml) Check if file '/root/.bash_profile.ORIG' exists - name: (users-systemfiles.yml) Check if file '/root/.bash_profile.ORIG' exists
stat: ansible.builtin.stat:
path: /root/.bash_profile.ORIG path: /root/.bash_profile.ORIG
register: profile_root_orig_exists register: profile_root_orig_exists
when: when:
@@ -286,16 +282,15 @@
- profile - profile
- name: (users-systemfiles.yml) Backup existing users .bash_profile file - name: (users-systemfiles.yml) Backup existing users .bash_profile file
command: cp -a /root/.bash_profile /root/.bash_profile.ORIG ansible.builtin.command: cp -a /root/.bash_profile /root/.bash_profile.ORIG
when: when:
- ansible_facts['distribution'] == "CentOS" - ansible_facts['distribution'] == "CentOS"
- profile_root_orig_exists.stat.exists == False - profile_root_orig_exists.stat.exists == False
tags: tags:
- profile - profile
# 1) Prüfen ob die _bash_profile für root auf dem Control-Node existiert # 1) Prüfen ob die _bash_profile für root auf dem Control-Node existiert
- name: stat root _bash_profile on control node - name: Stat root _bash_profile on control node
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/homedirs/root/_bash_profile" path: "{{ inventory_dir }}/files/homedirs/root/_bash_profile"
delegate_to: localhost delegate_to: localhost
@@ -305,13 +300,13 @@
- ansible_facts['distribution'] == "CentOS" - ansible_facts['distribution'] == "CentOS"
# 2) Wenn vorhanden, kopieren wir sie nach /root/.bash_profile auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.bash_profile auf dem Zielhost
- name: copy root .bash_profile if it exists - name: Copy root .bash_profile if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/homedirs/root/_bash_profile" src: "{{ inventory_dir }}/files/homedirs/root/_bash_profile"
dest: /root/.bash_profile dest: /root/.bash_profile
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
become: true become: true
when: when:
- ansible_facts['distribution'] == "CentOS" - ansible_facts['distribution'] == "CentOS"
@@ -319,7 +314,6 @@
tags: tags:
- bash - bash
# -- # --
# Copy .vimrc # Copy .vimrc
# --- # ---
@@ -333,7 +327,7 @@
loop: "{{ default_user }}" loop: "{{ default_user }}"
register: vimrc_stats register: vimrc_stats
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
# 2. Falls vorhanden, Datei kopieren # 2. Falls vorhanden, Datei kopieren
- name: (users-systemfiles.yml) copy .vimrc if it exists - name: (users-systemfiles.yml) copy .vimrc if it exists
@@ -342,7 +336,7 @@
dest: "~{{ user.name }}/.vimrc" dest: "~{{ user.name }}/.vimrc"
owner: "{{ user.name }}" owner: "{{ user.name }}"
group: "{{ user.name }}" group: "{{ user.name }}"
mode: '0644' mode: "0644"
loop: "{{ default_user | zip(vimrc_stats.results) | list }}" loop: "{{ default_user | zip(vimrc_stats.results) | list }}"
loop_control: loop_control:
label: "{{ user.name }}" label: "{{ user.name }}"
@@ -408,7 +402,7 @@
# -- # --
# 1) Prüfen ob die _vimrc für root auf dem Control-Node existiert # 1) Prüfen ob die _vimrc für root auf dem Control-Node existiert
- name: stat root _vimrc on control node - name: Stat root _vimrc on control node
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ inventory_dir }}/files/homedirs/root/_vimrc" path: "{{ inventory_dir }}/files/homedirs/root/_vimrc"
delegate_to: localhost delegate_to: localhost
@@ -416,13 +410,13 @@
register: vimrc_root_stat register: vimrc_root_stat
# 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost # 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost
- name: copy root .vimrc if it exists - name: Copy root .vimrc if it exists
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ inventory_dir }}/files/homedirs/root/_vimrc" src: "{{ inventory_dir }}/files/homedirs/root/_vimrc"
dest: /root/.vimrc dest: /root/.vimrc
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
become: true become: true
when: when:
- vimrc_root_stat.stat.exists - vimrc_root_stat.stat.exists
roles/common/tasks/users.yml
+59 -65
View File
@@ -1,5 +1,4 @@
--- ---
# --- # ---
# - Set base home directory # - Set base home directory
# --- # ---
@@ -7,8 +6,8 @@
- name: HOME in /etc/default/useradd setzen oder hinter Kommentar einfügen - name: HOME in /etc/default/useradd setzen oder hinter Kommentar einfügen
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/default/useradd path: /etc/default/useradd
regexp: '^HOME=' regexp: "^HOME="
