Compare commits
3 Commits
9e0c0505b3
...
49abac297d
Author | SHA1 | Date | |
---|---|---|---|
49abac297d | |||
732cf53192 | |||
6819e6b4cb |
23
playbooks/configure.yaml
Normal file
23
playbooks/configure.yaml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- name: Group hosts by platform
|
||||||
|
hosts: all
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
pre_tasks:
|
||||||
|
- include_tasks: tasks/meta/runtime-group-determination.yaml
|
||||||
|
|
||||||
|
|
||||||
|
- name: Bootstrap remote ansible environment
|
||||||
|
hosts: linux
|
||||||
|
gather_facts: false
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
tasks:
|
||||||
|
- include_tasks: tasks/meta/bootstrap-remote-env.yaml
|
||||||
|
|
||||||
|
- name: Configure hosts by role
|
||||||
|
hosts: linux
|
||||||
|
gather_facts: false
|
||||||
|
roles:
|
||||||
|
- role: server
|
||||||
|
when: "'server' in skylab_roles | default([])"
|
@ -9,57 +9,16 @@
|
|||||||
|
|
||||||
- name: Bootstrap remote ansible environment
|
- name: Bootstrap remote ansible environment
|
||||||
hosts: linux
|
hosts: linux
|
||||||
|
gather_facts: false
|
||||||
tags:
|
tags:
|
||||||
- always
|
- always
|
||||||
tasks:
|
tasks:
|
||||||
- name: Install CentOS 8 python bindings
|
- include_tasks: tasks/meta/bootstrap-remote-env.yaml
|
||||||
when: ansible_distribution == "Rocky"
|
|
||||||
become: true
|
|
||||||
ansible.builtin.dnf:
|
|
||||||
state: present
|
|
||||||
name:
|
|
||||||
- python3-libselinux
|
|
||||||
- python3-policycoreutils
|
|
||||||
- python3-firewall
|
|
||||||
|
|
||||||
- name: Create state directory
|
|
||||||
become: true
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ skylab_state_dir }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ ansible_user }}"
|
|
||||||
group: "{{ ansible_user }}"
|
|
||||||
mode: 0755
|
|
||||||
|
|
||||||
- name: Create bootstrap virtualenv
|
|
||||||
ansible.builtin.command:
|
|
||||||
cmd: "{{ ansible_python_interpeter | default(discovered_interpreter_python) }} -m venv {{ skylab_ansible_venv }} --system-site-packages"
|
|
||||||
creates: "{{ skylab_ansible_venv }}/bin/python"
|
|
||||||
|
|
||||||
- name: Pin bootstrap virtualenv pip
|
|
||||||
ansible.builtin.pip:
|
|
||||||
executable: "{{ skylab_ansible_venv }}/bin/pip"
|
|
||||||
name: pip
|
|
||||||
state: present
|
|
||||||
version: "{{ skylab_pip_version }}"
|
|
||||||
|
|
||||||
- name: Copy requirements file to remote
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: remote-requirements.txt
|
|
||||||
dest: "{{ skylab_ansible_venv }}/requirements.txt"
|
|
||||||
owner: "{{ ansible_user }}"
|
|
||||||
group: "{{ ansible_user }}"
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
- name: Install remote requirements
|
|
||||||
ansible.builtin.pip:
|
|
||||||
executable: "{{ skylab_ansible_venv }}/bin/pip"
|
|
||||||
requirements: "{{ skylab_ansible_venv }}/requirements.txt"
|
|
||||||
state: present
|
|
||||||
|
|
||||||
|
|
||||||
- name: Configure common server settings
|
- name: Configure common settings
|
||||||
hosts: linux
|
hosts: linux
|
||||||
|
gather_facts: false
|
||||||
vars_files:
|
vars_files:
|
||||||
- vars/packages.yaml
|
- vars/packages.yaml
|
||||||
tasks:
|
tasks:
|
||||||
@ -69,6 +28,15 @@
|
|||||||
name: "{{ inventory_hostname }}"
|
name: "{{ inventory_hostname }}"
|
||||||
use: systemd
|
use: systemd
|
||||||
|
|
||||||
|
- name: Install global bash config
|
||||||
|
become: true
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: global.sh
|
||||||
|
dest: /etc/profile.d/ZZ-skylab-global.sh
|
||||||
|
owner: root
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
- name: Install EPEL repository config
|
- name: Install EPEL repository config
|
||||||
when: ansible_distribution == "Rocky"
|
when: ansible_distribution == "Rocky"
|
||||||
become: true
|
become: true
|
||||||
@ -84,25 +52,6 @@
|
|||||||
state: present
|
state: present
|
||||||
key: https://archive.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}
|
key: https://archive.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}
|
||||||
|
|
||||||
- name: Disable sudo password for WHEEL group
