chris
81398e847e
- Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity. - Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems. - Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation. - Removed unnecessary comments and whitespace to enhance readability. - Ensured that conditions and loops are consistently formatted across all tasks.
274 lines
7.5 KiB
YAML
274 lines
7.5 KiB
YAML
---
|
|
- name: Ensure util-linux-extra is installed on Debian
|
|
ansible.builtin.apt:
|
|
name: util-linux-extra
|
|
state: present
|
|
update_cache: true
|
|
when:
|
|
- ansible_facts['os_family'] == 'Debian'
|
|
- ansible_facts['distribution_major_version'] | int >= 11
|
|
|
|
- name: (basic.yml) Ensure timezone is is correct
|
|
community.general.timezone:
|
|
name: "{{ time_zone }}"
|
|
tags:
|
|
- timezone
|
|
|
|
- name: (basic.yml) Ensure locales are present
|
|
community.general.locale_gen:
|
|
name: "{{ item }}"
|
|
state: present
|
|
with_items: "{{ locales }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- locales
|
|
|
|
- name: (basic.yml) Create a symbolic link /bin/sh -> bash
|
|
ansible.builtin.file:
|
|
src: bash
|
|
dest: /bin/sh
|
|
owner: root
|
|
group: root
|
|
state: link
|
|
tags:
|
|
- symlink-sh
|
|
|
|
# ----------
|
|
# security limit (maybe DEPRECATED see systemd settings)
|
|
# ----------
|
|
|
|
- name: (basic.yml) Ensure directory '/etc/security/limits.d' exists
|
|
ansible.builtin.file:
|
|
path: /etc/security/limits.d
|
|
state: directory
|
|
mode: "0755"
|
|
group: root
|
|
owner: root
|
|
when:
|
|
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
|
|
- copy_plain_files_security_limits is defined
|
|
- copy_plain_files_security_limits|length > 0
|
|
tags:
|
|
- systemd-config
|
|
|
|
- name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src_path }}"
|
|
dest: "{{ item.dest_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop: "{{ copy_plain_files_security_limits }}"
|
|
loop_control:
|
|
label: "dest: {{ item.name }}"
|
|
when:
|
|
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
|
|
- copy_plain_files_security_limits is defined
|
|
- copy_plain_files_security_limits|length > 0
|
|
tags:
|
|
- systemd-config
|
|
|
|
# ----------
|
|
# systemd stuff
|
|
# ----------
|
|
|
|
- name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system.conf.d
|
|
state: directory
|
|
mode: "0755"
|
|
group: root
|
|
owner: root
|
|
when:
|
|
- >-
|
|
inventory_hostname not in groups['lxc_guest'] or
|
|
inventory_hostname in groups['lxc_host'] or
|
|
inventory_hostname in groups['oopen_office_server'] or
|
|
inventory_hostname in groups['jitsi_meet_server']
|
|
- copy_plain_files_systemd is defined
|
|
- copy_plain_files_systemd|length > 0
|
|
tags:
|
|
- systemd-config
|
|
|
|
- name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src_path }}"
|
|
dest: "{{ item.dest_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop: "{{ copy_plain_files_systemd }}"
|
|
loop_control:
|
|
label: "dest: {{ item.name }}"
|
|
when:
|
|
- >-
|
|
inventory_hostname not in groups['lxc_guest'] or
|
|
inventory_hostname in groups['lxc_host'] or
|
|
inventory_hostname in groups['oopen_office_server'] or
|
|
inventory_hostname in groups['jitsi_meet_server']
|
|
- copy_plain_files_systemd is defined
|
|
- copy_plain_files_systemd|length > 0
|
|
tags:
|
|
- systemd-config
|
|
|
|
- name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/journald.conf.d
|
|
state: directory
|
|
mode: "0755"
|
|
group: root
|
|
owner: root
|
|
when:
|
|
- copy_plain_files_journald is defined
|
|
- copy_plain_files_journald|length > 0
|
|
tags:
|
|
- systemd-config
|
|
|
|
- name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src_path }}"