insertafter: '^#\s*HOME=' insertafter: "^#\\s*HOME="
line: "HOME={{ base_home }}" line: "HOME={{ base_home }}"
backup: true backup: true
when: when:
@@ -18,8 +17,8 @@
- name: DHOME in /etc/adduser.conf setzen oder hinter Kommentar einfügen - name: DHOME in /etc/adduser.conf setzen oder hinter Kommentar einfügen
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/adduser.conf path: /etc/adduser.conf
regexp: '^DHOME=' regexp: "^DHOME="
insertafter: '^#\s*DHOME=' insertafter: "^#\\s*DHOME="
line: "DHOME={{ base_home }}" line: "DHOME={{ base_home }}"
backup: true backup: true
when: when:
@@ -31,30 +30,30 @@
# --- # ---
- name: (users.yml) Ensure default groups exists - name: (users.yml) Ensure default groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: "{{ item.group_id | default(omit) }}"
loop: "{{ default_user }}" loop: "{{ default_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: item.group_id is defined when: item.group_id is defined
tags: tags:
- groups-exists - groups-exists
- name: (users.yml) Ensure default users exists - name: (users.yml) Ensure default users exists
user: ansible.builtin.user:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: "{{ item.user_id | default(omit) }}"
group: '{{ item.group | default(omit) }}' group: "{{ item.group | default(omit) }}"
home: "{{ item.home | default('/home/' ~ item.name) }}" home: "{{ item.home | default('/home/' ~ item.name) }}"
shell: '{{ item.shell|d("/bin/bash") }}' shell: '{{ item.shell | d("/bin/bash") }}'
password: "{{ item.password }}" password: "{{ item.password }}"
update_password: on_create update_password: on_create
loop: "{{ default_user }}" loop: "{{ default_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: item.name != ansible_user when: item.name != ansible_user
tags: tags:
- users-exists - users-exists
@@ -65,7 +64,7 @@
key: "{{ item.1 }}" key: "{{ item.1 }}"
state: present state: present
with_subelements: with_subelements:
- '{{ default_user }}' - "{{ default_user }}"
- ssh_keys - ssh_keys
loop_control: loop_control:
label: "{{ item.0.name }}" label: "{{ item.0.name }}"
@@ -77,31 +76,31 @@
# --- # ---
- name: (users.yml) Ensure extra groups exists - name: (users.yml) Ensure extra groups exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: "{{ item.group_id | default(omit) }}"
loop: "{{ extra_user }}" loop: "{{ extra_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- extra_user is defined and extra_user|length > 0 - extra_user is defined and extra_user|length > 0
tags: tags:
- groups-exists - groups-exists
- name: (users.yml) Ensure extra users exists - name: (users.yml) Ensure extra users exists
user: ansible.builtin.user:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: "{{ item.user_id | default(omit) }}"
group: '{{ item.name | default(omit) }}' group: "{{ item.name | default(omit) }}"
home: '{{ item.home | default(omit) }}' home: "{{ item.home | default(omit) }}"
shell: '{{ item.shell|d("/bin/bash") }}' shell: '{{ item.shell | d("/bin/bash") }}'
password: "{{ item.password }}" password: "{{ item.password }}"
update_password: on_create update_password: on_create
loop: "{{ extra_user }}" loop: "{{ extra_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: extra_user is defined and extra_user|length > 0 when: extra_user is defined and extra_user|length > 0
tags: tags:
- users-exists - users-exists
@@ -112,7 +111,7 @@
key: "{{ item.1 }}" key: "{{ item.1 }}"
state: present state: present
with_subelements: with_subelements:
- '{{ extra_user }}' - "{{ extra_user }}"
- ssh_keys - ssh_keys
loop_control: loop_control:
label: "{{ item.0.name }}" label: "{{ item.0.name }}"
@@ -132,16 +131,15 @@
- entries_authorized_key is defined - entries_authorized_key is defined
- entries_authorized_key|length > 0 - entries_authorized_key|length > 0
# --- # ---
# - extra system groups # - extra system groups
# --- # ---
- name: (users.yml) Extra system group sftp_users - name: (users.yml) Extra system group sftp_users
group: ansible.builtin.group:
name: 'sftp_users' name: "sftp_users"
state: present state: present
system: yes system: true
when: when:
- create_sftp_group is defined and create_sftp_group > 0 - create_sftp_group is defined and create_sftp_group > 0
tags: tags:
@@ -152,21 +150,20 @@
# --- # ---
- name: (users.yml) extra system user exists? - name: (users.yml) extra system user exists?