|
|
||||||
when: ansible_distribution == "Rocky" or ansible_distribution == "CentOS"
|
|
||||||
become: true
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: wheel-group-no-sudo-password
|
|
||||||
dest: /etc/sudoers.d/30-wheel
|
|
||||||
owner: root
|
|
||||||
group: "{{ ansible_user }}"
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
- name: Install global bash config
|
|
||||||
become: true
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: global.sh
|
|
||||||
dest: /etc/profile.d/ZZ-skylab-global.sh
|
|
||||||
owner: root
|
|
||||||
group: "{{ ansible_user }}"
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
- name: Install universal packages
|
- name: Install universal packages
|
||||||
when: ansible_distribution == "Rocky"
|
when: ansible_distribution == "Rocky"
|
||||||
become: true
|
become: true
|
||||||
@ -111,67 +60,7 @@
|
|||||||
state: present
|
state: present
|
||||||
|
|
||||||
|
|
||||||
- name: Configure SSH
|
|
||||||
hosts: linux
|
|
||||||
handlers:
|
|
||||||
- name: restart-sshd
|
|
||||||
become: true
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: sshd
|
|
||||||
state: restarted
|
|
||||||
tasks:
|
|
||||||
- name: Disable root auth
|
|
||||||
become: true
|
|
||||||
ansible.builtin.replace:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: "^.*PermitRootLogin (yes|no).*$"
|
|
||||||
replace: "PermitRootLogin no"
|
|
||||||
notify: [restart-sshd]
|
|
||||||
|
|
||||||
- name: Disable password auth
|
|
||||||
become: true
|
|
||||||
ansible.builtin.replace:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: "^.*PasswordAuthentication (yes|no).*$"
|
|
||||||
replace: "PasswordAuthentication no"
|
|
||||||
notify: [restart-sshd]
|
|
||||||
|
|
||||||
- name: Disable challenge response auth
|
|
||||||
become: true
|
|
||||||
ansible.builtin.replace:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: "^.*ChallengeResponseAuthentication (yes|no).*$"
|
|
||||||
replace: "ChallengeResponseAuthentication no"
|
|
||||||
notify: [restart-sshd]
|
|
||||||
|
|
||||||
- name: Disable GSSAPI auth
|
|
||||||
become: true
|
|
||||||
ansible.builtin.replace:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: "^.*GSSAPIAuthentication (yes|no).*$"
|
|
||||||
replace: "GSSAPIAuthentication no"
|
|
||||||
notify: [restart-sshd]
|
|
||||||
|
|
||||||
- name: Disable dynamic MOTD on debian systems
|
|
||||||
when: ansible_os_family == "Debian"
|
|
||||||
ansible.builtin.replace:
|
|
||||||
path: /etc/pam.d/sshd
|
|
||||||
regexp: "^session optional pam_motd.so motd=/run/motd.dynamic"
|
|
||||||
replace: "#session optional pam_motd.so motd=/run/motd.dynamic"
|
|
||||||
|
|
||||||
- name: Disable Cockpit activation message on Rocky
|
|
||||||
when: ansible_distribution == "Rocky"
|
|
||||||
become: true
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /etc/motd.d/cockpit
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
- name: Copy MOTD to remote
|
|
||||||
become: true
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: motd.j2
|
|
||||||
dest: /etc/motd
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
|
|
||||||
- import_playbook: update.yaml
|
- import_playbook: update.yaml
|
||||||
|
|
||||||
|
|
||||||
|
- import_playbook: configure.yaml
|
||||||
|
@ -7,6 +7,15 @@
|
|||||||
- include_tasks: tasks/meta/runtime-group-determination.yaml
|
- include_tasks: tasks/meta/runtime-group-determination.yaml
|
||||||
|
|
||||||
|
|
||||||
|
- name: Bootstrap remote ansible environment
|
||||||
|
hosts: linux
|
||||||
|
gather_facts: false
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
tasks:
|
||||||
|
- include_tasks: tasks/meta/bootstrap-remote-env.yaml
|
||||||
|
|
||||||
|
|
||||||
- name: Update system
|
- name: Update system
|
||||||
hosts: linux
|
hosts: linux
|
||||||
tags:
|
tags:
|
||||||
|
6
roles/server/handlers/main.yaml
Normal file
6
roles/server/handlers/main.yaml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
- name: restart-sshd
|
||||||
|
become: true
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: sshd
|
||||||
|
state: restarted
|
13
roles/server/tasks/main.yaml
Normal file
13
