redisign ..
This commit is contained in:
306
roles/common/tasks/apt.yml
Normal file
306
roles/common/tasks/apt.yml
Normal file
@ -0,0 +1,306 @@
|
||||
---
|
||||
|
||||
- name: (apt.yml) update configuration file - /etc/apt/sources.list
|
||||
template:
|
||||
src: "etc/apt/sources.list.{{ ansible_distribution }}.j2"
|
||||
dest: /etc/apt/sources.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
register: apt_config_updated
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- apt_manage_sources_list|bool
|
||||
tags:
|
||||
- apt-configuration
|
||||
|
||||
|
||||
- name: (apt.yml) apt update
|
||||
apt:
|
||||
update_cache: true
|
||||
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
|
||||
when: apt_update|bool
|
||||
tags:
|
||||
- apt-update
|
||||
- apt-upgrade
|
||||
- apt-dpkg-configure
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
- apt-compiler-pkgs
|
||||
- apt-webserver-pkgs
|
||||
|
||||
|
||||
- name: (apt.yml) dpkg --configure
|
||||
command: >
|
||||
dpkg --configure -a
|
||||
args:
|
||||
warn: false
|
||||
changed_when: _dpkg_configure.stdout_lines | length
|
||||
register: _dpkg_configure
|
||||
when: apt_dpkg_configure|bool
|
||||
tags:
|
||||
- apt-dpkg-configure
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
- apt-compiler-pkgs
|
||||
- apt-webserver-pkgs
|
||||
|
||||
|
||||
- name: (apt.yml) apt upgrade
|
||||
apt:
|
||||
upgrade: "{{ apt_upgrade_type }}"
|
||||
update_cache: true
|
||||
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
||||
when: apt_upgrade|bool
|
||||
tags:
|
||||
- apt-upgrade
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
- apt-compiler-pkgs
|
||||
- apt-webserver-pkgs
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (stretch)
|
||||
apt:
|
||||
name: "{{ apt_initial_install_stretch }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "9"
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install debian packages (buster)
|
||||
apt:
|
||||
name: "{{ apt_initial_install_buster }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "10"
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
- name: (apt.yml) Initial install ubuntu packages (bionic)
|
||||
apt:
|
||||
name: "{{ apt_initial_install_bionic }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "bionic"
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
- name: (apt.yml) Initial install ubuntu packages (xenial)
|
||||
apt:
|
||||
name: "{{ apt_initial_install_xenial }}"
|
||||
state: "{{ apt_install_state }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "xenial"
|
||||
tags:
|
||||
- apt-initial-install
|
||||
|
||||
|
||||
# ---
|
||||
# Microcode
|
||||
# ---
|
||||
|
||||
- name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch)
|
||||
apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}-backports"
|
||||
when:
|
||||
- apt_backports_enable
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "9"
|
||||
- ansible_facts['processor']|string is search("Intel")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Ensure we have CPU microcode from backports for AMD CPU (debian stretch)
|
||||
apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}-backports"
|
||||
when:
|
||||
- apt_backports_enable
|
||||
- apt_debian_contrib_nonfree_enable
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "9"
|
||||
- ansible_facts['processor']|string is search("AMD")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel CPU (debian buster)
|
||||
apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "10"
|
||||
- ansible_facts['processor']|string is search("Intel")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
|
||||
apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- apt_debian_contrib_nonfree_enable
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "10"
|
||||
- ansible_facts['processor']|string is search("AMD")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
|
||||
apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "bionic"
|
||||
- ansible_facts['processor']|string is search("Intel")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
|
||||
apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- apt_debian_contrib_nonfree_enable
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "bionic"
|
||||
- ansible_facts['processor']|string is search("AMD")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
|
||||
apt:
|
||||
name: "{{ microcode_intel_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "xenial"
|
||||
- ansible_facts['processor']|string is search("Intel")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
|
||||
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
|
||||
apt:
|
||||
name: "{{ microcode_amd_package }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- apt_debian_contrib_nonfree_enable
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "xenial"
|
||||
- ansible_facts['processor']|string is search("AMD")
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
# ---
|
||||
# Firmware
|
||||
# ---
|
||||
|
||||
- name: (apt.yml) Install Firmware packages
|
||||
apt:
|
||||
name: "{{ firmware_non_free_packages }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-firmware
|
||||
|
||||
|
||||
- name: (apt.yml) Install non-free Firmware packages
|
||||
apt:
|
||||
name: "{{ firmware_non_free_packages }}"
|
||||
state: present
|
||||
default_release: "{{ ansible_distribution_release }}"
|
||||
when:
|
||||
- apt_debian_contrib_nonfree_enable
|
||||
tags:
|
||||
- apt-initial-install
|
||||
- apt-firmware
|
||||
|
||||
|
||||
# ---
|
||||
# unwanted packages
|
||||
# ---
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages
|
||||
apt:
|
||||
name: "{{ apt_remove }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
tags:
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages Ubuntu bionic
|
||||
apt:
|
||||
name: "{{ apt_remove_bionic }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "bionic"
|
||||
tags:
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) Remove unwanted packages Ubuntu xenial
|
||||
apt:
|
||||
name: "{{ apt_remove_xenial }}"
|
||||
state: absent
|
||||
purge: "{{ apt_remove_purge }}"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Ubuntu"
|
||||
- ansible_facts['distribution_release'] == "xenial"
|
||||
tags:
|
||||
- apt-remove
|
||||
|
||||
- name: (apt.yml) autoremove
|
||||
apt:
|
||||
autoremove: true
|
||||
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
||||
when: apt_autoremove|bool
|
||||
tags:
|
||||
- apt-autoremove
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
|
||||
- name: (apt.yml) clean
|
||||
command: apt-get -y clean
|
||||
args:
|
||||
warn: false
|
||||
changed_when: false
|
||||
when: apt_clean|bool
|
||||
tags:
|
||||
- apt-clean
|
||||
- apt-initial-install
|
||||
- apt-microcode
|
||||
105
roles/common/tasks/basic.yml
Normal file
105
roles/common/tasks/basic.yml
Normal file
@ -0,0 +1,105 @@
|
||||
---
|
||||
|
||||
- name: (basic.yml) Ensure timezone is is correct
|
||||
timezone: name={{ time_zone }}
|
||||
tags:
|
||||
- timezone
|
||||
