ansible/common
ansible/common
1
0
Fork 0
Code Issues Pull requests Releases Activity

feat: use ansible block

Browse source
This commit is contained in:
Simon Cornet 2025-03-31 18:19:09 +02:00
commit b5c819fb27
12 changed files with 399 additions and 424 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tasks/apt/cleanup.yaml
View file

@ -1,18 +1,22 @@
---
# clean apt cache
- name: "apt - clean cache"
# apt cleanup
- name: "apt cleanup"
block:
# clean apt cache
- name: "apt - clean cache"
ansible.builtin.apt:
clean: true
changed_when: false
failed_when: false
tags: "apt-cleanup"
when: 'ansible_os_family == "Debian"'
# run fstrim if target is a VM
- name: "fstrim"
# run fstrim if target is a VM
- name: "fstrim"
ansible.builtin.command: "fstrim /"
changed_when: false
failed_when: false
tags: "apt-cleanup"
when: 'type == "vm"'
tags: "apt-cleanup"

13
tasks/apt/config.yaml
View file

@ -1,7 +1,11 @@
---
# configure apt auto update
- name: "apt - config - configure apt periodic"
# apt config
- name: "apt config"
block:
# configure apt auto update
- name: "apt - config - configure apt periodic"
ansible.builtin.template:
src: "templates/apt/conf.d/10periodic.j2"
dest: "/etc/apt/apt.conf.d/10periodic"
@ -9,10 +13,8 @@
group: "root"
mode: "0644"
when: 'ansible_os_family == "Debian"'
tags:
- "apt"
- name: "apt - config - configure apt unatteded updates"
- name: "apt - config - configure apt unatteded updates"
ansible.builtin.template:
src: "templates/apt/conf.d/50unattended-upgrades.{{ ansible_distribution }}.j2"
dest: "/etc/apt/apt.conf.d/50unattended-upgrades"
@ -20,5 +22,6 @@
group: "root"
mode: "0644"
when: 'ansible_os_family == "Debian"'
tags:
- "apt"

15
tasks/apt/packages.yaml
View file

@ -1,7 +1,11 @@
---
# install packages
- name: "apt - install - packages"
# apt packages
- name: "apt packages"
block:
# install packages
- name: "apt - install - packages"
ansible.builtin.apt:
name: "{{ apt_default_install }}"
state: "present"
@ -10,11 +14,9 @@
loop: "{{ apt_default_packages_install }}"
loop_control:
loop_var: "apt_default_install"
tags:
- "apt"
# purge packages
- name: "apt - delete - packages"
# purge packages
- name: "apt - delete - packages"
ansible.builtin.apt:
name: "{{ apt_default_delete }}"
state: "absent"
@ -23,5 +25,6 @@
loop: "{{ apt_default_packages_delete }}"
loop_control:
loop_var: "apt_default_delete"
tags:
- "apt"

21
tasks/apt/sources.yaml
View file

@ -1,7 +1,11 @@
---
# configure apt sources
- name: "apt - config - configure apt sources"
# manage apt sources
- name: "manage apt sources"
block:
# configure apt sources
- name: "apt - config - configure apt sources"
ansible.builtin.template:
src: "templates/apt/sources.d/sources.list.{{ ansible_distribution }}.j2"
dest: "/etc/apt/sources.list"
@ -12,11 +16,9 @@
- 'ansible_os_family == "Debian"'
- 'ansible_distribution_major_version <= "23"'
notify: "apt force cache update"
tags:
- "apt"
# configure apt sources
- name: "apt - config - configure apt sources"
# configure apt sources
- name: "apt - config - configure apt sources"
ansible.builtin.template:
src: "templates/apt/sources.d/{{ ansible_distribution }}.sources.j2"
dest: "/etc/apt/sources.list.d/ubuntu.sources"
@ -27,16 +29,15 @@
- 'ansible_distribution == "Ubuntu"'
- 'ansible_distribution_major_version >= "24"'
notify: "apt force cache update"
tags:
- "apt"
# delete unused sources.list
- name: "apt - config - remove old sources.list"
# delete unused sources.list
- name: "apt - config - remove old sources.list"
ansible.builtin.file:
path: "/etc/apt/sources.list"
state: "absent"
when:
- 'ansible_distribution == "Ubuntu"'
- 'ansible_distribution_major_version >= "24"'
tags:
- "apt"