user: ansible.builtin.user:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
system: yes system: true
home: '{{ item.home }}' home: "{{ item.home }}"
shell: '{{ item.shell|d("/usr/sbin/nologin") }}' shell: '{{ item.shell | d("/usr/sbin/nologin") }}'
groups: '{{ item.groups | default(omit) }}' groups: "{{ item.groups | default(omit) }}"
loop: "{{ extra_system_user }}" loop: "{{ extra_system_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: extra_system_user is defined and extra_system_user|length > 0 when: extra_system_user is defined and extra_system_user|length > 0
tags: tags:
- user-exists - user-exists
# --- # ---
# - Take care backup host has rsa key to connect via ssh to the other hosts # - Take care backup host has rsa key to connect via ssh to the other hosts
# --- # ---
@@ -224,47 +221,46 @@
# - authorized_key # - authorized_key
# - keypair-backup-server # - keypair-backup-server
# --- # ---
# - Allow connection via ssh to backup host # - Allow connection via ssh to backup host
# --- # ---
- name: Ensure root's .ssh directory exists - name: Ensure root's .ssh directory exists
file: ansible.builtin.file:
path: /root/.ssh path: /root/.ssh
state: directory state: directory
- name: (users.yml) Copy (backup) ed25519 ssh private key to user root - name: (users.yml) Copy (backup) ed25519 ssh private key to user root
copy: ansible.builtin.copy:
src: '{{ item.priv_key_src }}' src: "{{ item.priv_key_src }}"
dest: '{{ item.priv_key_dest }}' dest: "{{ item.priv_key_dest }}"
owner: root owner: root
group: root group: root
mode: '0600' mode: "0600"
when: when:
- insert_keypair_backup_client|bool - insert_keypair_backup_client|bool
- ssh_keypair_backup_client is defined - ssh_keypair_backup_client is defined
- ssh_keypair_backup_client|length > 0 - ssh_keypair_backup_client|length > 0
loop: "{{ ssh_keypair_backup_client }}" loop: "{{ ssh_keypair_backup_client }}"
loop_control: loop_control:
label: 'dest: {{ item.priv_key_dest }}' label: "dest: {{ item.priv_key_dest }}"
tags: tags:
- insert_ssh_keypair_backup_server - insert_ssh_keypair_backup_server
- name: (users.yml) Copy (backup) ed25519 ssh public key to user root - name: (users.yml) Copy (backup) ed25519 ssh public key to user root
copy: ansible.builtin.copy:
src: '{{ item.pub_key_src }}' src: "{{ item.pub_key_src }}"
dest: '{{ item.pub_key_dest }}' dest: "{{ item.pub_key_dest }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
when: when:
- insert_keypair_backup_client|bool - insert_keypair_backup_client|bool
- ssh_keypair_backup_client is defined - ssh_keypair_backup_client is defined
- ssh_keypair_backup_client|length > 0 - ssh_keypair_backup_client|length > 0
loop: "{{ ssh_keypair_backup_client }}" loop: "{{ ssh_keypair_backup_client }}"
loop_control: loop_control:
label: 'dest: {{ item.pub_key_dest }}' label: "dest: {{ item.pub_key_dest }}"
tags: tags:
- insert_ssh_keypair_backup_server - insert_ssh_keypair_backup_server
@@ -275,7 +271,7 @@
state: present state: present
loop: "{{ ssh_keypair_backup_client }}" loop: "{{ ssh_keypair_backup_client }}"
loop_control: loop_control:
label: 'authorized_keys - user: root' label: "authorized_keys - user: root"
when: when:
- inventory_hostname == item.target - inventory_hostname == item.target
- ssh_keypair_backup_client is defined - ssh_keypair_backup_client is defined
@@ -284,17 +280,16 @@
- authorized_key - authorized_key
- ssh-keypair-backup-server - ssh-keypair-backup-server
- name: (users.yml) Copy further ssh private key(s) to user root - name: (users.yml) Copy further ssh private key(s) to user root
copy: ansible.builtin.copy:
src: '{{ item.priv_key_src }}' src: "{{ item.priv_key_src }}"
