From 70c0c3bb7c57cb2ba12be1a430d09f8077e1f1b0 Mon Sep 17 00:00:00 2001 From: Christoph Date: Fri, 14 Feb 2025 11:36:24 +0100 Subject: [PATCH] update.. --- host_vars/cl-irights.oopen.de.yml | 84 +++++++ host_vars/file-dissens.dissens.netz.yml | 5 + host_vars/ga-st-mm.ga.netz.yml | 215 ++++++++++++++++++ host_vars/mm-irights-neu.oopen.de.yml | 54 +++++ host_vars/mm-irights.oopen.de.yml | 54 +++++ hosts | 20 +- .../system/apache2.service.d/limits.conf | 7 + .../system/mariadb.service.d/limits.conf | 7 + roles/common/handlers/main.yml | 13 ++ roles/common/tasks/apache2.yml | 37 +++ roles/common/tasks/main.yml | 10 + roles/common/tasks/mysql.yml | 37 +++ 12 files changed, 542 insertions(+), 1 deletion(-) create mode 100644 host_vars/ga-st-mm.ga.netz.yml create mode 100644 roles/common/files/etc/systemd/system/apache2.service.d/limits.conf create mode 100644 roles/common/files/etc/systemd/system/mariadb.service.d/limits.conf create mode 100644 roles/common/tasks/apache2.yml create mode 100644 roles/common/tasks/mysql.yml diff --git a/host_vars/cl-irights.oopen.de.yml b/host_vars/cl-irights.oopen.de.yml index 21ecc88..a4da310 100644 --- a/host_vars/cl-irights.oopen.de.yml +++ b/host_vars/cl-irights.oopen.de.yml @@ -99,6 +99,90 @@ resolved_fallback_nameserver: - 194.150.168.168 +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if webservices sre running. Restart if necessary" + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_webservice_load.sh + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Check Postfix E-Mail LOG file for 'fatal' errors.." + minute: '*/5' + hour: '*' + job: /root/bin/postfix/check-postfix-fatal-errors.sh + + - name: "Optimize mysql tables" + minute: '53' + hour: '04' + job: /root/bin/mysql/optimize_mysql_tables.sh + + - name: "Flush query cache for mysql tables" + minute: '27' + hour: '04' + job: /root/bin/mysql/flush_query_cache.sh + + - name: "Flush Host cache" + minute: '17' + hour: '05' + job: /root/bin/mysql/flush_host_cache.sh + + - name: "Run occ file:scan for each cloud account" + minute: '02' + hour: '23' + job: /root/bin/nextcloud/occ_maintenance.sh -s cloud-irights.oopen.de + + - name: "Background job for nextcloud instance 'cloud-irights.oopen.de" + minute: '*/15' + hour: '*' + job: sudo -u "www-data" /usr/local/php/bin/php -f /var/www/cloud-irights.oopen.de/htdocs/cron.php + + - name: "Check if certificates for coolwsd service are up to date" + minute: '17' + hour: '05' + job: /root/bin/nextcloud/check_cert_coolwsd.sh + + - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" + minute: '23' + hour: '05' + job: /var/lib/dehydrated/cron/dehydrated_cron.sh + + - name: "Check whether all certificates are included in the VHOST configurations" + minute: '33' + hour: '05' + job: /var/lib/dehydrated/tools/update_ssl_directives.sh + + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/host_vars/file-dissens.dissens.netz.yml b/host_vars/file-dissens.dissens.netz.yml index 94661a9..f412779 100644 --- a/host_vars/file-dissens.dissens.netz.yml +++ b/host_vars/file-dissens.dissens.netz.yml @@ -331,6 +331,11 @@ samba_user: - team password: '20/l4ur4-s4sse-24?' + - name: lino.koehler + groups: + - projekte + password: '20.l1no-ko3hl3r_25/' + - name: maite.gabriel groups: - projekte diff --git a/host_vars/ga-st-mm.ga.netz.yml b/host_vars/ga-st-mm.ga.netz.yml new file mode 100644 index 0000000..e9a9911 --- /dev/null +++ b/host_vars/ga-st-mm.ga.netz.yml @@ -0,0 +1,215 @@ +--- + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + +install_compiler_pkgs: true + +install_postgresql_pkgs: true + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 192.168.11.1 + - 192.168.10.3 + - 192.168.10.1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - ga.netz + - ga.intra + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 192.168.11.3 + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +insert_root_ssh_keypair: true + +root_ssh_keypair: + - name: id-rsa-dehydrated + priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated + priv_key_dest: /root/.ssh/id_rsa-dehydrated + pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub + pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub + - name: id-rsa-opendkim + priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim + priv_key_dest: /root/.ssh/id_rsa-opendkim + pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub + pub_key_dest: /root/.ssh/id_rsa-opendkim.pub + +default_user: + + - name: chris + password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3 + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: maadmin + password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51 + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1' + + - name: wadmin + password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1 + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1' + + - name: sysadm + user_id: 1050 + group_id: 1050 + group: sysadm + password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1' + + - name: back + user_id: 1060 + group_id: 1060 + group: back + password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74 + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + +sudo_users: + - chris + - sysadm + - maadmin + - wadmin + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/copy_files.yml +# --- + + + +# --- +# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml +# --- diff --git a/host_vars/mm-irights-neu.oopen.de.yml b/host_vars/mm-irights-neu.oopen.de.yml index 2b73172..96b3708 100644 --- a/host_vars/mm-irights-neu.oopen.de.yml +++ b/host_vars/mm-irights-neu.oopen.de.yml @@ -98,6 +98,60 @@ resolved_fallback_nameserver: - 194.150.168.168 +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if mattermost service ist running - Restart Service if needed." + minute: '*/6' + hour: '*' + job: /root/bin/monitoring/check_local_mattermost_service.sh + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" + minute: '01' + hour: '05' + job: /var/lib/dehydrated/cron/dehydrated_cron.sh + + - name: "Check whether all certificates are included in the VHOST configurations" + minute: '33' + hour: '05' + job: /var/lib/dehydrated/tools/update_ssl_directives.sh + + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/host_vars/mm-irights.oopen.de.yml b/host_vars/mm-irights.oopen.de.yml index 2936036..39739d4 100644 --- a/host_vars/mm-irights.oopen.de.yml +++ b/host_vars/mm-irights.oopen.de.yml @@ -100,6 +100,60 @@ resolved_fallback_nameserver: - 194.150.168.168 +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if mattermost service ist running - Restart Service if needed." + minute: '*/6' + hour: '*' + job: /root/bin/monitoring/check_local_mattermost_service.sh + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" + minute: '01' + hour: '05' + job: /var/lib/dehydrated/cron/dehydrated_cron.sh + + - name: "Check whether all certificates are included in the VHOST configurations" + minute: '33' + hour: '05' + job: /var/lib/dehydrated/tools/update_ssl_directives.sh + + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/hosts b/hosts index 680a202..8d64c6d 100644 --- a/hosts +++ b/hosts @@ -79,6 +79,7 @@ ga-al-gw.oopen.de ga-nh-gw.oopen.de ga-st-lxc1.ga.netz ga-st-mail.ga.netz +ga-st-mm.ga.netz ga-al-relay.ga.netz ga-st-kvm1.ga.netz ga-al-kvm2.ga.netz @@ -170,6 +171,7 @@ o24.oopen.de cl-irights.oopen.de cl-irights-neu.oopen.de mm-irights.oopen.de +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # IL - PAD @@ -375,7 +377,8 @@ mm-migration.oopen.de o24.oopen.de cl-irights.oopen.de cl-irights-neu.oopen.de -mm-irights.oopen.de +ga-st-mm.ga.netz +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # IL - PAD @@ -559,6 +562,7 @@ ga-nh-gw.oopen.de ga-st-lxc1.ga.netz ga-st-mail.ga.netz +ga-st-mm.ga.netz ga-al-relay.ga.netz ga-st-services.ga.netz ga-al-ws1.ga.netz @@ -842,6 +846,8 @@ mm-migration.oopen.de # o24.oopen.de mm-irights.oopen.de +ga-st-mm.ga.netz +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # Hetzner Cloud CX31 - AK @@ -884,6 +890,7 @@ web-nd.oopen.de # GA - Gemeinschaft Altensclirf ga-st-services.ga.netz +ga-st-mm.ga.netz # --- # Warenform server @@ -972,6 +979,8 @@ mm-migration.oopen.de # o24.oopen.de mm-irights.oopen.de +ga-st-mm.ga.netz +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # o27.oopen.de @@ -997,6 +1006,7 @@ g.mx.oopen.de # - GA - Gemeinschaft Altensclirf ga-st-mail.ga.netz +ga-st-mm.ga.netz ga-al-relay.ga.netz # --- @@ -1066,6 +1076,8 @@ mm-migration.oopen.de cl-irights.oopen.de cl-irights-neu.oopen.de mm-irights.oopen.de +ga-st-mm.ga.netz +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # Hetzner Cloud CX31 - AK @@ -1545,6 +1557,8 @@ mm-migration.oopen.de cl-irights.oopen.de cl-irights-neu.oopen.de mm-irights.oopen.de +ga-st-mm.ga.netz +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # - o27.oopen.de @@ -1628,6 +1642,7 @@ zapata.opp.netz # - GA - Gemeinschaft Altensclirf ga-st-mail.ga.netz +ga-st-mm.ga.netz ga-al-relay.ga.netz ga-st-services.ga.netz @@ -1748,6 +1763,7 @@ o24.oopen.de cl-irights.oopen.de cl-irights-neu.oopen.de mm-irights.oopen.de +mm-irights-neu.oopen.de mm-irights-migration.oopen.de # IL - PAD @@ -1842,6 +1858,8 @@ prometheus-nd.oopen.de web-nd.oopen.de test-nd.oopen.de +# Gemeinchaft Altenschlirf +ga-st-mm.ga.netz lxc-host-kb.anw-kb.netz diff --git a/roles/common/files/etc/systemd/system/apache2.service.d/limits.conf b/roles/common/files/etc/systemd/system/apache2.service.d/limits.conf new file mode 100644 index 0000000..2223724 --- /dev/null +++ b/roles/common/files/etc/systemd/system/apache2.service.d/limits.conf @@ -0,0 +1,7 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# Custom Values overrides/adds values in 'mariadb.service' +# +[Service] +LimitNOFILE=1048576 +LimitMEMLOCK=infinity diff --git a/roles/common/files/etc/systemd/system/mariadb.service.d/limits.conf b/roles/common/files/etc/systemd/system/mariadb.service.d/limits.conf new file mode 100644 index 0000000..2223724 --- /dev/null +++ b/roles/common/files/etc/systemd/system/mariadb.service.d/limits.conf @@ -0,0 +1,7 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# Custom Values overrides/adds values in 'mariadb.service' +# +[Service] +LimitNOFILE=1048576 +LimitMEMLOCK=infinity diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml index 0991f3f..7fb62f0 100644 --- a/roles/common/handlers/main.yml +++ b/roles/common/handlers/main.yml @@ -99,3 +99,16 @@ name: ntpsec daemon_reload: yes state: restarted + +- name: Restart mariadb + service: + name: mariadb + daemon_reload: yes + state: restarted + +- name: Restart apache2 + service: + name: apache2 + daemon_reload: yes + state: restarted + diff --git a/roles/common/tasks/apache2.yml b/roles/common/tasks/apache2.yml new file mode 100644 index 0000000..43bfa0e --- /dev/null +++ b/roles/common/tasks/apache2.yml @@ -0,0 +1,37 @@ +--- + +# --- +# Apache2 Server +# --- + +- name: Populate service facts + ansible.builtin.service_facts: + +#- name: Print service facts +# ansible.builtin.debug: +# var: ansible_facts.services +# when: +# - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found' + + +- name: (apache2.yml) Ensure directory '/etc/systemd/system/apache2.service.d' is present + file: + path: /etc/systemd/system/apache2.service.d + state: directory + owner: root + group: root + mode: '0755' + when: + - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found' + + +- name: (apache2.yml) Ensure file '/etc/systemd/system/apache2.service.d/limits.conf' exists + copy: + src: 'etc/systemd/system/apache2.service.d/limits.conf' + dest: '/etc/systemd/system/apache2.service.d/limits.conf' + owner: root + group: root + mode: '0644' + notify: "Restart apache2" + when: + - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found' diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index eec892f..d0a75a7 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -280,6 +280,16 @@ when: groups['caching_nameserver']|string is search(inventory_hostname) tags: caching-nameserver +- import_tasks: mysql.yml + when: groups['mysql_server']|string is search(inventory_hostname) + tags: + - mysql + - mariadb + +- import_tasks: apache2.yml + when: groups['apache2_webserver']|string is search(inventory_hostname) + tags: + - apache2 - import_tasks: systemd-services_debian_based_OS.yml when: diff --git a/roles/common/tasks/mysql.yml b/roles/common/tasks/mysql.yml new file mode 100644 index 0000000..e566805 --- /dev/null +++ b/roles/common/tasks/mysql.yml @@ -0,0 +1,37 @@ +--- + +# --- +# MySQL / MariaDB Server +# --- + +- name: Populate service facts + ansible.builtin.service_facts: + +#- name: Print service facts +# ansible.builtin.debug: +# var: ansible_facts.services +# when: +# - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' + + +- name: (mysql.yml) Ensure directory '/etc/systemd/system/mariadb.service.d' is present + file: + path: /etc/systemd/system/mariadb.service.d + state: directory + owner: root + group: root + mode: '0755' + when: + - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found' + + +- name: (mysql.yml) Ensure file '/etc/systemd/system/mariadb.service.d/limits.conf' exists + copy: + src: 'etc/systemd/system/mariadb.service.d/limits.conf' + dest: '/etc/systemd/system/mariadb.service.d/limits.conf' + owner: root + group: root + mode: '0644' + notify: "Restart mariadb" + when: + - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'