skylab/skylab-ansible
Archived
2
0
Fork 0
Code Pull Requests Releases Activity

Compare commits

base: skylab:f66a1fb8cc9aa65deb5d2deea7bcaf8ef701bd88
Branches Tags
skylab:devel
...
compare: skylab:4069d8a77a73fdd67e32d7b82857cd6262355e46
Branches Tags
skylab:devel

6 Commits
f66a1fb8cc ... 4069d8a77a

Author SHA1 Message Date
Ethan Paul
4069d8a77a
Fix ssh auth config settings labels 2021-11-06 22:14:20 -04:00
Ethan Paul
fe0cd3ab67
Reorganize network spec to more accurately reflect settings 2021-11-06 22:06:12 -04:00
Ethan Paul
2cff4e4354
Fix bootstrap instructions to include group id 2021-11-06 20:46:32 -04:00
Ethan Paul
b4f9fba952
Update the mmotd to improve readability 2021-11-06 20:31:12 -04:00
Ethan Paul
8f805c3b15
Move hostname parameter to separate variable 
Update inventory to support hubble
 2021-11-06 20:31:12 -04:00
Ethan Paul
742ef24a77
Roll passwords 2021-11-06 20:31:11 -04:00
9 changed files with 92 additions and 88 deletions
Show Stats Expand all files Collapse all files