dest: '{{ item.priv_key_dest }}' dest: "{{ item.priv_key_dest }}"
owner: root owner: root
group: root group: root
mode: '0600' mode: "0600"
loop: "{{ root_ssh_keypair }}" loop: "{{ root_ssh_keypair }}"
loop_control: loop_control:
label: 'dest: {{ item.priv_key_dest }}' label: "dest: {{ item.priv_key_dest }}"
when: when:
- insert_root_ssh_keypair|bool - insert_root_ssh_keypair|bool
- root_ssh_keypair is defined - root_ssh_keypair is defined
@@ -304,15 +299,15 @@
- root-defaut-ssh-keypair - root-defaut-ssh-keypair
- name: (users.yml) Copy further ssh public key(s) to user root - name: (users.yml) Copy further ssh public key(s) to user root
copy: ansible.builtin.copy:
src: '{{ item.pub_key_src }}' src: "{{ item.pub_key_src }}"
dest: '{{ item.pub_key_dest }}' dest: "{{ item.pub_key_dest }}"
owner: root owner: root
group: root group: root
mode: '0644' mode: "0644"
loop: "{{ root_ssh_keypair }}" loop: "{{ root_ssh_keypair }}"
loop_control: loop_control:
label: 'dest: {{ item.pub_key_dest }}' label: "dest: {{ item.pub_key_dest }}"
when: when:
- insert_root_ssh_keypair|bool - insert_root_ssh_keypair|bool
- root_ssh_keypair is defined - root_ssh_keypair is defined
@@ -320,4 +315,3 @@
tags: tags:
- insert_root_ssh_keypair - insert_root_ssh_keypair
- root-defaut-ssh-keypair - root-defaut-ssh-keypair
roles/common/tasks/webadmin-user.yml
+59 -61
View File
@@ -1,15 +1,14 @@
--- ---
# --- # ---
# - webadmin user/group # - webadmin user/group
# --- # ---
- name: (webadmin-user.yml) Ensure webadmin group exists - name: (webadmin-user.yml) Ensure webadmin group exists
group: ansible.builtin.group:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
gid: '{{ item.group_id | default(omit) }}' gid: "{{ item.group_id | default(omit) }}"
with_items: '{{ webadmin_user }}' with_items: "{{ webadmin_user }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: when:
@@ -21,16 +20,16 @@
- groups-exists - groups-exists
- name: (webadmin-user.yml) Ensure webadmin user exists - name: (webadmin-user.yml) Ensure webadmin user exists
user: ansible.builtin.user:
name: '{{ item.name }}' name: "{{ item.name }}"
state: present state: present
uid: '{{ item.user_id | default(omit) }}' uid: "{{ item.user_id | default(omit) }}"
group: '{{ item.name | default(omit) }}' group: "{{ item.name | default(omit) }}"
home: '{{ item.home | default(omit) }}' home: "{{ item.home | default(omit) }}"
shell: '{{ item.shell|d("/bin/bash") }}' shell: '{{ item.shell | d("/bin/bash") }}'
password: "{{ item.password }}" password: "{{ item.password }}"
update_password: on_create update_password: on_create
with_items: '{{ webadmin_user }}' with_items: "{{ webadmin_user }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"
when: when:
@@ -46,7 +45,7 @@
key: "{{ item.1 }}" key: "{{ item.1 }}"
state: present state: present
with_subelements: with_subelements:
- '{{ webadmin_user }}' - "{{ webadmin_user }}"
- ssh_keys - ssh_keys
loop_control: loop_control:
label: "{{ item.0.name }} key: {{ idx + 1 }}" label: "{{ item.0.name }} key: {{ idx + 1 }}"
@@ -59,32 +58,32 @@
- authorized_key - authorized_key
- name: (webadmin-user.yml) Copy default ed25519 ssh private key to user webadmin - name: (webadmin-user.yml) Copy default ed25519 ssh private key to user webadmin
copy: ansible.builtin.copy:
src: '{{ item.priv_key_src }}' src: "{{ item.priv_key_src }}"
dest: '{{ item.priv_key_dest }}' dest: "{{ item.priv_key_dest }}"
owner: '{{ item.login }}' owner: "{{ item.login }}"
group: '{{ item.login }}' group: "{{ item.login }}"
mode: '0600' mode: "0600"
#when: groups['oopen_server']|string is search(inventory_hostname) #when: groups['oopen_server']|string is search(inventory_hostname)
