Merge pull request 'Testing' (#2) from testing into main
Reviewed-on: max/ansible_home#2
This commit is contained in:
@@ -1,3 +1,6 @@
|
||||
# ---> Ansible
|
||||
*.retry
|
||||
inventory/group_vars/secret/
|
||||
|
||||
# Ignore python venv
|
||||
.venv
|
||||
@@ -5,3 +5,11 @@ ansible_become_password: p@a$$word
|
||||
ansible_ssh_key: $$h_key
|
||||
# Password for the default unprivileged user
|
||||
user_password: p@a$$word
|
||||
# ntfy topic
|
||||
ntfy_topic: https://x.y.z/topic
|
||||
# ntfy topic token
|
||||
ntfy_topic_token: t0ken
|
||||
# Home Assistant Webhook token
|
||||
ha_webhook_token: h@_t0ken
|
||||
# Proxmox API token secret
|
||||
proxmox_token_secret: t0ken_$ecret
|
||||
|
||||
@@ -1,21 +1,35 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
37386438323934313261326132383539643062353335333661326131643032316239326161373930
|
||||
3264633766303937353938343565326562626535343830370a303632386666613033323132616561
|
||||
33353565616333346663396535613738343439323535663932633134663139623032353764633333
|
||||
6533366164393164300a303963343863323133303565323635313030396532336237313837633231
|
||||
35653733306565386665333739323433646238343961396234666232666238363264333639346265
|
||||
31323037356665366138663365653666623066393661353035636239656136323466633461323765
|
||||
34323836623766643562363035313465343863633534646466376437633761373665636233646532
|
||||
39616362353930376464626136336133333639636638623138313065383934666237383738396334
|
||||
34323930306536663131333639373764393135653161663431373563323837313964333736643238
|
||||
61353861656431396366616534633935636332323665336536353337646133653333663436623633
|
||||
34616333393666356632656238333935636562366237393162653864306462316231376666653932
|
||||
32373336373231306134343337373736656638343439373564343464653030623034333734656462
|
||||
63633634396631333233323939663763313163373863326634306663656638373239306634643337
|
||||
32343262393761643237653538376163633066376538616537653139376637663339646234383535
|
||||
62396663396161396130303135396330303530333533363533366330303831326661653138333336
|
||||
37386436373337613064343138373433393435653066303364326461303565336539396362373135
|
||||
31663538383030326566303166353934626639653432356562613938646364666337383835353234
|
||||
62383838346339653766393233383563356363383039303862393564353464343534373666376434
|
||||
33323136613337366566393535633730643064353664393436363830333561643265623163386165
|
||||
62323337363238643166
|
||||
37396233623362356239383039306566316433613761383032386566643964326638663830343837
|
||||
3031613035666339666634393439386463373734336130320a646331343036626234316131313265
|
||||
36666134646236333162316237326362333430616235633130633364666261343133306637623165
|
||||
6565633434353035390a323665636234616230373430663030666564363434623930656264343231
|
||||
39623465326661393832633661393437396535363434646261323737303163623230366161366163
|
||||
35373561636233313764366631373261316635386463353464306437323461613033313836383238
|
||||
36316133343737373666386534663939636234363831633738383738386433663533306465333230
|
||||
64633161396538316535346333343937306431386364363736656131613939336438663364323262
|
||||
34636633366464306231373739343764333935623434633331316463323961363364393865383732
|
||||
31393834626561643235393035666263646334613837666436333632393665346638623965346461
|
||||
35343966633631386330653834623234626537353739323938323339663836616139633832303465
|
||||
66356564636233663230633732333363343732396264653339396562353734643561643536616237
|
||||
34366536623535313533623634653632316538326137363034653030346337646264653765316662
|
||||
30613430636433303661353266666635333362613964383337643130316563633438653631373665
|
||||
37393465343561333966303137373636613937383261616365613463393263303863333134653630
|
||||
66386165303135343662346335653537366230316332666439326639613063383931313839376237
|
||||
64626362386666613362616666373565336666623837323064386262393135343834323161366163
|
||||
63393765653964633861663765343735626462303064383063643563393332653738343633313466
|
||||
61613264303139623530393765636162373136363837626134653930376230343463623433643063
|
||||
62393337623566616431306632333337616263633031613437643334363162623331653535396233
|
||||
63323939633563373137346537363834306261613738333636303762353639366136373734346632
|
||||
39333135616335343561626133386539333833366339613463626637326337333430376430393538
|
||||
33373234353064326435376432383139623561646361303063386531373164353335323265616566
|
||||