|
||||
|
||||
- name: (basic.yml) Ensure locales are present
|
||||
locale_gen:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ locales }}"
|
||||
tags:
|
||||
- locales
|
||||
|
||||
|
||||
- name: (basic.yml) Create a symbolic link /bin/sh -> bash
|
||||
file:
|
||||
src: bash
|
||||
dest: /bin/sh
|
||||
owner: root
|
||||
group: root
|
||||
state: link
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- symlink-sh
|
||||
|
||||
|
||||
- name: (basic.yml) Check file '/etc/systemd/system.conf' exists
|
||||
stat:
|
||||
path: /etc/systemd/system
|
||||
register: etc_systemd_system_conf
|
||||
when:
|
||||
- set_default_limit_nofile|bool == true
|
||||
|
||||
|
||||
- name: (basic.yml) Change DefaultLimitNOFILE to 1048576
|
||||
lineinfile:
|
||||
dest: /etc/systemd/system.conf
|
||||
state: present
|
||||
regexp: '^DefaultLimitNOFILE'
|
||||
line: 'DefaultLimitNOFILE=1048576'
|
||||
insertafter: '^#DefaultLimitNOFILE'
|
||||
when:
|
||||
- set_default_limit_nofile|bool == true
|
||||
- etc_systemd_system_conf.stat.exists == true
|
||||
tags:
|
||||
- systemd-nofiles
|
||||
|
||||
|
||||
- name: (basic.yml) Check file '/etc/security/limits.conf.ORIG' exists
|
||||
stat:
|
||||
path: /etc/security/limits.conf.ORIG
|
||||
register: etc_security_limits_conf_ORIG
|
||||
tags:
|
||||
- limits-conf
|
||||
|
||||
- name: (basic.yml) Backup installation version of file '/etc/security/limits.conf'
|
||||
command: cp -a /etc/security/limits.conf /etc/security/limits.conf.ORIG
|
||||
when: etc_security_limits_conf_ORIG.stat.exists == False
|
||||
tags:
|
||||
- limits-conf
|
||||
|
||||
|
||||
- name: (basic.yml) Create new sshd_config from template limits.conf.j2
|
||||
template:
|
||||
src: etc/security/limits.conf.j2
|
||||
dest: /etc/security/limits.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
tags:
|
||||
- limits-conf
|
||||
|
||||
# - /etc/hosts
|
||||
|
||||
- name: (basic.yml) Check file '/etc/hosts.ORIG' exists
|
||||
stat:
|
||||
path: /etc/hosts.ORIG
|
||||
register: etc_hosts_ORIG
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- etc_hosts
|
||||
|
||||
- name: (basic.yml) Backup installation version of file '/etc/hosts'
|
||||
command: cp -a /etc/hosts /etc/hosts.ORIG
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- etc_hosts_ORIG.stat.exists == False
|
||||
tags:
|
||||
- etc_hosts
|
||||
|
||||
- name: (basic.yml) addjust '/etc/hosts' add nis-server ..
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: '^192\.168\.'
|
||||
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
|
||||
when:
|
||||
- "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- etc_hosts
|
||||
|
||||
152
roles/common/tasks/cups-install.yml
Normal file
152
roles/common/tasks/cups-install.yml
Normal file
@ -0,0 +1,152 @@
|
||||
---
|
||||
|
||||
|
||||
# ---
|
||||
# Cups Server
|
||||
# ---
|
||||
|
||||
- name: (cups-install.yml) Ensure CUPS packages server (buster) are installed.
|
||||
package:
|
||||
pkg: '{{ apt_install_server_cups_buster }}'
|
||||
state: present
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- ansible_facts['distribution_major_version'] == "10"
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
|
||||
# ---
|
||||
# Cups clients
|
||||
# ---
|
||||
|
||||
- name: (cups.yml) Ensure CUPS packages clients are installed.
|
||||
package:
|
||||
pkg: "{{ apt_install_client_cups }}"
|
||||
state: present
|
||||
when:
|
||||
- ansible_distribution_version == "18.04"
|
||||
- ansible_architecture == "x86_64"
|
||||
tags:
|
||||
- cups-client
|
||||
|
||||
|
||||
|
||||
# -- file /etc/cups/cups-browsed.conf
|
||||
- name: (cups.yml) Check if file '/etc/cups/cups-browsed.conf.ORIGi' exists
|
||||
stat:
|
||||
path: /etc/cups/cups-browsed.conf.ORIG
|
||||
register: cups_browsed_conf_orig_exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) Backup /etc/cups/cups-browsed.conf file
|
||||
command: cp /etc/cups/cups-browsed.conf /etc/cups/cups-browsed.conf.ORIG
|
||||
when: cups_browsed_conf_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) update configuration file server - /etc/cups/cups-browsed.conf
|
||||
template:
|
||||
src: "etc/cups/cups-browsed.conf.server.j2"
|
||||
dest: /etc/cups/cups-browsed.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify:
|
||||
Restart cups-browsed
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
- name: (cups.yml) update configuration file client - /etc/cups/cups-browsed.conf
|
||||
template:
|
||||
src: "etc/cups/cups-browsed.conf.client.j2"
|
||||
dest: /etc/cups/cups-browsed.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify:
|
||||
Restart cups-browsed
|
||||
when:
|
||||
- groups['client_pc']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-client
|
||||
|
||||
|
||||
# -- file /etc/cups/cupsd.conf
|
||||
- name: (cups.yml) Check if file '/etc/cups/cupsd.conf.ORIG' exists
|
||||
stat:
|
||||
path: /etc/cups/cupsd.conf.ORIG
|
||||
register: cupsd_conf_orig_exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) Backup /etc/cups/cupsd.conf file
|
||||
command: cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.ORIG
|
||||
when: cupsd_conf_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) update configuration file server - /etc/cups/cupsd.conf
|
||||
template:
|
||||
src: "etc/cups/cupsd.conf.server.j2"
|
||||
dest: /etc/cups/cupsd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify:
|
||||
Restart cups
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
- name: (cups.yml) update configuration file client - /etc/cups/cupsd.conf
|
||||
template:
|
||||
src: "etc/cups/cupsd.conf.client.j2"
|
||||
dest: /etc/cups/cupsd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify:
|
||||
Restart cups
|
||||
when:
|
||||
- groups['client_pc']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- cups-server
|
||||
|
||||
# -- file /etc/cups/cups-files.conf
|
||||
- name: (cups.yml) Check if file '/etc/cups/cups-files.conf.ORIGi' exists
|
||||
stat:
|
||||
path: /etc/cups/cups-files.conf.ORIG
|
||||
register: cups_files_conf_orig_exists
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) Backup /etc/cups/cups-files.conf file
|
||||
command: cp /etc/cups/cups-files.conf /etc/cups/cups-files.conf.ORIG
|
||||
when: cups_files_conf_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
- name: (cups.yml) update configuration file server - /etc/cups/cups-files.conf
|
||||
template:
|
||||
src: "etc/cups/cups-files.conf.j2"
|
||||
dest: /etc/cups/cups-files.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify:
|
||||
Restart cups
|
||||
tags:
|
||||
- cups-server
|
||||
- cups-client
|
||||
|
||||
66
roles/common/tasks/git.yml
Normal file
66
roles/common/tasks/git.yml
Normal file
@ -0,0 +1,66 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# Default reposotories
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update default repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_default_repositories }}'
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
tags:
|
||||
- git-default-repositories
|
||||
|
||||
|
