update..

host_vars/cl-irights.oopen.de.yml

@@ -99,6 +99,90 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: '53'
+    hour: '04'
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: '27'
+    hour: '04'
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: '02'
+    hour: '23'
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud-irights.oopen.de
+
+  - name: "Background job for nextcloud instance 'cloud-irights.oopen.de"
+    minute: '*/15'
+    hour: '*'
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud-irights.oopen.de/htdocs/cron.php
+
+  - name: "Check if certificates for coolwsd service are up to date"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/nextcloud/check_cert_coolwsd.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '23'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/file-dissens.dissens.netz.yml

@@ -331,6 +331,11 @@ samba_user:
       - team
     password: '20/l4ur4-s4sse-24?'
 
+  - name: lino.koehler
+    groups:
+      - projekte
+    password: '20.l1no-ko3hl3r_25/'
+
   - name: maite.gabriel
     groups:
       - projekte

host_vars/ga-st-mm.ga.netz.yml

@@ -0,0 +1,215 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+install_compiler_pkgs: true
+
+install_postgresql_pkgs: true
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.11.1
+   - 192.168.10.3
+  - 192.168.10.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - ga.netz
+  - ga.intra
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 192.168.11.3
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_root_ssh_keypair: true
+
+root_ssh_keypair:
+  - name: id-rsa-dehydrated
+    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
+    priv_key_dest: /root/.ssh/id_rsa-dehydrated
+    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
+    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
+  - name: id-rsa-opendkim
+    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
+    priv_key_dest: /root/.ssh/id_rsa-opendkim
+    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
+    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: maadmin
+    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - maadmin
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/copy_files.yml
+# ---
+
+
+
+# ---
+# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
+# ---

host_vars/mm-irights-neu.oopen.de.yml

@@ -98,6 +98,60 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if mattermost service ist running - Restart Service if needed."
+    minute: '*/6'
+    hour: '*'
+    job: /root/bin/monitoring/check_local_mattermost_service.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '01'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/mm-irights.oopen.de.yml

@@ -100,6 +100,60 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if mattermost service ist running - Restart Service if needed."
+    minute: '*/6'
+    hour: '*'
+    job: /root/bin/monitoring/check_local_mattermost_service.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '01'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

hosts

@@ -79,6 +79,7 @@ ga-al-gw.oopen.de
 ga-nh-gw.oopen.de
 ga-st-lxc1.ga.netz
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 ga-st-kvm1.ga.netz
 ga-al-kvm2.ga.netz
@@ -170,6 +171,7 @@ o24.oopen.de
 cl-irights.oopen.de
 cl-irights-neu.oopen.de
 mm-irights.oopen.de
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # IL - PAD
@@ -375,7 +377,8 @@ mm-migration.oopen.de
 o24.oopen.de
 cl-irights.oopen.de
 cl-irights-neu.oopen.de
-mm-irights.oopen.de
+ga-st-mm.ga.netz
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # IL - PAD
@@ -559,6 +562,7 @@ ga-nh-gw.oopen.de
 
 ga-st-lxc1.ga.netz
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 ga-st-services.ga.netz
 ga-al-ws1.ga.netz
@@ -842,6 +846,8 @@ mm-migration.oopen.de
 
 # o24.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # Hetzner Cloud CX31 - AK
@@ -884,6 +890,7 @@ web-nd.oopen.de
 
 # GA - Gemeinschaft Altensclirf
 ga-st-services.ga.netz
+ga-st-mm.ga.netz
 
 # ---
 # Warenform server
@@ -972,6 +979,8 @@ mm-migration.oopen.de
 
 # o24.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # o27.oopen.de
@@ -997,6 +1006,7 @@ g.mx.oopen.de
 
 # - GA - Gemeinschaft Altensclirf
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 
 # ---
@@ -1066,6 +1076,8 @@ mm-migration.oopen.de
 cl-irights.oopen.de
 cl-irights-neu.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # Hetzner Cloud CX31 - AK
@@ -1545,6 +1557,8 @@ mm-migration.oopen.de
 cl-irights.oopen.de
 cl-irights-neu.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # - o27.oopen.de
@@ -1628,6 +1642,7 @@ zapata.opp.netz
 
 # - GA - Gemeinschaft Altensclirf
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 ga-st-services.ga.netz
 
@@ -1748,6 +1763,7 @@ o24.oopen.de
 cl-irights.oopen.de
 cl-irights-neu.oopen.de
 mm-irights.oopen.de
+mm-irights-neu.oopen.de
 mm-irights-migration.oopen.de
 
 # IL - PAD
@@ -1842,6 +1858,8 @@ prometheus-nd.oopen.de
 web-nd.oopen.de
 test-nd.oopen.de
 
+# Gemeinchaft Altenschlirf
+ga-st-mm.ga.netz
 
 
 lxc-host-kb.anw-kb.netz

roles/common/files/etc/systemd/system/apache2.service.d/limits.conf

@@ -0,0 +1,7 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# Custom Values overrides/adds values in 'mariadb.service'
+#
+[Service]
+LimitNOFILE=1048576
+LimitMEMLOCK=infinity

roles/common/files/etc/systemd/system/mariadb.service.d/limits.conf

@@ -0,0 +1,7 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# Custom Values overrides/adds values in 'mariadb.service'
+#
+[Service]
+LimitNOFILE=1048576
+LimitMEMLOCK=infinity

roles/common/handlers/main.yml

@@ -99,3 +99,16 @@
     name: ntpsec
     daemon_reload: yes
     state: restarted
+
+- name: Restart mariadb
+  service:
+    name: mariadb
+    daemon_reload: yes
+    state: restarted
+
+- name: Restart apache2
+  service:
+    name: apache2
+    daemon_reload: yes
+    state: restarted
+

roles/common/tasks/apache2.yml

@@ -0,0 +1,37 @@
+---
+
+# ---
+# Apache2  Server
+# ---
+
+- name: Populate service facts
+  ansible.builtin.service_facts:
+
+#- name: Print service facts
+#  ansible.builtin.debug:
+#    var: ansible_facts.services
+#  when: 
+#    - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
+
+
+- name: (apache2.yml) Ensure directory '/etc/systemd/system/apache2.service.d' is present
+  file:
+    path: /etc/systemd/system/apache2.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when:
+    - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
+
+
+- name: (apache2.yml) Ensure file '/etc/systemd/system/apache2.service.d/limits.conf' exists
+  copy:
+    src: 'etc/systemd/system/apache2.service.d/limits.conf'
+    dest: '/etc/systemd/system/apache2.service.d/limits.conf'
+    owner: root
+    group: root
+    mode: '0644'
+  notify: "Restart apache2"
+  when:
+    - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'

roles/common/tasks/main.yml

@@ -280,6 +280,16 @@
   when: groups['caching_nameserver']|string is search(inventory_hostname)
   tags: caching-nameserver
 
+- import_tasks: mysql.yml
+  when: groups['mysql_server']|string is search(inventory_hostname)
+  tags:
+    - mysql
+    - mariadb
+
+- import_tasks: apache2.yml
+  when: groups['apache2_webserver']|string is search(inventory_hostname)
+  tags:
+    - apache2
 
 - import_tasks: systemd-services_debian_based_OS.yml
   when:

roles/common/tasks/mysql.yml

@@ -0,0 +1,37 @@
+---
+
+# ---
+# MySQL / MariaDB  Server
+# ---
+
+- name: Populate service facts
+  ansible.builtin.service_facts:
+
+#- name: Print service facts
+#  ansible.builtin.debug:
+#    var: ansible_facts.services
+#  when: 
+#    - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'
+
+
+- name: (mysql.yml) Ensure directory '/etc/systemd/system/mariadb.service.d' is present
+  file:
+    path: /etc/systemd/system/mariadb.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when:
+    - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'
+
+
+- name: (mysql.yml) Ensure file '/etc/systemd/system/mariadb.service.d/limits.conf' exists
+  copy:
+    src: 'etc/systemd/system/mariadb.service.d/limits.conf'
+    dest: '/etc/systemd/system/mariadb.service.d/limits.conf'
+    owner: root
+    group: root
+    mode: '0644'
+  notify: "Restart mariadb"
+  when:
+    - ansible_facts['services']['mariadb.service']['name'] | default('not-found') != 'not-found'