|
|
dest: "{{ item.dest_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop: "{{ copy_plain_files_journald }}"
|
|
loop_control:
|
|
label: "dest: {{ item.name }}"
|
|
notify: "Restart systemd-journald"
|
|
when:
|
|
- copy_plain_files_journald is defined
|
|
- copy_plain_files_journald|length > 0
|
|
tags:
|
|
- systemd-config
|
|
|
|
# ----------
|
|
# kernel parameter
|
|
# ----------
|
|
|
|
- name: (basic.yml) Ensure directory '/etc/sysctl.d' exists
|
|
ansible.builtin.file:
|
|
path: etc/sysctl.d
|
|
state: directory
|
|
mode: "0755"
|
|
group: root
|
|
owner: root
|
|
when:
|
|
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
|
|
- copy_plain_files_sysctl is defined
|
|
- copy_plain_files_sysctl|length > 0
|
|
tags:
|
|
- systctl-config
|
|
|
|
- name: (basic.yml) Ensure files /etc/sysctl.d/*.conf exists
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src_path }}"
|
|
dest: "{{ item.dest_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop: "{{ copy_plain_files_sysctl }}"
|
|
loop_control:
|
|
label: "dest: {{ item.name }}"
|
|
when:
|
|
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
|
|
- copy_plain_files_sysctl is defined
|
|
- copy_plain_files_sysctl|length > 0
|
|
tags:
|
|
- systctl-config
|
|
|
|
- name: (basic.yml) Additional Kernel Parameters (files /etc/sysctl.d/*.conf)
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src_path }}"
|
|
dest: "{{ item.dest_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop: "{{ copy_additional_plain_files_sysctl }}"
|
|
loop_control:
|
|
label: "dest: {{ item.name }}"
|
|
when:
|
|
- inventory_hostname not in groups['lxc_guest'] or inventory_hostname in groups['lxc_host'] or inventory_hostname in groups['oopen_office_server']
|
|
- copy_additional_plain_files_sysctl is defined
|
|
- copy_additional_plain_files_sysctl|length > 0
|
|
tags:
|
|
- systctl-config
|
|
|
|
# ----------
|
|
# unattended upgrades
|
|
# ----------
|
|
|
|
- name: (basic.yml) install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
pkg: unattended-upgrades
|
|
state: present
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- unattended-upgrades
|
|
|
|
- name: (basic.yml) install apt-listchanges
|
|
ansible.builtin.apt:
|
|
pkg: apt-listchanges
|
|
state: present
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- unattended-upgrades
|
|
|
|
- name: (basic.yml) remove apticron
|
|
ansible.builtin.apt:
|
|
pkg: apticron
|
|
state: absent
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- unattended-upgrades
|
|
|
|
- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
|
|
ansible.builtin.stat:
|
|
path: /etc/apt/apt.conf.d/20auto-upgrades
|
|
register: common_ua_enabled
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- unattended-upgrades
|
|
|
|
- name: (basic.yml) activate unattended upgrades
|
|
ansible.builtin.command:
|
|
cmd: dpkg-reconfigure -plow unattended-upgrades
|
|
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
|
environment:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
DEBCONF_NONINTERACTIVE_SEEN: "true"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- not common_ua_enabled.stat.exists
|
|
tags:
|
|
- unattended-upgrades
|
|
|
|
- name: (basic.yml) copy apt-listchanges.conf
|
|
ansible.builtin.template:
|
|
src: etc/apt/listchanges.conf.j2
|
|
dest: /etc/apt/listchanges.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- unattended-upgrades
|
|
|
|
- name: (basic.yml) copy unattended-upgrades conf
|
|
ansible.builtin.template:
|
|
src: etc/apt/apt.conf.d/50unattended-upgrades.j2
|
|
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
backup: true
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- unattended-upgrades
|