||||
# ---
|
||||
# Group [file_server] reposotories
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update file_server repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_oopen_server_repositories }}'
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- git-file-server-repositories
|
||||
|
||||
|
||||
# ---
|
||||
# Group [samba_server] reposotories
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update samba server repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_samba_repositories }}'
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when: "groups['samba_server']|string is search(inventory_hostname)"
|
||||
ignore_errors: True
|
||||
tags:
|
||||
- git-samba-server-repositories
|
||||
|
||||
|
||||
# ---
|
||||
# Group [gateway_server] reposotories
|
||||
# ---
|
||||
|
||||
- name: (git.yml) Install/Update gateway repositories
|
||||
git:
|
||||
repo: '{{ item.repo }}'
|
||||
dest: '{{ item.dest }}'
|
||||
with_items: '{{ git_gateway_repositories }}'
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when: "groups['gateway_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- git-gateway-server-repositories
|
||||
|
||||
|
||||
@ -1,4 +1,78 @@
|
||||
---
|
||||
|
||||
# tags supported inside basic.yml
|
||||
#
|
||||
# timezone
|
||||
# locales
|
||||
# systemd-nofiles
|
||||
- import_tasks: basic.yml
|
||||
tags:
|
||||
- basic
|
||||
|
||||
|
||||
# tags supported inside sshd.yml
|
||||
#
|
||||
# sshd-config
|
||||
- import_tasks: sshd.yml
|
||||
tags: sshd
|
||||
|
||||
|
||||
# tags supported inside apt.yml
|
||||
#
|
||||
# apt-update
|
||||
# apt-upgrade
|
||||
# apt-dpkg-configure
|
||||
# apt-initial-install
|
||||
# apt-microcode
|
||||
# apt-remove
|
||||
# apt-autoremove
|
||||
# apt-clean
|
||||
- import_tasks: apt.yml
|
||||
tags: apt
|
||||
|
||||
|
||||
# tags supportetd inside git.yml
|
||||
#
|
||||
# git-default-repositories
|
||||
# git-file-server-repositories
|
||||
# git-gateway-server-repositories
|
||||
- import_tasks: git.yml
|
||||
tags: git
|
||||
|
||||
# tags supported inside nis_user.yml:
|
||||
#
|
||||
# nis-user
|
||||
# system-user
|
||||
- import_tasks: nis-user.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-user
|
||||
|
||||
|
||||
# tags supported inside ntp.yml:
|
||||
#
|
||||
# ntp-server
|
||||
- import_tasks: ntp.yml
|
||||
tags:
|
||||
- ntp
|
||||
|
||||
|
||||
# tags supported inside cups-install.yml:
|
||||
#
|
||||
# cups-server
|
||||
# cups-client
|
||||
- import_tasks: cups-install.yml
|
||||
tags:
|
||||
- cups
|
||||
|
||||
|
||||
## tags supported inside pure-ftpd-install.yml:
|
||||
##
|
||||
#- import_tasks: pure-ftpd-install.yml
|
||||
# when:
|
||||
# - groups['ftp_server']|string is search(inventory_hostname)
|
||||
# tags:
|
||||
# - pure-ftpd
|
||||
|
||||
|
||||
# tags supported inside nfs.yml:
|
||||
@ -9,6 +83,33 @@
|
||||
tags:
|
||||
- nfs
|
||||
|
||||
|
||||
# tags supported inside samba-install.yml:
|
||||
#
|
||||
# samba-server
|
||||
# samba-client
|
||||
- import_tasks: samba-install.yml
|
||||
tags:
|
||||
- samba-install
|
||||
- samba
|
||||
|
||||
|
||||
# tags supported inside samba-remove-user.yml:
|
||||
#
|
||||
- import_tasks: samba-remove-user.yml
|
||||
tags:
|
||||
- samba-remove-user
|
||||
|
||||
|
||||
# tags supported inside system-user.yml:
|
||||
#
|
||||
# system-user
|
||||
- import_tasks: system-user.yml
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
|
||||
# tags supported inside nfs.yml:
|
||||
#
|
||||
# nis-install-server
|
||||
@ -16,6 +117,7 @@
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
# tags supported inside nfs.yml:
|
||||
#
|
||||
@ -24,44 +126,72 @@
|
||||
when: "groups['nis_client']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
|
||||
# tags supported inside nis_user.yml:
|
||||
#
|
||||
# nis-user
|
||||
# system-user
|
||||
- import_tasks: nis_user.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-user
|
||||
- nis-install-client
|
||||
|
||||
# tags supported inside samba_user.yml:
|
||||
#
|
||||
# samba-user
|
||||
- import_tasks: samba_user.yml
|
||||
- import_tasks: samba-user.yml
|
||||
when: "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-samba-user
|
||||
|
||||
# tags supported user-systemfiles.yml:
|
||||
|
||||
# profile
|
||||
- import_tasks: user-systemfiles.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- user-systemfiles
|
||||
|
||||
# tags supported inside sudoers.yml:
|
||||
#
|
||||
# sudoers-remove
|
||||
# sudoers-file-configuration
|
||||
# sudoers-global-configuration
|
||||
- import_tasks: sudoers.yml
|
||||
when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- sudoers
|
||||
|
||||
- import_tasks: mount_samba_shares.yml
|
||||
when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- samba-shares
|
||||
|
||||
|
||||
# tags supported system-user-systemfiles.yml:
|
||||
#
|
||||
# profile
|
||||
# bashrc
|
||||
# vimrc
|
||||
- import_tasks: system-user-systemfiles.yml
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- user-systemfiles
|
||||
|
||||
|
||||
# tags supported nis-user-systemfiles.yml:
|
||||
#
|
||||
# profile
|
||||
# bashrc
|
||||
# vimrc
|
||||
- import_tasks: nis-user-systemfiles.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- user-systemfiles
|
||||
- nis-user-systemfiles
|
||||
|
||||
|
||||
# tags supported root-files-scripts.yml:
|
||||
|
||||
# wakeup_lan
|
||||
- import_tasks: root-files-scripts.yml
|
||||
tags:
|
||||
- root-files-scripts
|
||||
|
||||
|
||||
# tags supported inside sudoers-pc.yml:
|
||||
#
|
||||
# sudoers-remove
|
||||
# sudoers-file-configuration
|
||||
# sudoers-global-configuration
|
||||
- import_tasks: sudoers-pc.yml
|
||||
when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- sudoers
|
||||
|
||||
|
||||
# tags supported inside sudoers-server.yml:
|
||||
#
|
||||
# sudoers-remove
|
||||
# sudoers-file-configuration
|
||||
# sudoers-global-configuration
|
||||
- import_tasks: sudoers-server.yml
|
||||
when: "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- sudoers
|
||||
|
||||
|
||||
@ -44,6 +44,23 @@
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
- name: Enable service rpc-statd and ensure it is not masked
|
||||
systemd:
|
||||
name: rpc-statd
|
||||
enabled: yes
|
||||
masked: no
|
||||
when:
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
|
||||
- name: Make sure service rpc-statd is running
|
||||
systemd:
|
||||
state: started
|
||||
name: rpc-statd
|
||||
when:
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
# ---
|
||||
# NFS clients
|
||||
# ---
|
||||
|
||||
@ -145,7 +145,7 @@
|
||||
- name: (nis-install-client.yml) Add nis-server to file /etc/hosts
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[1] }}'
|
||||
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
@ -160,7 +160,7 @@
|
||||
# /etc/nsswitch.conf
|
||||
# ---
|
||||
|
||||
- name: (nis.yml) Check if file '/etc/nsswitch.conf.ORIG' exists
|
||||
- name: (nis-install-client.yml) Check if file '/etc/nsswitch.conf.ORIG' exists
|
||||
stat:
