header, name most the include_tasks and reorder based on subgroups, refactoring a few file locations in some instances.
This commit is contained in:
@@ -1,52 +0,0 @@
|
||||
---
|
||||
# 20261002 - Hyperling
|
||||
# Move internet requiring code out of users.yml.
|
||||
|
||||
# Shared Environment Setup #
|
||||
|
||||
- name: General | Account Management | Users | env-shared | Download / Update
|
||||
ansible.builtin.git:
|
||||
repo: https://git.hyperling.com/me/env-shared
|
||||
version: "{{ branch }}"
|
||||
dest: "{{ shared_rc_install_dir }}"
|
||||
clone: true
|
||||
force: true
|
||||
update: true
|
||||
#ignore_errors: true
|
||||
|
||||
- name: General | Account Management | Users | env-shared | Install | .rc_shared
|
||||
copy:
|
||||
src: "{{ shared_rc_install_dir }}/rc_shared.sh"
|
||||
dest: "{{ item }}/.rc_shared"
|
||||
owner: root
|
||||
group: "{{ root_group }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- "{{ user_root.home }}"
|
||||
- "{{ user_user.home }}"
|
||||
#ignore_errors: true
|
||||
when: user_root.home != "" and user_user.home != ""
|
||||
|
||||
- name: General | Account Management | Users | env-shared | Install | .vimrc
|
||||
copy:
|
||||
src: "{{ shared_rc_install_dir }}/vimrc.vim"
|
||||
dest: "{{ item }}/.vimrc"
|
||||
owner: root
|
||||
group: "{{ root_group }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- "{{ user_root.home }}"
|
||||
- "{{ user_user.home }}"
|
||||
#ignore_errors: true
|
||||
when: user_root.home != "" and user_user.home != ""
|
||||
|
||||
- name: General | Account Management | Users | env-shared | Permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ user_user.home }}/{{ item }}"
|
||||
owner: "{{ user }}"
|
||||
group: "{{ user }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- .rc_shared
|
||||
- .vimrc
|
||||
#ignore_errors: true
|
||||
@@ -1,151 +0,0 @@
|
||||
---
|
||||
# Enable and disable services.
|
||||
|
||||
## Cron ##
|
||||
|
||||
- name: General | Software | Services | CROND | Enable
|
||||
ansible.builtin.service:
|
||||
name: "{{ crond }}"
|
||||
pattern: "{{ crond_pattern }}"
|
||||
state: started
|
||||
enabled: true
|
||||
when: ansible_virtualization_type != 'docker'
|
||||
and ansible_service_mgr != "runit"
|
||||
register: cron_status
|
||||
until: cron_status.state == "started"
|
||||
retries: 3
|
||||
delay: 3
|
||||
|
||||
- name: General | Software | Services | CROND | Enable (runit)
|
||||
ansible.builtin.service:
|
||||
name: "{{ crond }}"
|
||||
state: started
|
||||
enabled: true
|
||||
when: ansible_virtualization_type != 'docker'
|
||||
and ansible_service_mgr == "runit"
|
||||
ignore_errors: true # Service module seems experimental for this init system.
|
||||
|
||||
## SSHD ##
|
||||
|
||||
- name: General | Software | Services | SSHD | Configure
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ sshd_config }}"
|
||||
regexp: '{{ item.key }}'
|
||||
line: '{{ item.value }} # MANAGED BY ANSIBLE'
|
||||
state: present
|
||||
create: true
|
||||
backup: true
|
||||
mode: "0644"
|
||||
loop:
|
||||
- { "key": '^[\#]?AllowUsers', "value": 'AllowUsers {{ user }}'}
|
||||
- { "key": '^[\#]?PermitRootLogin', "value": 'PermitRootLogin no'}
|
||||
- { "key": '^[\#]?AllowTcpForwarding', "value": 'AllowTcpForwarding yes'}
|
||||
- { "key": '^[\#]?ClientAliveInterval', "value": 'ClientAliveInterval 60'}
|
||||
- { "key": '^[\#]?ClientAliveCountMax', "value": 'ClientAliveCountMax 2'}
|
||||
- { "key": '^[\#]?Compression', "value": 'Compression no'}
|
||||
- { "key": '^[\#]?LogLevel', "value": 'LogLevel verbose'}
|
||||
- { "key": '^[\#]?MaxAuthTries', "value": 'MaxAuthTries 3'}
|
||||
- { "key": '^[\#]?MaxSessions', "value": 'MaxSessions 2'}
|
||||
- { "key": '^[\#]?Port', "value": 'Port {{ sshd_port }}'}
|
||||
- { "key": '^[\#]?TCPKeepAlive', "value": 'TCPKeepAlive no'}
|
||||
- { "key": '^[\#]?X11Forwarding', "value": 'X11Forwarding no'}
|
||||
- { "key": '^[\#]?AllowAgentForwarding', "value": 'AllowAgentForwarding no'}
|
||||
- { "key": '^[\#]?PermitEmptyPasswords', "value": 'PermitEmptyPasswords no'}
|
||||
- { "key": '^[\#]?GatewayPorts', "value": 'GatewayPorts yes'}
|
||||
|
||||
- name: General | Software | Services | SSHD | Configure (PVE)
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ sshd_config }}"
|
||||
regexp: '{{ item.key }}'
|
||||
line: '{{ item.value }} # MANAGED BY ANSIBLE'
|
||||
state: present
|
||||
create: true
|
||||
backup: true
|
||||
mode: "0644"
|
||||
loop:
|
||||
- { "key": '^[\#]?AllowUsers', "value": 'AllowUsers root {{ user }}'}
|
||||
- { "key": '^[\#]?PermitRootLogin', "value": 'PermitRootLogin yes'}
|
||||
- { "key": '^[\#]?MaxSessions', "value": 'MaxSessions 5'}
|
||||
when: "'pve' in ansible_kernel"
|
||||
|
||||
- name: General | Software | Services | SSHD | Enable
|
||||
ansible.builtin.service:
|
||||
name: "{{ sshd }}"
|
||||
pattern: "{{ sshd_pattern }}"
|
||||
state: reloaded
|
||||
enabled: true
|
||||
when: ansible_virtualization_type != 'docker'
|
||||
and ansible_service_mgr != "runit"
|
||||
register: sshd_status
|
||||
until: sshd_status.state == "started"
|
||||
retries: 3
|
||||
delay: 3
|
||||
|
||||
## JournalCTL ##
|
||||
|
||||
- name: General | Software | Services | JournalCTL | Reduce Log Size
|
||||
ansible.builtin.shell: journalctl --vacuum-size=100M
|
||||
when: ansible_system == "Linux"
|
||||
and ansible_service_mgr == "systemd"