61643765313264626232366161313232323437306333316161663433643534363063393864666563
|
||||
35353966396164633534386663616233383236663466356465306361613039353366343630343063
|
||||
61643131343731366237313666626366656639663136393834376531323136653064383533383436
|
||||
31313038303766633339323465316236356536623362656432346233306434643236373831613339
|
||||
65663031326630303665306265623937623965633333363736373237333732306566386138396633
|
||||
36386461633762326466383436623263303935643133383365333664663665396134383730373030
|
||||
62663264363438336638663161366637663232383032633762373232396366633631666265323934
|
||||
62366536336435306539393662623962656335356439376466396539653263653033313964363364
|
||||
30303238646338396663323262653562353332346136323862616165663066373163313132396633
|
||||
31346438616130396332613736613635306530626663623634636434643137343262663635613061
|
||||
3762346665393865336666386163616430633731326237623733
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
physical:
|
||||
hosts:
|
||||
192.168.0.5:
|
||||
192.168.0.45:
|
||||
ansible_become_password: "{{ ansible_become_passwd }}"
|
||||
@@ -1,17 +1,17 @@
|
||||
---
|
||||
- name: Deplot simple test LXC on Proxmox VE
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
roles:
|
||||
- ../roles/basic_proxmox_lxc
|
||||
|
||||
- name: Basic Proxmox guest deployment
|
||||
hosts: all
|
||||
remote_user: root
|
||||
roles:
|
||||
- ../roles/0_basic_postinstall
|
||||
- ../roles/basic_postinstall
|
||||
vars_files:
|
||||
../inventory/group_vars/all/secrets.yaml
|
||||
vars:
|
||||
ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
|
||||
user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
|
||||
|
||||
handlers:
|
||||
- name: restart sshd
|
||||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
- name: Deploy a virtual machine from a cloud init image
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
roles:
|
||||
- ../roles/basic_proxmox_vm
|
||||
|
||||
- name: Basic Proxmox guest deployment
|
||||
hosts: all
|
||||
remote_user: ansible
|
||||
roles:
|
||||
- ../roles/basic_postinstall
|
||||
vars_files:
|
||||
../inventory/group_vars/all/secrets.yaml
|
||||
vars:
|
||||
ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
|
||||
user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
|
||||
|
||||
handlers:
|
||||
- name: restart ssh-server
|
||||
service:
|
||||
name: ssh
|
||||
state: restarted
|
||||
|
||||
- name: restart sshd-server
|
||||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
- name: Physical machines maintanance play
|
||||
hosts: all
|
||||
remote_user: ansible
|
||||
roles:
|
||||
- ../roles/common_healthcheck
|
||||
vars_files:
|
||||
../inventory/group_vars/all/secrets.yaml
|
||||
vars:
|
||||
ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
|
||||
user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
|
||||
ha_addr: https://ha.lan
|
||||
@@ -0,0 +1,30 @@
|
||||
ansible-compat==26.6.0
|
||||
ansible-core==2.21.1
|
||||
ansible-lint==26.6.0
|
||||
attrs==26.1.0
|
||||
black==26.5.1
|
||||
bracex==3.0
|
||||
cffi==2.1.0
|
||||
click==8.4.2
|
||||
cryptography==49.0.0
|
||||
distro==1.9.0
|
||||
filelock==3.29.7
|
||||
Jinja2==3.1.6
|
||||
jsonschema==4.26.0
|
||||
jsonschema-specifications==2025.9.1
|
||||
MarkupSafe==3.0.3
|
||||
mypy_extensions==1.1.0
|
||||
packaging==26.2
|
||||
pathspec==1.1.1
|
||||
platformdirs==4.10.0
|
||||
pycparser==3.0
|
||||
pytokens==0.4.1
|
||||
PyYAML==6.0.3
|
||||
referencing==0.37.0
|
||||
resolvelib==1.2.1
|
||||
rpds-py==2026.6.3
|
||||
ruamel.yaml==0.19.1
|
||||
ruamel.yaml.clib==0.2.15
|
||||
subprocess-tee==0.4.2
|
||||
wcmatch==11.0
|
||||
yamllint==1.38.0
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Configure ssh-server daemon
|
||||
copy:
|
||||
src: ../files/hardened_sshd.conf
|
||||
dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
|
||||
mode: u=rw,g=r,o=r
|
||||
notify: restart sshd
|
||||
|
||||
|
||||
- name: Configure ssh client
|
||||
copy:
|
||||
src: ../files/hardened_ssh.conf
|
||||
dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
|
||||
mode: u=rw,g=r,o=r
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
- name: Create and set up Ansible user and environment
|
||||
ansible.builtin.include_tasks: prepare_ansible_user.yaml
|
||||
|
||||
- name: Improve SSH configuration
|
||||
ansible.builtin.include_tasks: harden_ssh.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
set number
|
||||
set tabstop=2
|
||||
" Disable compatibility with vi which can cause unexpected issues.