when: when:
- insert_webadmin_ssh_keypair|bool - insert_webadmin_ssh_keypair|bool
with_items: '{{ webadmin_ssh_keypair }}' with_items: "{{ webadmin_ssh_keypair }}"
loop_control: loop_control:
label: 'dest: {{ item.priv_key_dest }}' label: "dest: {{ item.priv_key_dest }}"
tags: tags:
- webadmin - webadmin
- webadmin-defaut-ssh-keypair - webadmin-defaut-ssh-keypair
- name: (webadmin-user.yml) Copy default ssh key ed25519 public key to user webadmin - name: (webadmin-user.yml) Copy default ssh key ed25519 public key to user webadmin
copy: ansible.builtin.copy:
src: '{{ item.pub_key_src }}' src: "{{ item.pub_key_src }}"
dest: '{{ item.pub_key_dest }}' dest: "{{ item.pub_key_dest }}"
owner: '{{ item.login }}' owner: "{{ item.login }}"
group: '{{ item.login }}' group: "{{ item.login }}"
mode: '0644' mode: "0644"
with_items: '{{ webadmin_ssh_keypair }}' with_items: "{{ webadmin_ssh_keypair }}"
loop_control: loop_control:
label: 'dest: {{ item.pub_key_dest }}' label: "dest: {{ item.pub_key_dest }}"
when: when:
- insert_webadmin_ssh_keypair|bool - insert_webadmin_ssh_keypair|bool
tags: tags:
@@ -92,12 +91,12 @@
- webadmin-defaut-ssh-keypair - webadmin-defaut-ssh-keypair
- name: (webadmin-user.yml) Ensure .ssh/config of user webadmin is up-to-date - name: (webadmin-user.yml) Ensure .ssh/config of user webadmin is up-to-date
template: ansible.builtin.template:
src: var/www/.ssh/config.j2 src: var/www/.ssh/config.j2
dest: '~webadmin/.ssh/config' dest: "~webadmin/.ssh/config"
owner: webadmin owner: webadmin
group: webadmin group: webadmin
mode: '0644' mode: "0644"
when: when:
- insert_webadmin_ssh_keypair|bool - insert_webadmin_ssh_keypair|bool
tags: tags:
@@ -112,29 +111,27 @@
user: "{{ item.login }}" user: "{{ item.login }}"
key: "{{ lookup('file', item.pub_key_src) }}" key: "{{ lookup('file', item.pub_key_src) }}"
state: present state: present
with_items: '{{ webadmin_ssh_keypair }}' with_items: "{{ webadmin_ssh_keypair }}"
loop_control: loop_control:
label: 'authorized_keys - webadmin: root' label: "authorized_keys - webadmin: root"
when: inventory_hostname == item.target when: inventory_hostname == item.target
tags: tags:
- webadmin - webadmin
- authorized_key - authorized_key
- insert_webadmin_ssh_public_key - insert_webadmin_ssh_public_key
# --- # ---
# Check if local template directories exists # Check if local template directories exists
# --- # ---
- name: (users-systemfiles.yml) Check if local template directory exists for webadmin - name: (users-systemfiles.yml) Check if local template directory exists for webadmin
local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }} ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/{{ item.name }}
delegate_to: localhost
with_items: "{{ webadmin_user }}" with_items: "{{ webadmin_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
register: local_template_dir_webadmin register: local_template_dir_webadmin
# -- # --
# Copy .bashrc # Copy .bashrc
# --- # ---
@@ -164,21 +161,21 @@
# - bash # - bash
- name: (webadmin-user.yml) Check if webadmin's file '.bashrc.ORIG' exists - name: (webadmin-user.yml) Check if webadmin's file '.bashrc.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.bashrc.ORIG" path: "~{{ item.name }}/.bashrc.ORIG"
register: bashrc_webadmin_orig_exists register: bashrc_webadmin_orig_exists
with_items: "{{ webadmin_user }}" with_items: "{{ webadmin_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- webadmin - webadmin
- bash - bash
- name: (webadmin-user.yml) Backup existing webadmin's .bashrc file - name: (webadmin-user.yml) Backup existing webadmin's .bashrc file
