header, name most the include_tasks and reorder based on subgroups, refactoring a few file locations in some instances.

2026-10-17 17:17:49 -07:00
parent 8b4329d129
commit 32916ad470
4 changed files with 45 additions and 31 deletions
@@ -0,0 +1,151 @@
+---
+# Enable and disable services.
+
+## Cron ##
+
+- name: General | Software | Services | CROND | Enable
+  ansible.builtin.service:
+    name: "{{ crond }}"
+    pattern: "{{ crond_pattern }}"
+    state: started
+    enabled: true
+  when: ansible_virtualization_type != 'docker'
+    and ansible_service_mgr != "runit"
+  register: cron_status
+  until: cron_status.state == "started"
+  retries: 3
+  delay: 3
+
+- name: General | Software | Services | CROND | Enable (runit)
+  ansible.builtin.service:
+    name: "{{ crond }}"
+    state: started
+    enabled: true
+  when: ansible_virtualization_type != 'docker'
+    and ansible_service_mgr == "runit"
+  ignore_errors: true # Service module seems experimental for this init system.
+
+## SSHD ##
+
+- name: General | Software | Services | SSHD | Configure
+  ansible.builtin.lineinfile:
+    path: "{{ sshd_config }}"
+    regexp: '{{ item.key }}'
+    line: '{{ item.value }} # MANAGED BY ANSIBLE'
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+  loop:
+    - { "key": '^[\#]?AllowUsers',           "value": 'AllowUsers {{ user }}'}
+    - { "key": '^[\#]?PermitRootLogin',      "value": 'PermitRootLogin no'}
+    - { "key": '^[\#]?AllowTcpForwarding',   "value": 'AllowTcpForwarding yes'}
+    - { "key": '^[\#]?ClientAliveInterval',  "value": 'ClientAliveInterval 60'}
+    - { "key": '^[\#]?ClientAliveCountMax',  "value": 'ClientAliveCountMax 2'}
+    - { "key": '^[\#]?Compression',          "value": 'Compression no'}
+    - { "key": '^[\#]?LogLevel',             "value": 'LogLevel verbose'}
+    - { "key": '^[\#]?MaxAuthTries',         "value": 'MaxAuthTries 3'}
+    - { "key": '^[\#]?MaxSessions',          "value": 'MaxSessions 2'}
+    - { "key": '^[\#]?Port',                 "value": 'Port {{ sshd_port }}'}
+    - { "key": '^[\#]?TCPKeepAlive',         "value": 'TCPKeepAlive no'}
+    - { "key": '^[\#]?X11Forwarding',        "value": 'X11Forwarding no'}
+    - { "key": '^[\#]?AllowAgentForwarding', "value": 'AllowAgentForwarding no'}
+    - { "key": '^[\#]?PermitEmptyPasswords', "value": 'PermitEmptyPasswords no'}
+    - { "key": '^[\#]?GatewayPorts',         "value": 'GatewayPorts yes'}
+
+- name: General | Software | Services | SSHD | Configure (PVE)
+  ansible.builtin.lineinfile:
+    path: "{{ sshd_config }}"
+    regexp: '{{ item.key }}'
+    line: '{{ item.value }} # MANAGED BY ANSIBLE'
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+  loop:
+    - { "key": '^[\#]?AllowUsers',      "value": 'AllowUsers root {{ user }}'}
+    - { "key": '^[\#]?PermitRootLogin', "value": 'PermitRootLogin yes'}
+    - { "key": '^[\#]?MaxSessions',     "value": 'MaxSessions 5'}
+  when: "'pve' in ansible_kernel"
+
+- name: General | Software | Services | SSHD | Enable
+  ansible.builtin.service:
+    name: "{{ sshd }}"
+    pattern: "{{ sshd_pattern }}"
+    state: reloaded
+    enabled: true
+  when: ansible_virtualization_type != 'docker'
+    and ansible_service_mgr != "runit"
+  register: sshd_status
+  until: sshd_status.state == "started"
+  retries: 3
+  delay: 3
+
+## JournalCTL ##
+
+- name: General | Software | Services | JournalCTL | Reduce Log Size
+  ansible.builtin.shell: journalctl --vacuum-size=100M
+  when: ansible_system == "Linux"
+    and ansible_service_mgr == "systemd"
+  ignore_errors: true
+
+## Bluetooth ##
+# Do people seriously depend on Bluetooth? Plug your devices in, silly!
+# Hehe, I use it now for a few rare things so disabling this for now.
+
+#- name: General | Software | Services | Bluetooth | Disable
+#  ansible.builtin.service:
+#    name: "{{ bluetooth }}"
+#    pattern: "{{ bluetooth_pattern }}"
+#    state: stopped
+#    enabled: false
+#  ignore_errors: true
+
+## NTP ##
+
+- name: General | Software | Services | NTP | Enable
+  ansible.builtin.service:
+    name: "{{ ntp_server }}"
+    pattern: "{{ ntp_server }}"
+    state: started
+    enabled: true
+  when: ansible_virtualization_type != 'docker'
+    and ansible_service_mgr != "runit"
+  register: ntp_status
+  until: ntp_status.state == "started"
+  retries: 3
+  delay: 3
+
+## Timezone ##
+
+# TBD/TODO:
+# Add a field to general.yml config file which gets applied via timedatectl and /etc/localtime.
+# Example of what to do to file:
+#    /etc/localtime -> ../usr/share/zoneinfo/America/Phoenix
+
+## Disable ##
+
+- name: General | Software | Services | Disable
+  ansible.builtin.service:
+    name: "{{ item.name }}"
+    pattern: "{{ item.pattern }}"
+    state: stopped
+    enabled: false
+  ignore_errors: true
+  loop:
+    - {name: "{{ cups }}"       , pattern: "{{ cups_pattern }}"}
+    - {name: "{{ cups_browse }}", pattern: "{{ cups_browse_pattern }}"}
+  when: ansible_service_mgr != "runit"
+
+- name: General | Software | Services | Disable (runit)
+  ansible.builtin.shell: |
+    if [[ -e {{ runit_service_dir }}/{{ item.name }} ]]; then
+      rm -v {{ runit_service_dir }}/{{ item.name }}
+    fi
+  ignore_errors: true
+  loop:
+    - {name: "{{ cups }}"               }
+    - {name: "{{ cups_pattern }}"       }
+    - {name: "{{ cups_browse }}"        }
+    - {name: "{{ cups_browse_pattern }}"}
+  when: ansible_service_mgr == "runit"