|
||||
set nocompatible
|
||||
|
||||
" Enable type file detection. Vim will be able to try to detect the type of file in use.
|
||||
filetype on
|
||||
|
||||
" Enable plugins and load plugin for the detected file type.
|
||||
filetype plugin on
|
||||
|
||||
" Load an indent file for the detected file type.
|
||||
filetype indent on
|
||||
|
||||
" Turn syntax highlighting on.
|
||||
syntax on
|
||||
@@ -0,0 +1,105 @@
|
||||
export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
|
||||
|
||||
# Path to your Oh My Zsh installation.
|
||||
export ZSH="$HOME/.oh-my-zsh"
|
||||
|
||||
export GTK_THEME=Adwaita-dark
|
||||
|
||||
# Set name of the theme to load --- if set to "random", it will
|
||||
# load a random theme each time Oh My Zsh is loaded, in which case,
|
||||
# to know which specific one was loaded, run: echo $RANDOM_THEME
|
||||
# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
|
||||
ZSH_THEME="gnzh"
|
||||
|
||||
# Set list of themes to pick from when loading at random
|
||||
# Setting this variable when ZSH_THEME=random will cause zsh to load
|
||||
# a theme from this variable instead of looking in $ZSH/themes/
|
||||
# If set to an empty array, this variable will have no effect.
|
||||
# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
|
||||
|
||||
# Uncomment the following line to use case-sensitive completion.
|
||||
# CASE_SENSITIVE="true"
|
||||
|
||||
# Uncomment the following line to use hyphen-insensitive completion.
|
||||
# Case-sensitive completion must be off. _ and - will be interchangeable.
|
||||
# HYPHEN_INSENSITIVE="true"
|
||||
|
||||
# Uncomment one of the following lines to change the auto-update behavior
|
||||
# zstyle ':omz:update' mode disabled # disable automatic updates
|
||||
# zstyle ':omz:update' mode auto # update automatically without asking
|
||||
# zstyle ':omz:update' mode reminder # just remind me to update when it's time
|
||||
|
||||
# Uncomment the following line to change how often to auto-update (in days).
|
||||
# zstyle ':omz:update' frequency 13
|
||||
|
||||
# Uncomment the following line if pasting URLs and other text is messed up.
|
||||
# DISABLE_MAGIC_FUNCTIONS="true"
|
||||
|
||||
# Uncomment the following line to disable colors in ls.
|
||||
# DISABLE_LS_COLORS="true"
|
||||
|
||||
# Uncomment the following line to disable auto-setting terminal title.
|
||||
# DISABLE_AUTO_TITLE="true"
|
||||
|
||||
# Uncomment the following line to enable command auto-correction.
|
||||
# ENABLE_CORRECTION="true"
|
||||
|
||||
# Uncomment the following line to display red dots whilst waiting for completion.
|
||||
# You can also set it to another string to have that shown instead of the default red dots.
|
||||
# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
|
||||
# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
|
||||
# COMPLETION_WAITING_DOTS="true"
|
||||
|
||||
# Uncomment the following line if you want to disable marking untracked files
|
||||
# under VCS as dirty. This makes repository status check for large repositories
|
||||
# much, much faster.
|
||||
# DISABLE_UNTRACKED_FILES_DIRTY="true"
|
||||
|
||||
# Uncomment the following line if you want to change the command execution time
|
||||
# stamp shown in the history command output.
|
||||
# You can set one of the optional three formats:
|
||||
# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
|
||||
# or set a custom format using the strftime function format specifications,
|
||||
# see 'man strftime' for details.
|
||||
# HIST_STAMPS="mm/dd/yyyy"
|