roles/server/tasks/main.yaml
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
- name: Disable sudo password for WHEEL group
|
||||||
|
when: ansible_distribution == "Rocky" or ansible_distribution == "CentOS"
|
||||||
|
become: true
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: wheel-group-no-sudo-password
|
||||||
|
dest: /etc/sudoers.d/30-wheel
|
||||||
|
owner: root
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
- name: Configure SSH server
|
||||||
|
ansible.builtin.import_tasks: sshd.yml
|
44
roles/server/tasks/sshd.yaml
Normal file
44
roles/server/tasks/sshd.yaml
Normal file
@ -0,0 +1,44 @@
|
|||||||
|
---
|
||||||
|
- name: Configure SSH authentication settings
|
||||||
|
become: true
|
||||||
|
ansible.builtin.replace:
|
||||||
|
path: /etc/ssh/sshd_config
|
||||||
|
regexp: "{{ item.regex }}"
|
||||||
|
replace: "{{ item.value }}"
|
||||||
|
notify: [restart-sshd]
|
||||||
|
loop:
|
||||||
|
- name: disable root login
|
||||||
|
regex: "^.*PermitRootLogin (yes|no).*$"
|
||||||
|
value: PermitRootLogin no
|
||||||
|
- name: disable password auth
|
||||||
|
regex: "^.*PasswordAuthentication (yes|no).*$"
|
||||||
|
value: PasswordAuthentication no
|
||||||
|
- name: disable challenge response auth
|
||||||
|
regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
|
||||||
|
value: ChallengeResponseAuthentication no
|
||||||
|
- name: disable GSSAPI auth
|
||||||
|
regex: "^.*GSSAPIAuthentication (yes|no).*$"
|
||||||
|
value: GSSAPIAuthentication no
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.name }}"
|
||||||
|
|
||||||
|
- name: Disable dynamic MOTD on debian systems
|
||||||
|
when: ansible_os_family == "Debian"
|
||||||
|
ansible.builtin.replace:
|
||||||
|
path: /etc/pam.d/sshd
|
||||||
|
regexp: "^session optional pam_motd.so motd=/run/motd.dynamic"
|
||||||
|
replace: "#session optional pam_motd.so motd=/run/motd.dynamic"
|
||||||
|
|
||||||
|
- name: Disable Cockpit activation message on Rocky
|
||||||
|
when: ansible_distribution == "Rocky"
|
||||||
|
become: true
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/motd.d/cockpit
|
||||||
|
state: absent
|
||||||
|
|
||||||
|
- name: Copy MOTD to remote
|
||||||
|
become: true
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: motd.j2
|
||||||
|
dest: /etc/motd
|
||||||
|
mode: 0644
|
45
tasks/meta/bootstrap-remote-env.yaml
Normal file
45
tasks/meta/bootstrap-remote-env.yaml
Normal file
@ -0,0 +1,45 @@
|
|||||||
|
---
|
||||||
|
- name: Install CentOS 8 python bindings
|
||||||
|
when: ansible_distribution == "Rocky"
|
||||||
|
become: true
|
||||||
|
ansible.builtin.dnf:
|
||||||
|
state: present
|
||||||
|
name:
|
||||||
|
- python3-libselinux
|
||||||
|
- python3-policycoreutils
|
||||||
|
- python3-firewall
|
||||||
|
|
||||||
|
- name: Create state directory
|
||||||
|
become: true
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ skylab_state_dir }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ ansible_user }}"
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: 0755
|
||||||
|
|
||||||
|
- name: Create bootstrap virtualenv
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "{{ ansible_python_interpeter | default(discovered_interpreter_python) }} -m venv {{ skylab_ansible_venv }} --system-site-packages"
|
||||||
|
creates: "{{ skylab_ansible_venv }}/bin/python"
|
||||||
|
|
||||||
|
- name: Pin bootstrap virtualenv pip
|
||||||
|
ansible.builtin.pip:
|
||||||
|
executable: "{{ skylab_ansible_venv }}/bin/pip"
|
||||||
|
name: pip
|
||||||
|
state: present
|
||||||
|
version: "{{ skylab_pip_version }}"
|
||||||
|
|
||||||
|
- name: Copy requirements file to remote
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: remote-requirements.txt
|
||||||
|
dest: "{{ skylab_ansible_venv }}/requirements.txt"
|
||||||
|
owner: "{{ ansible_user }}"
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
- name: Install remote requirements
|
||||||
|
ansible.builtin.pip:
|
||||||
|
executable: "{{ skylab_ansible_venv }}/bin/pip"
|
||||||
|
requirements: "{{ skylab_ansible_venv }}/requirements.txt"
|
||||||
|
state: present
|
Reference in New Issue
Block a user