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG ansible.builtin.command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
loop: "{{ bashrc_webadmin_orig_exists.results }}" loop: "{{ bashrc_webadmin_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.stat.exists == False - item.stat.exists == False
tags: tags:
@@ -186,15 +183,15 @@
- bash - bash
- name: (webadmin-user.yml) copy new .bashrc for webadmin if it exists - name: (webadmin-user.yml) copy new .bashrc for webadmin if it exists
copy: ansible.builtin.copy:
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') }}" src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') }}"
dest: "~{{ item.item.name }}/.bashrc" dest: "~{{ item.item.name }}/.bashrc"
owner: "{{ item.item.name }}" owner: "{{ item.item.name }}"
group: "{{ item.item.name }}" group: "{{ item.item.name }}"
mode: 0644 mode: "0644"
with_items: "{{ local_template_dir_webadmin.results }}" with_items: "{{ local_template_dir_webadmin.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.stat.exists - item.stat.exists
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') != '' - lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') != ''
@@ -207,21 +204,21 @@
# --- # ---
- name: (webadmin-user.yml) Check if webadmin's file '.profile.ORIG' exists - name: (webadmin-user.yml) Check if webadmin's file '.profile.ORIG' exists
stat: ansible.builtin.stat:
path: "~{{ item.name }}/.profile.ORIG" path: "~{{ item.name }}/.profile.ORIG"
register: profile_webadmin_orig_exists register: profile_webadmin_orig_exists
with_items: "{{ webadmin_user }}" with_items: "{{ webadmin_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
tags: tags:
- webadmin - webadmin
- profile - profile
- name: (webadmin-user.yml) Backup existing users .profile file - name: (webadmin-user.yml) Backup existing users .profile file
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG ansible.builtin.command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
with_items: "{{ profile_webadmin_orig_exists.results }}" with_items: "{{ profile_webadmin_orig_exists.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.stat.exists == False - item.stat.exists == False
tags: tags:
@@ -229,15 +226,15 @@
- profile - profile
- name: (webadmin-user.yml) copy .profile for user webadmin if it exists - name: (webadmin-user.yml) copy .profile for user webadmin if it exists
copy: ansible.builtin.copy:
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') }}" src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') }}"
dest: "~{{ item.item.name }}/.profile" dest: "~{{ item.item.name }}/.profile"
owner: "{{ item.item.name }}" owner: "{{ item.item.name }}"
group: "{{ item.item.name }}" group: "{{ item.item.name }}"
mode: 0644 mode: "0644"
with_items: "{{ local_template_dir_webadmin.results }}" with_items: "{{ local_template_dir_webadmin.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.stat.exists - item.stat.exists
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') != '' - lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') != ''
@@ -250,15 +247,15 @@
# --- # ---
- name: (webadmin-user.yml) copy .vimrc for user webadmin if it exists - name: (webadmin-user.yml) copy .vimrc for user webadmin if it exists
copy: ansible.builtin.copy:
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') }}" src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') }}"
dest: "~{{ item.item.name }}/.vimrc" dest: "~{{ item.item.name }}/.vimrc"
owner: "{{ item.item.name }}" owner: "{{ item.item.name }}"
group: "{{ item.item.name }}" group: "{{ item.item.name }}"
mode: 0644 mode: "0644"
with_items: "{{ local_template_dir_webadmin.results }}" with_items: "{{ local_template_dir_webadmin.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.stat.exists - item.stat.exists