3
README.md
View File

@ -17,8 +17,9 @@ Bootstrap checklist:
sudo tee /etc/sudoers.d/30-ansible <<<"ansible ALL=(ALL) NOPASSWD:ALL" sudo tee /etc/sudoers.d/30-ansible <<<"ansible ALL=(ALL) NOPASSWD:ALL"
``` ```
5. Change the UID of the `ansible` user to `1400` with this command: 5. Change the UID/GID of the `ansible` user/group to `1400` with these commands:
```bash ```bash
sudo usermod -u 1400 ansible sudo usermod -u 1400 ansible
sudo groupmod -g 1400 ansible
``` ```

115
inventory.yaml
View File

@ -32,87 +32,90 @@ en1:
skylab_targets: [cluster, datastore] skylab_targets: [cluster, datastore]
skylab_roles: skylab_roles:
- server - server
- docker-swarm-manager - docker-swarm
- datastore - datastore
hosts: hosts:
pegasus: # jupiter pegasus: # jupiter
ansible_host: 10.42.101.100 ansible_host: 10.42.101.100
skylab_hostname: pegasus.skylab.enp.one
skylab_description: Arbiter Node skylab_description: Arbiter Node
skylab_cluster: skylab_cluster:
address: 10.42.101.10/24 address: 10.42.101.10/24
interface: bond0 interface: bond0
skylab_networking: skylab_networking:
hostname: pegasus.skylab.enp.one eno1:
dns: [10.42.101.1] bond: bond0
gateway: 10.42.101.1/24 eno2:
interfaces: bond: bond0
eno1: bond0:
bond: bond0 type: bond
eno2: gateway: 10.42.101.1/24
bond: bond0 dns:
bond0: - 10.42.101.1
type: bond addresses:
addresses: - 10.42.101.100/24
- 10.42.101.100/24 - 192.168.255.255/32
- 192.168.255.255/32 dhcp: false
dhcp: false bond0.99:
bond0.99: type: vlan
type: vlan addresses:
addresses: [192.168.42.10/24] - 192.168.42.10/24
dhcp: false dhcp: false
saturn: # remus saturn: # remus
ansible_host: 10.42.101.110 ansible_host: 10.42.101.110
skylab_hostname: saturn.skylab.enp.one
skylab_description: Operational Node skylab_description: Operational Node
skylab_cluster: skylab_cluster:
address: 10.42.101.11/24 address: 10.42.101.11/24
interface: bond0 interface: bond0
skylab_networking: skylab_networking:
hostname: saturn.skylab.enp.one eno1:
dns: [10.42.101.1] bond: bond0
gateway: 10.42.101.1/24 eno2:
interfaces: bond: bond0
eno1: bond0:
bond: bond0 type: bond
eno2: dhcp: false
bond: bond0 gateway: 10.42.101.1/24
bond0: addresses:
type: bond - 10.42.101.110/24
addresses: - 192.168.255.255/32
- 10.42.101.110/24 dns:
- 192.168.255.255/32 - 10.42.101.1
dhcp: false bond0.99:
bond0.99: type: vlan
type: vlan dhcp: false
addresses: [192.168.42.20/24] addresses:
dhcp: false - 192.168.42.20/24
orion: # romulus orion: # romulus
ansible_host: 10.42.101.120 ansible_host: 10.42.101.120
skylab_hostname: orion.skylab.enp.one
skylab_description: Operational Node skylab_description: Operational Node
skylab_cluster: skylab_cluster:
address: 10.42.101.12/24 address: 10.42.101.12/24
interface: bond0 interface: bond0
skylab_networking: skylab_networking:
hostname: orion.skylab.enp.one eno1:
dns: [10.42.101.1] bond: bond0
gateway: 10.42.101.1/24 eno2:
interfaces: bond: bond0
eno1: bond0:
bond: bond0 type: bond
eno2: gateway: 10.42.101.1/24
bond: bond0 dns:
bond0: - 10.42.101.1
type: bond addresses:
addresses: - 10.42.101.120/24
- 10.42.101.120/24 - 192.168.255.255/32
- 192.168.255.255/32 dhcp: false
dhcp: false bond0.99:
bond0.99: type: vlan
type: vlan addresses:
addresses: [192.168.42.30/24] - 192.168.42.30/24
dhcp: false dhcp: false
en2: en2:
vars: vars:
@ -121,5 +124,7 @@ en2:
hosts: hosts:
hubble: hubble:
ansible_host: en2a.enp.one ansible_host: en2a.enp.one
skylab_hostname: hubble.en2.enp.one
skylab_description: Cloud Web Server skylab_description: Cloud Web Server
skylab_targets: [cloud] skylab_targets: [cloud]
skylab_roles: [server]

2
playbooks/provision.yaml
View File

@ -23,7 +23,7 @@
- name: Set hostname - name: Set hostname
become: true become: true
ansible.builtin.hostname: ansible.builtin.hostname:
name: "{{ skylab_networking.hostname | default(inventory_hostname) }}" name: "{{ skylab_hostname | default(inventory_hostname) }}"
use: systemd use: systemd
- name: Disable case-sensitive tab-completion - name: Disable case-sensitive tab-completion

8
roles/server/tasks/networkd.yaml
View File

@ -22,19 +22,19 @@
mode: 0644 mode: 0644
owner: root owner: root
group: "{{ ansible_user }}" group: "{{ ansible_user }}"
loop: "{{ skylab_networking.interfaces | dict2items }}" loop: "{{ skylab_networking | dict2items }}"
loop_control: loop_control:
label: "{{ item.key }}" label: "{{ item.key }}"
- name: Create netdev files - name: Create netdev files
when: item.value.type is defined when: item.value.device is defined
ansible.builtin.template: ansible.builtin.template:
src: netdev.j2 src: netdev.j2
dest: /etc/systemd/network/{{ item.key }}.netdev dest: /etc/systemd/network/{{ item.key }}.netdev
mode: 0644 mode: 0644
owner: root owner: root
group: "{{ ansible_user }}" group: "{{ ansible_user }}"
loop: "{{ skylab_networking.interfaces | dict2items }}" loop: "{{ skylab_networking | dict2items }}"
loop_control: loop_control:
label: "{{ item.key }}" label: "{{ item.key }}"
@ -45,7 +45,7 @@
register: _network_config_dir_raw register: _network_config_dir_raw
- name: Remove legacy network config files - name: Remove legacy network config files
when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking.interfaces when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking
ansible.builtin.file: ansible.builtin.file:
path: /etc/systemd/network/{{ item }} path: /etc/systemd/network/{{ item }}
state: absent state: absent

14
roles/server/tasks/sshd.yaml
View File

@ -7,20 +7,16 @@
replace: "{{ item.value }}" replace: "{{ item.value }}"
notify: [restart-sshd] notify: [restart-sshd]
loop: loop:
- name: disable root login - regex: "^.*PermitRootLogin (yes|no).*$"
regex: "^.*PermitRootLogin (yes|no).*$"
value: PermitRootLogin no value: PermitRootLogin no
- name: disable password auth - regex: "^.*PasswordAuthentication (yes|no).*$"
regex: "^.*PasswordAuthentication (yes|no).*$"
value: PasswordAuthentication no value: PasswordAuthentication no
- name: disable challenge response auth - regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
value: ChallengeResponseAuthentication no value: ChallengeResponseAuthentication no
- name: disable GSSAPI auth - regex: "^.*GSSAPIAuthentication (yes|no).*$"
regex: "^.*GSSAPIAuthentication (yes|no).*$"
value: GSSAPIAuthentication no value: GSSAPIAuthentication no
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.value }}"
- name: Disable dynamic MOTD on debian systems - name: Disable dynamic MOTD on debian systems
when: ansible_os_family == "Debian" when: ansible_os_family == "Debian"

14
roles/server/templates/motd.j2
View File

@ -1,11 +1,11 @@
######## ### ### ### ### ### ####### ###### /######## /## /## /## /## /## /####### /#####
### ### ### ### ### ### ### ### ### ### /## /##___/## /##__/## /## /##___/## /##__/##
### ######## ####### ### ######### ####### /##____ /####### /###### /## /######## /######
####### ### ### ### ### ### ### ### ### \####### /## |## |## /## /## /## /##__/##
### ### ### #### ### ### ### ####### /## /## |## \### /## /## /## /######
### ### ___/## /##_____
###### /////////////////// ######### ///////////// /##### ``````````````````` /######## ``````````````
✨ {{ skylab_description }} @{{ skylab_location }} ✨ {{ skylab_description }} @{{ skylab_location }}
{{ ' ' }} {{ ' ' }}

6
roles/server/templates/netdev.j2
View File

@ -2,15 +2,15 @@
# #
[NetDev] [NetDev]
Name={{ item.key }} Name={{ item.key }}
type={{ item.value.type }} Kind={{ item.value.device }}
{% if item.value.type.lower() == 'bond' %} {% if item.value.device.lower() == 'bond' %}
[Bond] [Bond]
Mode={{ item.value.bond_mode | default('balance-rr') }} Mode={{ item.value.bond_mode | default('balance-rr') }}
PrimaryReselectPolicy=always PrimaryReselectPolicy=always
MIIMonitorSec=1s MIIMonitorSec=1s
{% endif %} {% endif %}
{% if item.value.type.lower() == 'vlan' %} {% if item.value.device.lower() == 'vlan' %}
[VLAN] [VLAN]
Id={{ item.key.partition('.')[2] }} Id={{ item.key.partition('.')[2] }}
{% endif %} {% endif %}

8
roles/server/templates/network.j2
View File

@ -14,14 +14,16 @@ DNS={{ server }}
{% if item.value.bond is defined %} {% if item.value.bond is defined %}
Bond={{ item.value.bond }} Bond={{ item.value.bond }}
{% endif %} {% endif %}
{% if item.value.dhcp | default(false) %} {% if not item.value.dhcp | default(false) %}
{% if item.value.gateway is defined %}
Gateway={{ item.value.gateway | ansible.netcommon.ipaddr('address') }} Gateway={{ item.value.gateway | ansible.netcommon.ipaddr('address') }}
{% for address in item.value.addresses %} {% endif %}
{% for address in item.value.addresses | default([]) %}
Address={{ address | ansible.netcommon.ipaddr('host/prefix') }} Address={{ address | ansible.netcommon.ipaddr('host/prefix') }}
{% endfor %} {% endfor %}
{% endif %} {% endif %}
{% for interface in skylab_networking.interfaces.keys() %} {% for interface in skylab_networking.keys() %}
{% if interface.startswith(item.key) and interface.partition('.')[2] | regex_search('^[0-9]{1,4}$') and interface != item.key %} {% if interface.startswith(item.key) and interface.partition('.')[2] | regex_search('^[0-9]{1,4}$') and interface != item.key %}
VLAN={{ interface }} VLAN={{ interface }}
{% endif %} {% endif %}

10
vars/access.yaml
View File

@ -3,16 +3,16 @@ skylab_accounts:
- name: enpaul - name: enpaul
uid: 1300 uid: 1300
fullname: Ethan N. Paul fullname: Ethan N. Paul
targets: [network, datastore, cluster] targets: [network, datastore, cluster, cloud]
admin: true admin: true
password: $y$j9T$cWkd9aGj4sNepyJm5NVZl0$yBhFy3cN3syM8r4doGYnsLZhsaTLQVoDIBs2kkXtxY2 password: $6$H7jZEL2Ey93zfMTD$CzUlZkXDudPHgUMU/OFUn8/Yhzo8nBxoSI8thD15toIFlWN.iUfq/Jp5z3KpDCGTxyv.IbRTvE8dOVWjoRfgJ.
- name: ansible - name: ansible
uid: 1400 uid: 1400
targets: [network, datastore, cluster] targets: [network, datastore, cluster, cloud]
admin: true admin: true
service: true service: true
password: $y$j9T$w/pIBtZIMo3PmXccZ.LHi1$AbMVIks.P10CyuK8tWt21O4JuLpKGpWTFgX0WlTbiw6 password: $6$qNKmYg4y9YS4f5Gr$m0mAqEVbymPguj.1cS.pfclt33Okfmn1KhFC0r1iQ3eVvz/OIZY3x0qGmPnJ1zOXDWyKKs5hnlGTAeZgCh49C.
skylab_group: skylab_group:
name: skylab name: skylab
@ -26,4 +26,4 @@ skylab_group_automation:
name: skylab_auto name: skylab_auto
gid: 1202 gid: 1202
skylab_root_password: $y$j9T$vcNKa2vbTBQLGsU7QZfkM0$4.gw4YqknZJSZJ/uRKFI36G8JtK/MJPsxFdTTmzQoL6 skylab_root_password: $6$FDwVi2DUVPg.LSrC$vRMIW6ah0x5cSZFLDrV2FuiwoUtYgcnJJV06gn2HxLsUnkXJ0/Sv1hjRn8v6bZy1AmkDCyQCtT6DHRRBuQspx.