||||
|
||||
# Would you like to use another custom folder than $ZSH/custom?
|
||||
# ZSH_CUSTOM=/path/to/new-custom-folder
|
||||
|
||||
# Which plugins would you like to load?
|
||||
# Standard plugins can be found in $ZSH/plugins/
|
||||
# Custom plugins may be added to $ZSH_CUSTOM/plugins/
|
||||
# Example format: plugins=(rails git textmate ruby lighthouse)
|
||||
# Add wisely, as too many plugins slow down shell startup.
|
||||
#plugins=(git)
|
||||
|
||||
source $ZSH/oh-my-zsh.sh
|
||||
|
||||
# User configuration
|
||||
|
||||
# export MANPATH="/usr/local/man:$MANPATH"
|
||||
|
||||
# You may need to manually set your language environment
|
||||
# export LANG=en_US.UTF-8
|
||||
|
||||
# Preferred editor for local and remote sessions
|
||||
# if [[ -n $SSH_CONNECTION ]]; then
|
||||
# export EDITOR='vim'
|
||||
# else
|
||||
# export EDITOR='nvim'
|
||||
# fi
|
||||
|
||||
# Compilation flags
|
||||
# export ARCHFLAGS="-arch $(uname -m)"
|
||||
|
||||
# Set personal aliases, overriding those provided by Oh My Zsh libs,
|
||||
# plugins, and themes. Aliases can be placed here, though Oh My Zsh
|
||||
# users are encouraged to define aliases within a top-level file in
|
||||
# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
|
||||
# - $ZSH_CUSTOM/aliases.zsh
|
||||
# - $ZSH_CUSTOM/macos.zsh
|
||||
# For a full list of active aliases, run `alias`.
|
||||
#
|
||||
# Example aliases
|
||||
# alias zshconfig="mate ~/.zshrc"
|
||||
# alias ohmyzsh="mate ~/.oh-my-zsh"
|
||||
+18
-12
@@ -1,23 +1,29 @@
|
||||
# Disable root login entirely
|
||||
PermitRootLogin no
|
||||
|
||||
PubkeyAuthentication yes
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
UsePAM no
|
||||
# Disable password authentication — keys only
|
||||
PasswordAuthentication no
|
||||
ChallengeResponseAuthentication no
|
||||
UsePAM no
|
||||
|
||||
|
||||
AllowGroups sshusers
|
||||
PrintMotd no
|
||||
AcceptEnv LANG LC_*
|
||||
ClientAliveCountMax 0
|
||||
ClientAliveInterval 300
|
||||
Port 22
|
||||
|
||||
|
||||
# Disable root login entirely
|
||||
PermitRootLogin no
|
||||
|
||||
# Limit authentication attempts
|
||||
MaxAuthTries 3
|
||||
MaxSessions 2
|
||||
|
||||
# Allow only your specific user
|
||||
AllowUsers deploy
|
||||
MaxSessions 3
|
||||
|
||||
# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
|
||||
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
|
||||
# Connection timeout
|
||||
ClientAliveInterval 300
|
||||
ClientAliveCountMax 2
|
||||
@@ -0,0 +1,15 @@
|
||||
#!/bin/sh
|
||||
|
||||
FILE=/home/$USER/.oh-my-zsh/oh-my-zsh.sh
|
||||
if [ -f "$FILE" ]; then
|
||||
echo "$FILE exists and we not installing ohmyzsh"
|
||||
exit 0
|
||||
else
|
||||
echo "$FILE does not exist and we install ohmyzsh"
|
||||
cd /home/max
|
||||
wget https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh
|
||||
chmod +x /home/max/install.sh
|
||||
timeout -s 15 -k 30s 20s /home/max/install.sh --unattendend --keep-zshrc || exit 0
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
---
|
||||
- name: Create a new user with a password, set shell
|
||||
remote_user: ansible
|
||||
ansible.builtin.user:
|
||||
name: max
|
||||
groups: sshusers,sudo
|
||||
password: "{{ user_passwd_hash }}"
|
||||
shell: /bin/zsh
|
||||
|
||||
- name: Set authorized key taken from file
|
||||
remote_user: ansible
|
||||
ansible.posix.authorized_key:
|
||||
user: max
|
||||
state: present
|
||||
key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
|
||||
|
||||
- name: Copy omz installation wrapper script to the target machine