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') != '' - lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') != ''
@@ -267,22 +264,23 @@
- vim - vim
- name: (webadmin-user.yml) Check if local template directory .vim exists for webadmin - name: (webadmin-user.yml) Check if local template directory .vim exists for webadmin
local_action: stat path={{ inventory_dir }}/files/homedirs/webadmin/.vim ansible.builtin.stat: path={{ inventory_dir }}/files/homedirs/webadmin/.vim
delegate_to: localhost
register: local_template_dir_vim_webadmin register: local_template_dir_vim_webadmin
with_items: "{{ webadmin_user }}" with_items: "{{ webadmin_user }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
- name: (webadmin-user.yml) copy .vim directory for user webadmin if it exists - name: (webadmin-user.yml) copy .vim directory for user webadmin if it exists
copy: ansible.builtin.copy:
src: "{{ inventory_dir + '/files/homedirs/' + item.item.name + '/.vim' }}" src: "{{ inventory_dir + '/files/homedirs/' + item.item.name + '/.vim' }}"
dest: "~{{ item.item.name }}" dest: "~{{ item.item.name }}"
owner: "{{ item.item.name }}" owner: "{{ item.item.name }}"
group: "{{ item.item.name }}" group: "{{ item.item.name }}"
mode: 0644 mode: "0644"
with_items: "{{ local_template_dir_vim_webadmin.results }}" with_items: "{{ local_template_dir_vim_webadmin.results }}"
loop_control: loop_control:
label: '{{ item.item.name }}' label: "{{ item.item.name }}"
when: when:
- item.stat.exists - item.stat.exists
tags: tags:
roles/common/tasks/x2go-server.yml
+1 -5
View File
@@ -1,11 +1,10 @@
--- ---
# --- # ---
# NFS Server # NFS Server
# --- # ---
- name: (x2g-server.yml) Ensure X2Go server packages are installed. - name: (x2g-server.yml) Ensure X2Go server packages are installed.
apt: ansible.builtin.apt:
name: name:
- x2goserver - x2goserver
- x2goserver-xsession - x2goserver-xsession
@@ -17,6 +16,3 @@
- "groups['x2go_server']|string is search(inventory_hostname)" - "groups['x2go_server']|string is search(inventory_hostname)"
tags: tags:
- x2g--server - x2g--server
roles/common/tasks/yum.yml
+16 -23
View File
@@ -1,10 +1,9 @@
--- ---
- name: (yum.yml) Install system updates for redhat (centos/fedora) systems - name: (yum.yml) Install system updates for redhat (centos/fedora) systems
yum: ansible.builtin.dnf:
name: '*' name: "*"
state: latest state: latest
update_cache: yes update_cache: true
#cache_valid_time: 3600 #cache_valid_time: 3600
when: when:
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
@@ -12,19 +11,17 @@
tags: tags:
- yum-update - yum-update
- name: Install the EPEL Repository in CentOS 7 - name: Install the EPEL Repository in CentOS 7
yum: ansible.builtin.dnf:
name: epel-release name: epel-release
state: latest state: latest
when: when:
- ansible_facts.os_family == "RedHat" - ansible_facts.os_family == "RedHat"
- ansible_facts.distribution == "CentOS" - ansible_facts.distribution == "CentOS"
# Its more eficient to in # Its more eficient to in
- name: (yum.yml) Base install CentOS packages (CentOS 7) - name: (yum.yml) Base install CentOS packages (CentOS 7)
yum: ansible.builtin.dnf:
name: "{{ yum_base_install_centos_7 }}" name: "{{ yum_base_install_centos_7 }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -35,7 +32,7 @@
- yum-base-install - yum-base-install
- name: (yum.yml) Initial install CentOS packages (CentOS 7) - name: (yum.yml) Initial install CentOS packages (CentOS 7)
yum: ansible.builtin.dnf:
name: "{{ yum_initial_install_centos_7 }}" name: "{{ yum_initial_install_centos_7 }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -45,10 +42,9 @@