|
||||
path: /etc/nsswitch.conf.ORIG
|
||||
register: nsswitch_conf_orig_exists
|
||||
@ -168,7 +168,7 @@
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis.yml) Backup existing file /etc/nsswitch.conf
|
||||
- name: (nis-install-client.yml) Backup existing file /etc/nsswitch.conf
|
||||
command: cp -a /etc/nsswitch.conf /etc/nsswitch.conf.ORIG
|
||||
when:
|
||||
- nsswitch_conf_orig_exists.stat.exists == False
|
||||
|
||||
@ -4,6 +4,16 @@
|
||||
# Install nis
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Install nis common packages
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ nis_common_packages }}"
|
||||
register: nis_installed
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Set (nis) default domain (/etc/defaultdomain)
|
||||
template:
|
||||
dest: /etc/defaultdomain
|
||||
@ -15,15 +25,16 @@
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Install nis common packages
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ nis_common_packages }}"
|
||||
register: nis_installed
|
||||
- name: (nis-install-server.yml) Create preconfigured /etc/yp.conf on nis clients
|
||||
template:
|
||||
dest: /etc/yp.conf
|
||||
src: etc/yp.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# ---
|
||||
@ -85,14 +96,14 @@
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-client.yml) Comment line like '0.0.0.0 ..' to file /etc/ypserv.securenets
|
||||
- name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file /etc/ypserv.securenets
|
||||
replace:
|
||||
path: /etc/ypserv.securenets
|
||||
regexp: '^(0.0.0.0\s+.*)'
|
||||
replace: '#\1'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file /etc/ypserv.securenets
|
||||
lineinfile:
|
||||
@ -105,7 +116,7 @@
|
||||
mode: '0644'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file /etc/ypserv.securenets
|
||||
lineinfile:
|
||||
@ -134,13 +145,13 @@
|
||||
|
||||
- name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually /data/home) exists
|
||||
file:
|
||||
path: '{{ nis_base_home}}'
|
||||
path: '{{ nis_base_home }}'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
when:
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
- "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
183
roles/common/tasks/nis-user-systemfiles.yml
Normal file
183
roles/common/tasks/nis-user-systemfiles.yml
Normal file
@ -0,0 +1,183 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# Check if local template directories exists
|
||||
# ---
|
||||
|
||||
# nis_users
|
||||
- name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
|
||||
local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }}
|
||||
with_items: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: local_template_dir_nis_user
|
||||
|
||||
|
||||
# --
|
||||
# Copy .profile
|
||||
# ---
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Check if users file '.profile.ORIG' exists
|
||||
stat:
|
||||
path: "~{{ item.name }}/.profile.ORIG"
|
||||
register: profile_user_orig_exists
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
|
||||
loop: "{{ profile_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == False
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy .profile if it exists
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') }}"
|
||||
dest: "~{{ item.item.name }}/.profile"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_nis_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile')
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy default .profile if it exists
|
||||
template:
|
||||
src: files/homedirs/DEFAULT/_profile.j2
|
||||
dest: "~{{ item.item.name }}/.profile"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_nis_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == false
|
||||
tags:
|
||||
- profile
|
||||
|
||||
|
||||
# --
|
||||
# Copy .bashrc
|
||||
# ---
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
|
||||
stat:
|
||||
path: "~{{ item.name }}/.bashrc.ORIG"
|
||||
register: bashrc_user_orig_exists
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Backup existing users .bashrc file
|
||||
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
|
||||
loop: "{{ bashrc_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when: item.stat.exists == False
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy .bashrc if it exists
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') }}"
|
||||
dest: "~{{ item.item.name }}/.bashrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_nis_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc')
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy default .bashrc if it exists
|
||||
copy:
|
||||
src: files/homedirs/DEFAULT/_bashrc
|
||||
dest: "~{{ item.item.name }}/.bashrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_nis_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == false
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
|
||||
# --
|
||||
# Copy .vimrc
|
||||
# ---
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy .vimrc if it exists
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') }}"
|
||||
dest: "~{{ item.item.name }}/.vimrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_nis_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc')
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
- name: (nis-user-systemfiles.yml) Check if .vim directory exists for default users
|
||||
local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }}/.vim
|
||||
with_items: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: local_template_dir_dotvim_default_user
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy .vim directory if it exists
|
||||
copy:
|
||||
src: "{{ inventory_dir + '/files/homedirs/' + item.item.name + '/.vim' }}"
|
||||
dest: "~{{ item.item.name }}"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
with_items: "{{ local_template_dir_dotvim_default_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
- name: (nis-user-systemfiles.yml) copy default .vimrc if it exists
|
||||
copy:
|
||||
src: files/homedirs/DEFAULT/_vimrc
|
||||
dest: "~{{ item.item.name }}/.vimrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_nis_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == false
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
175
roles/common/tasks/nis-user.yml
Normal file
175
roles/common/tasks/nis-user.yml
Normal file
@ -0,0 +1,175 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Remove (old) users from system
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ remove_nis_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ remove_nis_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Ensure nis groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
loop: "{{ nis_groups }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: item.group_id is defined
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
|
||||
- name: (nis_user.yml) Get database of nis (system) users
|
||||
getent:
|
||||
database: passwd
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Add nis (system) users if not yet exists..