11
tasks/firewall/firewall-rules-routed.yaml
View file

@ -1,7 +1,11 @@
---
# basic firewall rules
- name: "firewall - allow incoming routed traffic"
- name: "basic firewall rules"
block:
# basic firewall rules
- name: "firewall - allow incoming routed traffic"
community.general.ufw:
rule: "allow"
route: "yes"
@ -10,10 +14,8 @@
with_nested:
- "{{ __rule['source_nets'] }}"
- "{{ __rule['destination_nets'] }}"
tags:
- "firewall"
- name: "firewall - allow outgoing routed traffic"
- name: "firewall - allow outgoing routed traffic"
community.general.ufw:
rule: "allow"
route: "yes"
@ -22,5 +24,6 @@
with_nested:
- "{{ __rule['source_nets'] }}"
- "{{ __rule['destination_nets'] }}"
tags:
- "firewall"

37
tasks/main.yaml
View file

@ -1,35 +1,18 @@
---
# check os support
- name: "check for os support"
ansible.builtin.import_tasks: "ossupport.yaml"
tags:
- "apt"
- "apt-cleanup"
- "cron"
- "environment-file"
- "hostname"
- "firewall"
- "journald"
- "locale"
- "lldp"
- "lxd"
- "motd"
- "ntp"
- "telemetry"
- "snap"
- "sshd"
- "swap"
- "sysctl"
- "systemctl"
- "syslog"
- "timezone"
- "usermanagement"
# import ossupport and load variables
- name: "import ossupport and load variables"
block:
# load os variables
- name: "include os specific vars"
# check os support
- name: "check for os support"
ansible.builtin.import_tasks: "ossupport.yaml"
# load os variables
- name: "include os specific vars"
ansible.builtin.include_vars: "{{ ansible_os_family }}.yaml"
when: "os_support"
tags:
- "apt"
- "apt-cleanup"

26
tasks/motd.yaml
View file

@ -1,37 +1,34 @@
---
# find old motd files
- name: "motd - find old scripts"
- name: "manage motd"
block:
# find old motd files
- name: "motd - find old scripts"
ansible.builtin.find:
paths: "/etc/update-motd.d/"
file_type: "file"
excludes:
- "10-custom-motd"
register: "old_motd"
tags:
- "motd"
# remove old custom motd files
- name: "motd - cleanup directory"
# remove old custom motd files
- name: "motd - cleanup directory"
ansible.builtin.file:
path: "{{ item.path }}"
state: "absent"
loop: "{{ old_motd.files }}"
when: "old_motd.files|length > 0"
tags:
- "motd"
# remove old motd files
- name: "motd - cleanup main file"
# remove old motd files
- name: "motd - cleanup main file"
ansible.builtin.file:
path: "/etc/motd"
state: "absent"
when: "inventory_hostname != 'bastion.siempie.internal'"
tags:
- "motd"
# configure motd
- name: "motd - siempie"
# configure motd
- name: "motd - siempie"
ansible.builtin.template:
src: "templates/motd/motd.sh.j2"
dest: "/etc/update-motd.d/10-custom-motd"
@ -39,5 +36,6 @@
group: "root"
mode: "0755"
when: 'ansible_os_family == "Debian"'
tags:
- "motd"

14
tasks/ntp.yaml
View file

@ -1,16 +1,17 @@
---
# install chrony
- name: "ntp - install - chrony debian"
- name: "manage ntp"
block:
# install chrony
- name: "ntp - install - chrony debian"
ansible.builtin.apt:
name: "chrony"
state: "present"
when: 'ansible_os_family == "Debian"'
tags:
- "ntp"
# configure chrony
- name: "ntp - config - configure chrony"
# configure chrony
- name: "ntp - config - configure chrony"
ansible.builtin.template:
src: "templates/chrony/chrony.conf.j2"
dest: "/etc/chrony/chrony.conf"
@ -19,5 +20,6 @@
mode: "0644"
when: 'ansible_os_family == "Debian"'
notify: "restart chrony"
tags:
- "ntp"