|
||||
ignore_errors: true
|
||||
|
||||
## Bluetooth ##
|
||||
# Do people seriously depend on Bluetooth? Plug your devices in, silly!
|
||||
# Hehe, I use it now for a few rare things so disabling this for now.
|
||||
|
||||
#- name: General | Software | Services | Bluetooth | Disable
|
||||
# ansible.builtin.service:
|
||||
# name: "{{ bluetooth }}"
|
||||
# pattern: "{{ bluetooth_pattern }}"
|
||||
# state: stopped
|
||||
# enabled: false
|
||||
# ignore_errors: true
|
||||
|
||||
## NTP ##
|
||||
|
||||
- name: General | Software | Services | NTP | Enable
|
||||
ansible.builtin.service:
|
||||
name: "{{ ntp_server }}"
|
||||
pattern: "{{ ntp_server }}"
|
||||
state: started
|
||||
enabled: true
|
||||
when: ansible_virtualization_type != 'docker'
|
||||
and ansible_service_mgr != "runit"
|
||||
register: ntp_status
|
||||
until: ntp_status.state == "started"
|
||||
retries: 3
|
||||
delay: 3
|
||||
|
||||
## Timezone ##
|
||||
|
||||
# TBD/TODO:
|
||||
# Add a field to general.yml config file which gets applied via timedatectl and /etc/localtime.
|
||||
# Example of what to do to file:
|
||||
# /etc/localtime -> ../usr/share/zoneinfo/America/Phoenix
|
||||
|
||||
## Disable ##
|
||||
|
||||
- name: General | Software | Services | Disable
|
||||
ansible.builtin.service:
|
||||
name: "{{ item.name }}"
|
||||
pattern: "{{ item.pattern }}"
|
||||
state: stopped
|
||||
enabled: false
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- {name: "{{ cups }}" , pattern: "{{ cups_pattern }}"}
|
||||
- {name: "{{ cups_browse }}", pattern: "{{ cups_browse_pattern }}"}
|
||||
when: ansible_service_mgr != "runit"
|
||||
|
||||
- name: General | Software | Services | Disable (runit)
|
||||
ansible.builtin.shell: |
|
||||
if [[ -e {{ runit_service_dir }}/{{ item.name }} ]]; then
|
||||
rm -v {{ runit_service_dir }}/{{ item.name }}
|
||||
fi
|
||||
ignore_errors: true
|
||||
loop:
|
||||
- {name: "{{ cups }}" }
|
||||
- {name: "{{ cups_pattern }}" }
|
||||
- {name: "{{ cups_browse }}" }
|
||||
- {name: "{{ cups_browse_pattern }}"}
|
||||
when: ansible_service_mgr == "runit"
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
# Setup swap file on systems without any swap available.
|
||||
# Must have the swap amount preferred set up in general.ini.
|
||||
# This does not handle if the user changes the file name or location later on.
|
||||
|
||||
- name: General | Software | Swap
|
||||
block:
|
||||
|
||||
- name: General | Software | Swap | Check For Swapfile
|
||||
ansible.builtin.stat:
|
||||
path: "{{ swap_file }}"
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: swap_check
|
||||
|
||||
- name: General | Software | Swap | Install Block
|
||||
block:
|
||||
|
||||
- name: General | Software | Swap | Create Swapfile
|
||||
ansible.builtin.shell: "{{ item }}"
|
||||
loop:
|
||||
- dd if=/dev/zero of={{ swap_file }} bs={{ swap_block }}
|
||||
count={{ swap_count }} status=progress
|
||||
- chmod 600 {{ swap_file }}
|
||||
- mkswap {{ swap_file }}
|
||||
- swapon {{ swap_file }}
|
||||
|
||||
# Only do the swapfile generation if it does not already exist.
|
||||
when: not swap_check.stat.exists
|
||||
|
||||
# NixOS's swap setup is handled in nixos.yml when ansible.nix is created.
|
||||
- name: General | Software | Swap | Add to FSTAB
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/fstab
|
||||
regexp: '^[\#]?{{ swap_file }}'
|
||||
line: '{{ swap_file }} none swap sw 0 0'
|
||||
state: present
|
||||
backup: true
|
||||
when: ansible_distribution != "NixOS"
|
||||
|
||||
# Only run through this file if the ini has been changed from false.
|
||||
when: swap_block != false
|
||||
Reference in New Issue
Block a user