|
||||
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.name not in getent_passwd
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Ensure nis users exists
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
#group: '{{ item.0.name | default(omit) }}'
|
||||
groups: "{{ item.groups|join(', ') }}"
|
||||
home: '{{ nis_base_home }}/{{ item.name }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
password: "{{ item.password | password_hash('sha512') }}"
|
||||
update_password: on_create
|
||||
append: yes
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
|
||||
- name: (nis_user.yml) Check if directory ~/.config/autostart exists
|
||||
stat:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: home_config_autostart
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
|
||||
- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
|
||||
file:
|
||||
path: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart'
|
||||
state: directory
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0700
|
||||
recurse: yes
|
||||
loop: "{{ home_config_autostart.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when : not item.stat.exists|bool
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
|
||||
#- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
|
||||
# file:
|
||||
# path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
|
||||
# state: directory
|
||||
# owner: "{{ item.name }}"
|
||||
# group: "{{ item.name }}"
|
||||
# mode: 0700
|
||||
# recurse: yes
|
||||
# loop: "{{ nis_user }}"
|
||||
# loop_control:
|
||||
# label: '{{ item.name }}'
|
||||
# tags:
|
||||
# - nis-user
|
||||
# - x11vnc
|
||||
|
||||
|
||||
- name: (nis_user.yml) Check if file ~/.config/autostart/x11vnc.desktop exists
|
||||
stat:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: home_config_autostart_x11vnc
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
|
||||
copy:
|
||||
src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
|
||||
dest: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart/x11vnc.desktop'
|
||||
owner: '{{ item.item.name }}'
|
||||
group: '{{ item.item.name }}'
|
||||
mode: 0600
|
||||
loop: "{{ home_config_autostart_x11vnc.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- x11vnc
|
||||
|
||||
#- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
|
||||
# copy:
|
||||
# src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
|
||||
# dest: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
|
||||
# owner: '{{ item.name }}'
|
||||
# group: '{{ item.name }}'
|
||||
# mode: 0600
|
||||
# loop: "{{ nis_user }}"
|
||||
# loop_control:
|
||||
# label: '{{ item.name }}'
|
||||
# tags:
|
||||
# - nis-user
|
||||
# - x11vnc
|
||||
|
||||
|
||||
@ -1,95 +0,0 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Remove (old) users from system
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Ensure nis groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
loop: "{{ nis_groups }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: item.group_id is defined
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
|
||||
- name: (nis_user.yml) Check if nis (system) user exists
|
||||
shell: "getent passwd {{ item.name }}"
|
||||
register: nis_user_exists
|
||||
changed_when: "nis_user_exists.rc == 2"
|
||||
failed_when: "nis_user_exists.rc > 2"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
ignore_errors: true
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Add nis (system) users
|
||||
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: nis_user_exists is changed
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Ensure nis users exists
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
#group: '{{ item.0.name | default(omit) }}'
|
||||
groups: "{{ item.groups|join(', ') }}"
|
||||
home: '{{ nis_base_home }}/{{ item.name }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
password: "{{ item.password | password_hash('sha512') }}"
|
||||
update_password: on_create
|
||||
append: yes
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
|
||||
47
roles/common/tasks/ntp.yml
Normal file
47
roles/common/tasks/ntp.yml
Normal file
@ -0,0 +1,47 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# NTP Server
|
||||
# ---
|
||||
|
||||
- name: (ntp.yml) Ensure ntp package is installed.
|
||||
apt:
|
||||
name:
|
||||
- ntp
|
||||
state: present
|
||||
when:
|
||||
- ansible_os_family == "Debian"
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
- name: (ntp.yml) Check file '/etc/ntp.conf.ORIG' exists
|
||||
stat:
|
||||
path: /etc/ntp.conf.ORIG
|
||||
register: etc_ntp_conf_ORIG
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
- name: (ntp.yml) Backup installation version of file '/etc/ntp.conf'
|
||||
command: cp -a /etc/ntp.conf /etc/ntp.conf.ORIG
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
- etc_ntp_conf_ORIG.stat.exists == False
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
- name: (ntp.yml) Update '/etc/ntp.conf'
|
||||
template:
|
||||
src: "etc/ntp.conf.j2"
|
||||
dest: /etc/ntp.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: Restart ntp
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- ntp-server
|
||||
|
||||
51
roles/common/tasks/root-files-scripts.yml
Normal file
51
roles/common/tasks/root-files-scripts.yml
Normal file
@ -0,0 +1,51 @@
|
||||
---
|
||||
|
||||
- name: (root_files_scripts.yml) Ensure directory /root/bin exists
|
||||
file:
|
||||
path: /root/bin
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0700'
|
||||
state: directory
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
|
||||
- name: (root_files_scripts.yml) Ensure script 'wakeup_lan.sh' is present
|
||||
template:
|
||||
src: "root/bin/wakeup_lan.sh.j2"
|
||||
dest: /root/bin/wakeup_lan.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- groups['file_server']|string is search(inventory_hostname)
|
||||
tags:
|
||||
- wakeup_lan
|
||||
|
||||
- name: (root_files_scripts.yml) Check file '/etc/motd.ORIG' exists
|
||||
stat:
|
||||
path: /etc/motd.ORIG
|
||||
register: etc_motd_ORIG
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- etc_motd
|
||||
|
||||
- name: (basic.yml) Backup installation version of file '/etc/motd'
|
||||
command: cp -a /etc/motd /etc/motd.ORIG
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- etc_motd_ORIG.stat.exists == False
|
||||
tags:
|
||||
- etc_motd
|
||||
|
||||
|
||||
- name: (root_files_scripts.yml) Write new '/etc/motd' file..
|
||||
shell: >
|
||||
figlet '{{ nis_server_name.split(".")[0] }}' > /etc/motd
|
||||
when:
|
||||
- "groups['file_server']|string is search(inventory_hostname)"
|
||||
- etc_motd_ORIG.stat.exists == False
|
||||
tags:
|
||||
- etc_motd
|
||||
|
||||
185
roles/common/tasks/samba-install.yml
Normal file
185
roles/common/tasks/samba-install.yml
Normal file
@ -0,0 +1,185 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# Samba Server
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Ensure samba packages server (buster) are installed.