tags: tags:
- yum-initial-install - yum-initial-install
# Its more eficient to in # Its more eficient to in
- name: (yum.yml) Base install Fedira packages (Fedora 38) - name: (yum.yml) Base install Fedira packages (Fedora 38)
yum: ansible.builtin.dnf:
name: "{{ yum_base_install_fedora_38 }}" name: "{{ yum_base_install_fedora_38 }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -59,7 +55,7 @@
- yum-base-install - yum-base-install
- name: (yum.yml) Initial install Fedora packages (Fedora 38) - name: (yum.yml) Initial install Fedora packages (Fedora 38)
yum: ansible.builtin.dnf:
name: "{{ yum_initial_install_fedora_38 }}" name: "{{ yum_initial_install_fedora_38 }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -69,9 +65,8 @@
tags: tags:
- yum-initial-install - yum-initial-install
- name: (yum.yml) Install lxc_host related packages CentOS systems - name: (yum.yml) Install lxc_host related packages CentOS systems
yum: ansible.builtin.dnf:
name: "{{ yum_lxc_host_pkgs_centos }}" name: "{{ yum_lxc_host_pkgs_centos }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -82,7 +77,7 @@
- yum-lxc-hosts-pkgs - yum-lxc-hosts-pkgs
- name: (yum.yml) Install lxc_host related packages Fedora systems - name: (yum.yml) Install lxc_host related packages Fedora systems
yum: ansible.builtin.dnf:
name: "{{ yum_lxc_host_pkgs_fedora }}" name: "{{ yum_lxc_host_pkgs_fedora }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -92,9 +87,8 @@
tags: tags:
- yum-lxc-hosts-pkgs - yum-lxc-hosts-pkgs
- name: (yum.yml) Install postgresql server related packages CentOS systems - name: (yum.yml) Install postgresql server related packages CentOS systems
yum: ansible.builtin.dnf:
name: "{{ yum_postgresql_pkgs_centos }}" name: "{{ yum_postgresql_pkgs_centos }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -105,7 +99,7 @@
- apt-postgresql-server-pkgs - apt-postgresql-server-pkgs
- name: (yum.yml) Install postgresql server related packages Fedora systems - name: (yum.yml) Install postgresql server related packages Fedora systems
yum: ansible.builtin.dnf:
name: "{{ yum_postgresql_pkgs_fedora }}" name: "{{ yum_postgresql_pkgs_fedora }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -115,9 +109,8 @@
tags: tags:
- apt-postgresql-server-pkgs - apt-postgresql-server-pkgs
- name: (yum.yml) Install compile related packages CentOS systems - name: (yum.yml) Install compile related packages CentOS systems
yum: ansible.builtin.dnf:
name: "{{ yum_compiler_pkgs_centos }}" name: "{{ yum_compiler_pkgs_centos }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -128,7 +121,7 @@
- yum-compiler-pkgs - yum-compiler-pkgs
- name: (yum.yml) Install compile related packages Fedora systems - name: (yum.yml) Install compile related packages Fedora systems
yum: ansible.builtin.dnf:
name: "{{ yum_compiler_pkgs_fedora }}" name: "{{ yum_compiler_pkgs_fedora }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -139,7 +132,7 @@
- yum-compiler-pkgs - yum-compiler-pkgs
- name: (yum.yml) Install webserver related packages CentOS systems - name: (yum.yml) Install webserver related packages CentOS systems
yum: ansible.builtin.dnf:
name: "{{ yum_webserver_pkgs_centos }}" name: "{{ yum_webserver_pkgs_centos }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when:
@@ -150,7 +143,7 @@
- yum-webserver-pkgs - yum-webserver-pkgs
- name: (yum.yml) Install webserver related packages Fedora systems - name: (yum.yml) Install webserver related packages Fedora systems
yum: ansible.builtin.dnf:
name: "{{ yum_webserver_pkgs_fedora }}" name: "{{ yum_webserver_pkgs_fedora }}"
state: "{{ yum_install_state }}" state: "{{ yum_install_state }}"
when: when: