Reduce output from ansible playbooks. Some minor changes.

This commit is contained in:
2019-07-03 04:14:14 +02:00
parent 21fcd86115
commit 505cdbf120
25 changed files with 3158 additions and 615 deletions

View File

@ -10,6 +10,10 @@ apt_ansible_dependencies:
- python3
- python3-apt
- lsb-release
- apt-transport-https
- apt-transport-tor
- dbus
- sudo
- vim
@ -66,8 +70,30 @@ sshd_password_authentication: !!str "no"
sshd_print_motd: !!str "no"
# sshd_kexalgorithms
#
# Example:
# sshd_kexalgorithms:
# - curve25519-sha256@libssh.org
# - diffie-hellman-group-exchange-sha256
# - diffie-hellman-group14-sha1
#
sshd_kexalgorithms: {}
# sshd_kexalgorithms
#
# Example:
# sshd_ciphers:
# - chacha20-poly1305@openssh.com
# - aes256-gcm@openssh.com
# - aes256-ctr
sshd_ciphers: {}
sshd_use_dns: !!str "no"
sshd_allowed_users: {}
# ---
# vars used by apt.yml
@ -96,224 +122,230 @@ apt_upgrade_dpkg_options:
- force-confold
apt_initial_install_stretch:
- openssh-server
- rssh
- vim
- vim-common
- vim-doc
- mc
- screen
- tmux
- bc
- figlet
- rcconf
- sudo
- rsync
- dselect
- iputils-ping
- apt-utils
- aptitude
- apt-transport-https
- zip
- unzip
- bzip2
- arj
- locate
- curl
- gawk
- mawk
- lynx
- links
- w3m
- exuberant-ctags
- mime-support
- file
- coreutils
- moreutils
- less
- realpath
- sipcalc
- psmisc
- dnsutils
- rblcheck
- whois
- gettext
- gettext-base
- gettext-doc
- debian-keyring
- patch
- patchutils
- recode
- recode-doc
- librecode0
- librecode-dev
- sharutils
- perl
- perl-modules-5.24
- perl-doc
- libperl-dev
- libterm-readline-gnu-perl
- libterm-readline-perl-perl
- libterm-readkey-perl
- libmail-imapclient-perl
- libtime-duration-perl
- libtimedate-perl
- libwww-perl
- libpcre3
- libreadline5
- re2c
- util-linux
- parted
- lshw
- gdisk
- smartmontools
- tcpdump
- telnet
- unhide
- lsof
- hdparm
- groff
- iproute2
- bridge-utils
- vlan
- ethtool
- wipe
- iperf
- mtr
- iptraf
- wget
- logrotate
- rsyslog
- haveged
- rdate
- ntpdate
- wipe
- man-db
- groff
- iptables
- shellcheck
- ssl-cert
- ssl-cert-check
- git
- ftp
- htop
- net-tools
- lsb-release
- attr
- acl
- quota
- quotatool
- needrestart
- apt-transport-https
- apt-transport-tor
- dbus
- openssh-server
- rssh
- vim
- vim-common
- vim-doc
- mc
- screen
- tmux
- bc
- figlet
- rcconf
- sudo
- rsync
- dselect
- iputils-ping
- apt-utils
- aptitude
- apt-transport-https
- zip
- unzip
- bzip2
- arj
- locate
- curl
- gawk
- mawk
- lynx
- links
- w3m
- exuberant-ctags
- mime-support
- file
- coreutils
- moreutils
- less
- realpath
- sipcalc
- psmisc
- dnsutils
- rblcheck
- whois
- gettext
- gettext-base
- gettext-doc
- debian-keyring
- patch
- patchutils
- recode
- recode-doc
- librecode0
- librecode-dev
- sharutils
- perl
- perl-modules-5.24
- perl-doc
- libperl-dev
- libterm-readline-gnu-perl
- libterm-readline-perl-perl
- libterm-readkey-perl
- libmail-imapclient-perl
- libtime-duration-perl
- libtimedate-perl
- libwww-perl
- libpcre3
- libreadline5
- re2c
- util-linux
- parted
- lshw
- gdisk
- smartmontools
- tcpdump
- telnet
- unhide
- lsof
- hdparm
- groff
- iproute2
- bridge-utils
- vlan
- ethtool
- wipe
- iperf
- mtr
- iptraf
- wget
- logrotate
- rsyslog
- haveged
- rdate
- ntpdate
- wipe
- man-db
- groff
- iptables
- shellcheck
- ssl-cert
- ssl-cert-check
- git
- ftp
- htop
- net-tools
- lsb-release
- attr
- acl
- quota
- quotatool
- needrestart
apt_initial_install_buster:
- openssh-server
- rush
- vim
- vim-common
- vim-doc
- mc
- screen
- tmux
- bc
- figlet
- rcconf
- sudo
- rsync
- dselect
- iputils-ping
- apt-utils
- aptitude
- apt-transport-https
- zip
- unzip
- bzip2
- arj
- locate
- curl
- gawk
- mawk
- lynx
- links
- w3m
- ctags
- mime-support
- file
- coreutils
- moreutils
- less
- sipcalc
- psmisc
- dnsutils
- rblcheck
- whois
- gettext
- gettext-base
- gettext-doc
- debian-keyring
- patch
- patchutils
- recode
- recode-doc
- librecode0
- librecode-dev
- sharutils
- perl
- perl-modules-5.28
- perl-doc
- libperl-dev
- libterm-readline-gnu-perl
- libterm-readline-perl-perl
- libterm-readkey-perl
- libmail-imapclient-perl
- libtime-duration-perl
- libtimedate-perl
- libwww-perl
- libpcre3
- libio-compress-perl
- libreadline5
- re2c
- util-linux
- parted
- lshw
- gdisk
- smartmontools
- tcpdump
- telnet
- unhide
- lsof
- hdparm
- groff
- iproute2
- bridge-utils
- vlan
- ethtool
- wipe
- iperf
- mtr
- iptraf
- wget
- logrotate
- rsyslog
- haveged
- rdate
- ntpdate
- wipe
- man
- groff
- iptables
- shellcheck
- ssl-cert
- ssl-cert-check
- git
- ftp
- htop
- net-tools
- lsb-release
- attr
- acl
- quota
- quotatool
- needrestart
- apt-transport-https
- apt-transport-tor
- dbus
- openssh-server
- rush
- vim
- vim-common
- vim-doc
- mc
- screen
- tmux
- bc
- figlet
- rcconf
- sudo
- rsync
- dselect
- iputils-ping
- apt-utils
- aptitude
- apt-transport-https
- zip
- unzip
- bzip2
- arj
- locate
- curl
- gawk
- mawk
- lynx
- links
- w3m
- ctags
- mime-support
- file
- coreutils
- moreutils
- less
- sipcalc
- psmisc
- dnsutils
- rblcheck
- whois
- gettext
- gettext-base
- gettext-doc
- debian-keyring
- patch
- patchutils
- recode
- recode-doc
- librecode0
- librecode-dev
- sharutils
- perl
- perl-modules-5.28
- perl-doc
- libperl-dev
- libterm-readline-gnu-perl
- libterm-readline-perl-perl
- libterm-readkey-perl
- libmail-imapclient-perl
- libtime-duration-perl
- libtimedate-perl
- libwww-perl
- libpcre3
- libio-compress-perl
- libreadline5
- re2c
- util-linux
- parted
- lshw
- gdisk
- smartmontools
- tcpdump
- telnet
- unhide
- lsof
- hdparm
- groff
- iproute2
- bridge-utils
- vlan
- ethtool
- wipe
- iperf
- mtr
- iptraf
- wget
- logrotate
- rsyslog
- haveged
- rdate
- ntpdate
- wipe
- man
- groff
- iptables
- shellcheck
- ssl-cert
- ssl-cert-check
- git
- ftp
- htop
- net-tools
- lsb-release
- attr
- acl
- quota
- quotatool
- needrestart
apt_install_compiler_pkgs: false
apt_compiler_pkgs:
@ -436,6 +468,7 @@ apt_lxc_host_pkgs:
- lxc
- btrfs-tools
- lua5.3
- ntp
apt_install: {}
apt_install_state: latest
@ -486,8 +519,87 @@ webadmin_user: {}
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
# /etc/sudoers
#
# see: roles/common/tasks/vars
sudoers_defaults:
- env_reset
- mail_badpass
- 'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"'
sudoers_host_aliases: []
sudoers_user_aliases: []
sudoers_cmnd_aliases: []
sudoers_runas_aliases: []
sudoers_user_privileges:
- name: root
entry: 'ALL=(ALL:ALL) ALL'
sudoers_group_privileges: []
sudoers_remove_user:
- back
- www-data
# /etc/sudoers.d/50-user
#
sudoers_file_defaults: []
sudoers_file_host_aliases: []
sudoers_file_user_aliases: []
sudoers_file_cmnd_aliases: []
sudoers_file_runas_aliases: []
sudoers_file_user_back_privileges:
- 'ALL=(root) NOPASSWD: /usr/bin/rsync'
- 'ALL=(root) NOPASSWD: /usr/bin/find'
- 'ALL=(root) NOPASSWD: /usr/bin/realpath'
sudoers_file_user_back_postgres_privileges:
- 'ALL=(postgres) NOPASSWD: /usr/bin/psql'
- 'ALL=(postgres) NOPASSWD: /usr/bin/pg_dump'
- 'ALL=(postgres) NOPASSWD: /usr/bin/pg_dumpall'
sudoers_file_user_back_disk_privileges:
- 'ALL=(root) NOPASSWD: /usr/bin/which'
- 'ALL=(root) NOPASSWD: /sbin/hdparm -I /dev/*'
- 'ALL=(root) NOPASSWD: /sbin/fdisk'
- 'ALL=(root) NOPASSWD: /sbin/sgdisk'
- 'ALL=(root) NOPASSWD: /sbin/sfdisk -d /dev/*'
- 'ALL=(root) NOPASSWD: /bin/dd if=/dev/*'
- 'ALL=(root) NOPASSWD: /sbin/parted'
- 'ALL=(root) NOPASSWD: /sbin/gdisk'
sudoers_file_user_webadmin_disk_privileges:
- 'ALL=(root) NOPASSWD: /usr/bin/mailq'
- 'ALL=(root) NOPASSWD: /usr/bin/tail'
- 'ALL=(root) NOPASSWD: /usr/bin/view'
sudoers_file_dns_server_privileges:
- name: manage-bind
entry: 'ALL=(root) NOPASSWD: /usr/local/bin/bind_*'
- name: manage-bind
entry: 'ALL=(root) NOPASSWD: /root/bin/bind/bind_*'
- name: chris
entry: 'ALL=(root) NOPASSWD: /root/bin/bind/*'
sudoers_file_postfixadmin_privileges:
- name: www-data
entry: 'ALL=(vmail)NOPASSWD: /usr/local/bin/postfixadmin-mailbox-postdeletion.sh'
- name: www-data
entry: 'ALL=(vmail)NOPASSWD: /usr/local/bin/postfixadmin-domain-postdeletion.sh'
sudoers_file_user_privileges: []
sudoers_file_group_privileges: []
# ---
@ -500,8 +612,238 @@ acl_caching_nameserver: {}
# ---
# vars used by roles/common/tasks/git.yml
# ---
# ---
# Firewall repository
# ---
git_firewall_repository: []
# ---
# all servers
# ---
git_default_repositories:
# script repositories (destination /root/bin/)
- name: admin-stuff
repo: https://git.oopen.de/script/admin-stuff
dest: /root/bin/admin-stuff
- name: postfix
repo: https://git.oopen.de/script/postfix
dest: /root/bin/postfix
# install repositories (destination: /usr/local/src/)
- name: mailsystem
repo: https://git.oopen.de/install/mailsystem
dest: /usr/local/src/mailsystem
# ---
# group [lxc_host]
# ---
git_lxc_host_repositories:
# Monitoring
- name: monitoring
repo: https://git.oopen.de/script/monitoring
dest: /root/bin/monitoring
# LXC
- name: LXC
repo: https://git.oopen.de/script/LXC
dest: /root/bin/LXC
# firewall
- name: ipt-server
repo: https://git.oopen.de/firewall/ipt-server
dest: /usr/local/src/ipt-server
# ---
# group [lxc_guest]
# ---
git_lxc_guest_repositories:
# dehydrated-cron
- name: dehydrated-cron
repo: https://git.codecoop.org/so36intern/dehydrated-cron.git
dest: /usr/local/src/dehydrated-cron
# firewall
- name: ipt-server
repo: https://git.oopen.de/firewall/ipt-server
dest: /usr/local/src/ipt-server
# ---
# group [gateway_server]
# ---
git_gateway_repositories:
# firewall
- name: ipt-gateway
repo: https://git.oopen.de/firewall/ipt-gateway
dest: /usr/local/src/ipt-gateway
# ---
# group [apache2_webserver]
# ---
git_apache2_repositories:
# script repositories (destination /root/bin/)
- name: apache2
repo: https://git.oopen.de/script/apache2
dest: /root/bin/apache2
# install repositories (destination: /usr/local/src/)
- name: apache2
repo: https://git.oopen.de/install/apache2
dest: /usr/local/src/apache2
- name: php
repo: https://git.oopen.de/install/php
dest: /usr/local/src/php
# ---
# group [nginx_webserver]
# ---
git_nginx_repositories: []
# ---
# group [mysql_server]
# ---
git_mysql_repositories:
# script repositories (destination /root/bin/)
- name: mysql
repo: https://git.oopen.de/script/mysql
dest: /root/bin/mysql
# install repositories (destination: /usr/local/src/)
- name: mysql
repo: https://git.oopen.de/install/mysql
dest: /usr/local/src/mysql
# ---
# group [postgresql_server]
# ---
git_postgresql_repositories:
# script repositories (destination /root/bin/)
- name: postgres
repo: https://git.oopen.de/script/postgres
dest: /root/bin/postgres
# ---
# group [nextcloud_server]
# ---
git_nextcloud_repositories:
# script repositories (destination /root/bin/)
- name: nextcloud
repo: https://git.oopen.de/script/nextcloud
dest: /root/bin/nextcloud
# install repositories (destination: /usr/local/src/)
- name: nextcloud
repo: https://git.oopen.de/install/nextcloud
dest: /usr/local/src/nextcloud
# ---
# group [dns_server]
# ---
git_dns_repositories:
# script repositories (destination /root/bin/)
- name: bind
repo: https://git.oopen.de/script/bind
dest: /root/bin/bind
# ---
# group [backup_server]
# ---
git_backup_repositories:
# script repositories (destination /root/bin/)
- name: backup-rcopy
repo: https://git.oopen.de/backup/backup-rcopy
dest: /root/crontab/backup-rcopy
# ---
# group [samba_server]
# ---
git_samba_repositories:
# script repositories (destination /root/bin/)
- name: samba
repo: https://git.oopen.de/script/samba
dest: /root/bin/samba
# ---
# group [mail_server]
# ---
git_mailserver_repositories:
# script repositories (destination /root/bin/)
- name: apache2
repo: https://git.oopen.de/script/apache2
dest: /root/bin/apache2
- name: postfix
repo: https://git.oopen.de/script/postfix
dest: /root/bin/postfix
- name: monitoring
repo: https://git.oopen.de/script/monitoring
dest: /root/bin/monitoring
# install repositories (destination: /usr/local/src/)
- name: apache2
repo: https://git.oopen.de/install/apache2
dest: /usr/local/src/apache2
- name: php
repo: https://git.oopen.de/install/php
dest: /usr/local/src/php
- name: mailsystem
repo: https://git.oopen.de/install/mailsystem
dest: /usr/local/src/mailsystem
- name: fail2ban
repo: https://git.oopen.de/install/fail2ban
dest: /usr/local/src/fail2ban
# let's encrypt
- name: dehydrated-cron
repo: https://git.codecoop.org/so36intern/dehydrated-cron.git
dest: /usr/local/src/dehydrated-cron
# ---
# group [sympa_list_servers]
# ---
git_sympa_repositories:
# install repositories (destination: /usr/local/src/)
- name: sympa
repo: https://git.oopen.de/install/sympa
dest: /usr/local/src/sympa
# ---
# Use this for host specific repositories defined in files git-<hostname>.yaml
#
# see: roles/common/tasks/vars
# Leave empty here
# ---
git_other_repositories: []
# ==============================