|
||||
package:
|
||||
pkg: '{{ apt_install_server_samba }}'
|
||||
state: present
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
- name: (samba-install.yml) Ensure samba share directories exists
|
||||
file:
|
||||
path: "{{ item.path }}"
|
||||
owner: "root"
|
||||
group: "{{ item.group_write_list }}"
|
||||
mode: '2770'
|
||||
state: directory
|
||||
with_items: "{{ samba_shares }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- samba-shares
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/samba/smb.conf
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Check if file '/etc/samba/smb.conf.ORIG exists'
|
||||
stat:
|
||||
path: /etc/samba/smb.conf.ORIG
|
||||
register: smb_conf_exists
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
- name: (samba-install.yml) Backup existing file /etc/samba/smb.conf
|
||||
command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- smb_conf_exists.stat.exists == False
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: (samba-install.yml) /etc/samba/smb.conf
|
||||
template:
|
||||
dest: /etc/samba/smb.conf
|
||||
src: etc/samba/smb.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
notify:
|
||||
- Restart smbd
|
||||
- Restart nmbd
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: (samba-install.yml) Ensure file /etc/samba/users.map exists
|
||||
copy:
|
||||
src: "{{ role_path + '/files/etc/samba/users.map' }}"
|
||||
dest: /etc/samba/users.map
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
notify:
|
||||
- Restart smbd
|
||||
- Restart nmbd
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
# ---
|
||||
# Cronjob for cleaning up samba trash dirs
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists
|
||||
stat:
|
||||
path: /root/bin/samba/clean_samba_trash.sh
|
||||
register: clean_samba_trash_exists
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
|
||||
- name: (samba-install.yml) Adjust configuration for script 'clean_samba_trash.sh'
|
||||
template:
|
||||
dest: /root/bin/samba/conf/clean_samba_trash.conf
|
||||
src: root/bin/samba/conf/clean_samba_trash.conf.j2
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- clean_samba_trash_exists.stat.exists|bool
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: Check if cleaning up trash dirs is configured
|
||||
lineinfile:
|
||||
path: /root/bin/samba/conf/clean_samba_trash.conf
|
||||
regexp: "^trash_dirs=*"
|
||||
state: absent
|
||||
check_mode: yes
|
||||
changed_when: false
|
||||
register: clean_samba_trash_dirs
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
|
||||
|
||||
- name: Creates a cron job for cleaning up samba trash dirs
|
||||
cron:
|
||||
name: '{{ samba_cronjob_trash_dirs.name }}'
|
||||
minute: '{{ samba_cronjob_trash_dirs.minute }}'
|
||||
hour: "{{ samba_cronjob_trash_dirs.hour | default('*') }}"
|
||||
day: "{{ samba_cronjob_trash_dirs.hour.day | default('*') }}"
|
||||
month: "{{ samba_cronjob_trash_dirs.hour.month| default('*') }}"
|
||||
weekday: "{{ samba_cronjob_trash_dirs.hour.weekday| default('*') }}"
|
||||
user: "{{ samba_cronjob_trash_dirs.user | default('root') }}"
|
||||
job: "{{ samba_cronjob_trash_dirs.job }}"
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- clean_samba_trash_dirs.found
|
||||
|
||||
|
||||
# ---
|
||||
# Cronjob for setting permissions on samba shares
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists
|
||||
stat:
|
||||
path: /root/bin/samba/set_permissions_samba_shares.sh
|
||||
register: set_permissions_on_samba_shares_exists
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
|
||||
- name: (samba-install.yml) Adjust configuration for script 'set_permissions_samba_shares.sh'
|
||||
template:
|
||||
dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
|
||||
src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- set_permissions_on_samba_shares_exists.stat.exists|bool
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: Creates a cron job for cleaning up samba trash dirs
|
||||
cron:
|
||||
name: '{{ samba_cronjob_permissions.name }}'
|
||||
minute: '{{ samba_cronjob_permissions.minute }}'
|
||||
hour: "{{ samba_cronjob_permissions.hour | default('*') }}"
|
||||
day: "{{ samba_cronjob_permissions.day | default('*') }}"
|
||||
month: "{{ samba_cronjob_permissions.month| default('*') }}"
|
||||
weekday: "{{ samba_cronjob_permissions.weekday| default('*') }}"
|
||||
user: "{{ samba_cronjob_permissions.user | default('root') }}"
|
||||
job: "{{ samba_cronjob_permissions.job }}"
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- clean_samba_trash_dirs.found
|
||||
|
||||
|
||||
# ---
|
||||
# Samba clients
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Ensure samba packages clients are installed.
|
||||
package:
|
||||
pkg: "{{ apt_install_client_samba }}"
|
||||
state: present
|
||||
when:
|
||||
- "groups['nis_client']|string is search(inventory_hostname)"
|
||||
- ansible_distribution == "Ubuntu"
|
||||
tags:
|
||||
- samba-client
|
||||
|
||||
57
roles/common/tasks/samba-remove-user.yml
Normal file
57
roles/common/tasks/samba-remove-user.yml
Normal file
@ -0,0 +1,57 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Check if samba user exists for removable system user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_remove_system_users_present
|
||||
changed_when: "samba_remove_system_users_present.rc == 0"
|
||||
failed_when: "samba_remove_system_users_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ remove_system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Remove (old) system users from samba
|
||||
shell: >
|
||||
smbpasswd -s -x {{ item.item.name }}
|
||||
with_items:
|
||||
- "{{ samba_remove_system_users_present.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.changed
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Check if samba user exists for removable nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_remove_nis_users_present
|
||||
changed_when: "samba_remove_nis_users_present.rc == 0"
|
||||
failed_when: "samba_remove_nis_users_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ remove_nis_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (samba-remove-user.yml) Remove (old) nis users from samba
|
||||
shell: >
|
||||
smbpasswd -s -x {{ item.item.name }}
|
||||
with_items:
|
||||
- "{{ samba_remove_nis_users_present.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.changed
|
||||
tags:
|
||||
- samba-user
|
||||
30
roles/common/tasks/samba-user.yml
Normal file
30
roles/common/tasks/samba-user.yml
Normal file
@ -0,0 +1,30 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (samba-user.yml) Check if samba user exists for nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_nis_user_present
|
||||
changed_when: "samba_nis_user_present.rc == 1"
|
||||
failed_when: "samba_nis_user_present.rc > 1"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
- name: (samba-user.yml) Add nis user to samba (with nis users password)
|
||||
shell: >
|
||||
(echo '{{ item.item.password }}'; echo '{{ item.item.password }}')
|
||||
| smbpasswd -s -a {{ item.item.name }}
|
||||
loop: "{{ samba_nis_user_present.results }}"
|
||||
when: item.changed
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
@ -1,60 +0,0 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (samba_user.yml) Check if samba user exists for removable nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_deleted_user_present
|
||||
changed_when: "samba_deleted_user_present.rc == 0"
|
||||
failed_when: "samba_deleted_user_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (samba_user.yml) Remove (old) users from samba
|
||||
shell: "smbpasswd -s -x {{ item.name }}"
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: samba_deleted_user_present is changed
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (samba_user.yml) Check if samba user exists for nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_nis_user_present
|
||||
changed_when: "samba_nis_user_present.rc > 0"
|
||||
failed_when: "samba_nis_user_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
- name: (samba_user.yml) Add nis user to samba (with nis users password)
|
||||
shell: "echo -e '{{ item.password }}\n{{ item.password }}\n' | smbpasswd -s -a {{ item.name }}"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
- samba_nis_user_present is changed
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
29
roles/common/tasks/sshd.yml
Normal file
29
roles/common/tasks/sshd.yml
Normal file
@ -0,0 +1,29 @@
|
||||
---
|
||||
|
||||
- name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
|
||||
stat:
|
||||
path: /etc/ssh/sshd_config.ORIG
|
||||
register: etc_sshd_sshd_config_ORIG
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
- name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
|
||||
command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
|
||||
when: etc_sshd_sshd_config_ORIG.stat.exists == False
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
|
||||
- name: (sshd.yml) Create new sshd_config from template sshd_config.j2
|
||||
template:
|
||||
src: etc/ssh/sshd_config.j2
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
validate: 'sshd -f %s -T'
|
||||
#backup: yes
|
||||
notify: "Restart ssh"
|
||||
tags:
|
||||
- sshd-config
|
||||
|
||||
32
roles/common/tasks/sudoers-pc.yml
Normal file
32
roles/common/tasks/sudoers-pc.yml
Normal file
@ -0,0 +1,32 @@
|
||||
---
|
||||
|
||||
- name: (sudoers-pc.yml) update specific sudoers configuration files (/etc/sudoers.d/)
|
||||
template:
|
||||
src: etc/sudoers.d/50-user.pc.j2
|
||||
dest: /etc/sudoers.d/50-user
|
||||
validate: visudo -cf %s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
tags:
|
||||
- sudoers-file-configuration
|
||||
|
||||
- name: (sudoers-pc.yml) update global sudoers configuration file
|
||||
template:
|
||||
src: etc/sudoers.pc.j2
|
||||
dest: /etc/sudoers
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- sudoers-global-configuration
|
||||
|
||||
- name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
|
||||
user:
|
||||
name: "{{ item }}"
|
||||
groups: sudo
|
||||
append: yes
|
||||
with_items: "{{ sudo_pc_users }}"
|
||||
tags:
|
||||
- sudo-users
|
||||
57
roles/common/tasks/sudoers-server.yml
Normal file
57
roles/common/tasks/sudoers-server.yml
Normal file
@ -0,0 +1,57 @@
|
||||
---
|
||||
|
||||
#- name: (sudoers-server.yml) include variables
|
||||
# include_vars: "{{ item }}"
|
||||
# with_first_found:
|
||||
# - "sudoers-{{ inventory_hostname }}.yml"
|
||||
# - "sudoers-{{ ansible_distribution_release }}.yml"
|
||||
# - "sudoers-{{ ansible_distribution | lower }}.yml"
|
||||
# - "sudoers-default.yml"
|
||||
# tags:
|
||||
# - sudoers-remove
|
||||
# - sudoers-file-configuration
|
||||
# - sudoers-global-configuration
|
||||
|
||||
- name: (sudoers-server.yml) Remove user entries in file /etc/sudoers
|
||||
lineinfile:
|
||||
dest: /etc/sudoers
|
||||
state: absent
|
||||
regexp: '^{{ item }}'
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
validate: visudo -cf %s
|
||||
with_items: '{{ sudoers_server_remove_user }}'
|
||||
tags:
|
||||
- sudoers-remove
|
||||
|
||||
- name: (sudoers-server.yml) update specific sudoers configuration files (/etc/sudoers.d/)
|
||||
template:
|
||||
src: etc/sudoers.d/50-user.server.j2
|
||||
dest: /etc/sudoers.d/50-user
|
||||
#validate: visudo -cf %s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
tags:
|
||||
- sudoers-file-configuration
|
||||
|
||||
- name: (sudoers-server.yml) update global sudoers configuration file
|
||||
template:
|
||||
src: etc/sudoers.server.j2
|
||||
dest: /etc/sudoers
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
#validate: visudo -cf %s
|
||||
tags:
|
||||
- sudoers-global-configuration
|
||||
|
||||
- name: (sudoers-server.yml) Ensure all sudo_users are in sudo group
|
||||
user:
|
||||
name: "{{ item }}"
|
||||
groups: sudo
|
||||
append: yes
|
||||
with_items: "{{ sudo_server_users }}"
|
||||
tags:
|
||||
- sudo-users
|
||||
@ -1,32 +0,0 @@
|
||||
---
|
||||
|
||||
- name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/)
|
||||
template:
|
||||
src: etc/sudoers.d/50-user.j2
|
||||
dest: /etc/sudoers.d/50-user
|
||||
validate: visudo -cf %s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
tags:
|
||||
- sudoers-file-configuration
|
||||
|
||||
- name: (sudoers.yml) update global sudoers configuration file
|
||||
template:
|
||||
src: etc/sudoers.j2
|
||||
dest: /etc/sudoers
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- sudoers-global-configuration
|
||||
|
||||
#- name: (sudoers.yml) Ensure all sudo_users are in sudo group
|
||||
# user:
|
||||
# name: "{{ item }}"
|
||||
# groups: sudo
|
||||
# append: yes
|
||||
# with_items: "{{ sudo_users }}"
|
||||
# tags:
|
||||
# - sudo-users
|
||||
278
roles/common/tasks/system-user-systemfiles.yml
Normal file
278
roles/common/tasks/system-user-systemfiles.yml
Normal file
@ -0,0 +1,278 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# Check if local template directories exists
|
||||
# ---
|
||||
|
||||
# system_user
|
||||
- name: (system-user-systemfiles.yml) Check if local template directory exists for default users
|
||||
local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }}
|
||||
with_items: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: local_template_dir_system_users
|
||||
|
||||
# root
|
||||
- name: (system-user-systemfiles.yml) Check if local template directory exists for root
|
||||
local_action: stat path={{ inventory_dir }}/files/homedirs/root
|
||||
register: local_template_dir_root
|
||||
|
||||
|
||||
# --
|
||||
# Copy .profile
|
||||
# ---
|
||||
|
||||
- name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
|
||||
stat:
|
||||
path: "~{{ item.name }}/.profile.ORIG"
|
||||
register: profile_user_orig_exists
|
||||
loop: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
|
||||
loop: "{{ profile_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == False
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .profile if it exists
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile') }}"
|
||||
dest: "~{{ item.item.name }}/.profile"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_system_users.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_profile')
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy default .profile if it exists
|
||||
template:
|
||||
src: files/homedirs/DEFAULT/_profile
|
||||
dest: "~{{ item.item.name }}/.profile"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_system_users.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == false
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/DEFAULT/_profile')
|
||||
tags:
|
||||
- profile
|
||||
|
||||
# -- root user
|
||||
- name: (system-user-systemfiles.yml) Check if file '/root/.profile.ORIG' exists
|
||||
stat:
|
||||
path: /root/.profile.ORIG
|
||||
register: profile_root_orig_exists
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (system-user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a /root/.profile /root/.profile.ORIG
|
||||
when: profile_root_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .profile for user root
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/root/_profile') }}"
|
||||
dest: "/root/.profile"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- local_template_dir_root.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/root/_profile')
|
||||
tags:
|
||||
- profile
|
||||
|
||||
# --
|
||||
# Copy .bashrc
|
||||
# ---
|
||||
|
||||
- name: (system-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
|
||||
stat:
|
||||
path: "~{{ item.name }}/.bashrc.ORIG"
|
||||
register: bashrc_user_orig_exists
|
||||
loop: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) Backup existing users .bashrc file
|
||||
command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
|
||||
loop: "{{ bashrc_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when: item.stat.exists == False
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .bashrc if it exists
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc') }}"
|
||||
dest: "~{{ item.item.name }}/.bashrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_system_users.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_bashrc')
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy default .bashrc if it exists
|
||||
copy:
|
||||
src: files/homedirs/DEFAULT/_bashrc
|
||||
dest: "~{{ item.item.name }}/.bashrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_system_users.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == false
|
||||
tags:
|
||||
- bashrc
|
||||
|
||||
# -- root user
|
||||
- name: (system-user-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists
|
||||
stat:
|
||||
path: /root/.bashrc.ORIG
|
||||
register: bashrc_root_orig_exists
|
||||
tags:
|
||||
- bash
|
||||
|
||||
- name: (system-user-systemfiles.yml) Backup /root/.bashrc file
|
||||
command: cp /root/.bashrc /root/.bashrc.ORIG
|
||||
when: bashrc_root_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- bash
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .bashrc for user root
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/root/_bashrc') }}"
|
||||
dest: "/root/.bashrc"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- local_template_dir_root.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/root/_bashrc')
|
||||
tags:
|
||||
- bash
|
||||
|
||||
# --
|
||||
# Copy .vimrc
|
||||
# ---
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .vimrc if it exists
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc') }}"
|
||||
dest: "~{{ item.item.name }}/.vimrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_system_users.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/' + item.item.name + '/_vimrc')
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) Check if .vim directory exists for default users
|
||||
local_action: stat path={{ inventory_dir }}/files/homedirs/{{ item.name }}/.vim
|
||||
with_items: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
register: local_template_dir_dotvim_default_user
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .vim directory if it exists
|
||||
copy:
|
||||
src: "{{ inventory_dir + '/files/homedirs/' + item.item.name + '/.vim' }}"
|
||||
dest: "~{{ item.item.name }}"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
with_items: "{{ local_template_dir_dotvim_default_user.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy default .vimrc if it exists
|
||||
copy:
|
||||
src: files/homedirs/DEFAULT/_vimrc
|
||||
dest: "~{{ item.item.name }}/.vimrc"
|
||||
owner: "{{ item.item.name }}"
|
||||
group: "{{ item.item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ local_template_dir_system_users.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.stat.exists == false
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .vimrc for user root
|
||||
copy:
|
||||
src: "{{ lookup('fileglob', inventory_dir + '/files/homedirs/root/_vimrc') }}"
|
||||
dest: "/root/.vimrc"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- local_template_dir_root.stat.exists
|
||||
- lookup('fileglob', inventory_dir + '/files/homedirs/root/_vimrc')
|
||||
tags:
|
||||
- vimrc
|
||||
|
||||
- name: (system-user-systemfiles.yml) Check if local template directory .vim exists for user root
|
||||
local_action: stat path={{ inventory_dir }}/files/homedirs/root/.vim
|
||||
register: local_template_dir_vim_root
|
||||
with_items: 'root'
|
||||
loop_control:
|
||||
label: 'root'
|
||||
|
||||
- name: (system-user-systemfiles.yml) copy .vim directory for user root if it exists
|
||||
copy:
|
||||
src: "{{ inventory_dir + '/files/homedirs/root/.vim' }}"
|
||||
dest: "/root"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: 0644
|
||||
with_items: "{{ local_template_dir_vim_root.results }}"
|
||||
loop_control:
|
||||
label: 'root'
|
||||
when:
|
||||
- item.stat.exists
|
||||
tags:
|
||||
- vim
|
||||
|
||||
|
||||
64
roles/common/tasks/system-user.yml
Normal file
64
roles/common/tasks/system-user.yml
Normal file
@ -0,0 +1,64 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (user.yml) Remove (old) users from system
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ remove_system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
- name: (user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
path: '{{ base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ remove_system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (user.yml) Ensure system groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
loop: "{{ system_groups }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: item.group_id is defined
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
|
||||
- name: (system-user.yml) Get database of nis (system) users
|
||||
getent:
|
||||
database: passwd
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
- name: (system-user.yml) Add (system) users if not yet exists..
|
||||
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
loop: "{{ system_users }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.name not in getent_passwd
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- system-user
|
||||
|
||||
@ -1,39 +0,0 @@
|
||||
---
|
||||
|
||||
- name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
|
||||
stat:
|
||||
path: "~{{ item.name }}/.profile.ORIG"
|
||||
register: profile_user_orig_exists
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
|
||||
loop: "{{ profile_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
- item.stat.exists == False
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (user-systemfiles.yml) Create new users .profile file
|
||||
template:
|
||||
src: user_homedirs/dot.profile.j2
|
||||
dest: "~{{ item.name }}/.profile"
|
||||
owner: "{{ item.name }}"
|
||||
group: "{{ item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- profile
|
||||
Reference in New Issue
Block a user