27
tasks/snap/snap_daemon.yaml
View file

@ -1,38 +1,37 @@
---
# set defaults
- name: "set facts"
# manage snapd
- name: "manage snapd"
block:
# set defaults
- name: "set facts"
ansible.builtin.set_fact:
__snapd_service: "{{ snapd_service | default('false') }}"
tags:
- "snap"
# purge snapd
- name: "snapd - purge - package"
# purge snapd
- name: "snapd - purge - package"
ansible.builtin.apt:
name: "snapd"
state: "absent"
purge: "yes"
when: "not __snapd_service"
tags:
- "snap"
# install snapd
- name: "snapd - install - package"
# install snapd
- name: "snapd - install - package"
ansible.builtin.apt:
name: "snapd"
state: "present"
cache_valid_time: "120"
when: "__snapd_service"
tags:
- "snap"
# enable snapd
- name: "snapd - enable snapd service"
# enable snapd
- name: "snapd - enable snapd service"
ansible.builtin.service:
name: "snapd"
state: "started"
enabled: true
when: "__snapd_service"
tags:
- "snap"

67
tasks/swap.yaml
View file

@ -1,48 +1,42 @@
---
# enable or disable swap
- name: "swap - set variable"
# manage swap
- name: "manage swap"
block:
# enable or disable swap
- name: "swap - set variable"
ansible.builtin.set_fact:
__swap: "{{ swap | default('true') }}"
tags:
- "swap"
# verify swapfile
- name: "swap - verify swapfile"
# verify swapfile
- name: "swap - verify swapfile"
ansible.builtin.stat:
path: "{{ swap_file_location | default('/swapfile') }}"
register: "swap_file_check"
tags:
- "swap"
## create swap
# create swap file
- name: "swap - create swap file"
## create swap
# create swap file
- name: "swap - create swap file"
ansible.builtin.command: "fallocate -l {{ swap_file_size }} {{ swap_file_location }}"
when: "not swap_file_check.stat.exists and __swap"
tags:
- "swap"
# set swap file permissions
- name: "swap - set permissions "
# set swap file permissions
- name: "swap - set permissions "
ansible.builtin.file:
path: "{{ swap_file_location }}"
owner: "root"
group: "root"
mode: "0600"
when: "__swap"
tags:
- "swap"
# 'format' swapfile
- name: "swap - format swap file"
# 'format' swapfile
- name: "swap - format swap file"
ansible.builtin.command: "mkswap {{ swap_file_location }}"
when: "not swap_file_check.stat.exists and __swap"
tags:
- "swap"
# configure fstab
- name: "swap - configure fstab"
# configure fstab
- name: "swap - configure fstab"
ansible.posix.mount:
name: "swapfile"
src: "{{ swap_file_location | default('/swapfile') }}"
@ -52,35 +46,27 @@
dump: "0"
state: "present"
when: "__swap"
tags:
- "swap"
# enable swap
- name: "swap - enable swap"
# enable swap
- name: "swap - enable swap"
ansible.builtin.command: "swapon -a"
when: "not swap_file_check.stat.exists and __swap"
tags:
- "swap"
## delete swap
# disable swap
- name: "swap - disable swap"
## delete swap
# disable swap
- name: "swap - disable swap"
ansible.builtin.command: "swapoff -a"
when: "swap_file_check.stat.exists and not __swap"
tags:
- "swap"
# delete swap file
- name: "swap - delete swap file"
# delete swap file
- name: "swap - delete swap file"
ansible.builtin.file:
path: "{{ swap_file_location }}"
state: "absent"
when: "swap_file_check.stat.exists and not __swap"
tags:
- "swap"
# configure fstab
- name: "swap - configure fstab"
# configure fstab
- name: "swap - configure fstab"
ansible.posix.mount:
name: "swapfile"
src: "{{ swap_file_location | default('/swapfile') }}"
@ -90,5 +76,6 @@
dump: "0"
state: "absent"
when: "not __swap"
tags:
- "swap"

27
tasks/syslog/config.yaml
View file

@ -1,7 +1,11 @@
---
# configure rsyslogd - debian
- name: "syslog - config - rsyslog - debian"
# manage syslog
- name: "manage syslog"
block:
# configure rsyslogd - debian
- name: "syslog - config - rsyslog - debian"
ansible.builtin.template:
src: "templates/syslog/rsyslog/rsyslog.debian.conf.j2"
dest: "/etc/rsyslog.conf"
@ -10,11 +14,9 @@
mode: "0644"
when: 'ansible_distribution == "Debian"'
notify: "restart rsyslog"
tags:
- "syslog"
# configure rsyslogd - ubuntu
- name: "syslog - config - rsyslog - ubuntu"
# configure rsyslogd - ubuntu
- name: "syslog - config - rsyslog - ubuntu"
ansible.builtin.template:
src: "templates/syslog/rsyslog/rsyslog.ubuntu.conf.j2"
dest: "/etc/rsyslog.conf"
@ -23,11 +25,9 @@
mode: "0644"
when: 'ansible_distribution == "Ubuntu"'
notify: "restart rsyslog"
tags:
- "syslog"
# configure rsyslogd - apt
- name: "syslog - config - apt"
# configure rsyslogd - apt
- name: "syslog - config - apt"
ansible.builtin.template:
src: "templates/syslog/rsyslog.d/apt.conf.j2"
dest: "/etc/rsyslog.d/apt.conf"
@ -36,11 +36,9 @@
mode: "0644"
when: 'ansible_os_family == "Debian"'
notify: "restart rsyslog"
tags:
- "syslog"
# configure rsyslogd - observium
- name: "syslog - config - remote-logging"
# configure rsyslogd - observium
- name: "syslog - config - remote-logging"
ansible.builtin.template:
src: "templates/syslog/rsyslog.d/remote-logging.j2"
dest: "/etc/rsyslog.d/remote-logging.conf"
@ -49,5 +47,6 @@
mode: "0644"
when: 'ansible_os_family == "Debian"'
notify: "restart rsyslog"
tags:
- "syslog"

41
tasks/user.yaml
View file

@ -1,17 +1,19 @@
---
# manage facts
- name: "user - set default facts for {{ __user['username'] }}"
# manage users
- name: "manage users"
block:
# manage facts
- name: "user - set default facts for {{ __user['username'] }}"
ansible.builtin.set_fact:
sudo_hosts: "{{ __user['hosts'] | default('all') }}"
sudo_file: "{{ __user['sudo'] | default('False') }}"
sudo_pwless: "{{ __user['sudo_passwordless'] | default('False') }}"
user_state: "{{ __user['state'] | default('present') }}"
tags:
- "usermanagement"
# create users
- name: "user - create users with password - {{ __user['username'] }}"
# create users
- name: "user - create users with password - {{ __user['username'] }}"
ansible.builtin.user:
name: "{{ __user['username'] }}"
comment: "{{ __user['name'] }}"
@ -21,10 +23,8 @@
when:
- "__user['password'] is defined"
- "user_state == 'present'"
tags:
- "usermanagement"
- name: "user - create users withouth password - {{ __user['username'] }}"
- name: "user - create users withouth password - {{ __user['username'] }}"
ansible.builtin.user:
name: "{{ __user['username'] }}"
comment: "{{ __user['name'] }}"
@ -33,11 +33,9 @@
when:
- "__user['password'] is not defined"
- "user_state == 'present'"
tags:
- "usermanagement"
# manage authorized_keys
- name: "user - manage authorized_keys - {{ __user['username'] }}"
# manage authorized_keys
- name: "user - manage authorized_keys - {{ __user['username'] }}"
ansible.posix.authorized_key:
user: "{{ __user['username'] }}"
key: "{{ __user['publickey'] }}"
@ -45,21 +43,17 @@
manage_dir: "true"
when:
- "__user['publickey'] is defined"
tags:
- "usermanagement"
# delete users
- name: "user - delete users - {{ __user['username'] }}"
# delete users
- name: "user - delete users - {{ __user['username'] }}"
ansible.builtin.user:
name: "{{ __user['username'] }}"
state: "absent"
remove: "yes"
when: "user_state == 'absent'"
tags:
- "usermanagement"
# manage sudoers file
- name: "user - create sudoers file - {{ __user['username'] }}"
# manage sudoers file
- name: "user - create sudoers file - {{ __user['username'] }}"
ansible.builtin.template:
src: "templates/usermanagement/sudoers.d/sudoers.j2"
dest: "/etc/sudoers.d/{{ __user['username'] }}"
@ -68,14 +62,13 @@
mode: "0644"
when:
- "sudo_file"
tags:
- "usermanagement"
- name: "user - delete sudoers file - {{ __user['username'] }}"
- name: "user - delete sudoers file - {{ __user['username'] }}"
ansible.builtin.file:
state: "absent"
path: "/etc/sudoers.d/{{ __user['username'] }}"
when:
- "not sudo_file"
tags:
- "usermanagement"