|
||||
remote_user: ansible
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/install_omz.sh"
|
||||
dest: /home/max/install_omz.sh
|
||||
owner: max
|
||||
group: max
|
||||
mode: u=rwx,g=r,o-rwx
|
||||
|
||||
# WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
|
||||
- name: Install oh my zsh
|
||||
remote_user: max
|
||||
become: false
|
||||
ansible.builtin.command: /home/max/install_omz.sh
|
||||
changed_when: true
|
||||
|
||||
- name: Configure oh my zsh, by pushing the config file
|
||||
remote_user: ansible
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/.zshrc"
|
||||
dest: /home/max/.zshrc
|
||||
owner: max
|
||||
group: max
|
||||
mode: u=rw,g=r,o-rwx
|
||||
|
||||
- name: Configure vim, by pushing the config
|
||||
remote_user: ansible
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/.vimrc"
|
||||
dest: /home/max/.vimrc
|
||||
owner: max
|
||||
group: max
|
||||
mode: u=rw,g=r,o-rwx
|
||||
|
||||
|
||||
# WARNING: we've finished with the initial setup, drop ansible key
|
||||
# Push regular user key
|
||||
- name: Set authorized key taken from file
|
||||
remote_user: ansible
|
||||
ansible.posix.authorized_key:
|
||||
user: max
|
||||
state: absent
|
||||
key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
|
||||
|
||||
- name: Set authorized key taken from file
|
||||
remote_user: ansible
|
||||
ansible.posix.authorized_key:
|
||||
user: max
|
||||
state: present
|
||||
key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
|
||||
- name: Configure ssh-server daemon
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/hardened_sshd.conf"
|
||||
dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
|
||||
mode: u=rw,g=r,o=r
|
||||
when: ansible_facts['distribution'] == 'Ubuntu'
|
||||
|
||||
- name: Configure ssh-server daemon
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/hardened_sshd.conf"
|
||||
dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
|
||||
mode: u=rw,g=r,o=r
|
||||
when: ansible_facts['distribution'] == 'Debian'
|
||||
|
||||
- name: Configure ssh client
|
||||
remote_user: ansible
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/hardened_ssh.conf"
|
||||
dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
|
||||
mode: u=rw,g=r,o=r
|
||||
|
||||
- name: Restart ssh-server Debian
|
||||
remote_user: ansible
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
when: ansible_facts['distribution'] == 'Debian'
|
||||
|
||||
- name: Restart ssh-server Ubuntu
|
||||
remote_user: ansible
|
||||
ansible.builtin.service:
|
||||
name: ssh
|
||||
state: restarted
|
||||
when: ansible_facts['distribution'] == 'Ubuntu'
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
- name: Installing basic utils for comfort work (apt-based system)
|
||||
when: (ansible_facts['distribution'] == "Debian") or
|
||||
(ansible_facts['distribution'] == "Ubuntu")
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- vim
|
||||
- ranger
|
||||
- zsh
|
||||
- rsync
|
||||
- git
|
||||
- curl
|
||||
- kitty
|
||||
- unattended-upgrades
|
||||
- ssh
|
||||
- openssh-server
|
||||
update-cache: true # Run apt update before installation
|
||||
become: true
|
||||
remote_user: ansible
|
||||
|
||||
- name: Install qemu-guest-agent on VM
|
||||
when:
|
||||
- ansible_facts['os_family'] == "Debian"
|
||||
- ansible_facts['virtualization_type'] == "kvm"
|
||||
ansible.builtin.apt:
|
||||
name: qemu-guest-agent
|
||||
state: present
|
||||
update-cache: true # Run apt update before installation
|
||||
become: true
|
||||
remote_user: ansible
|
||||
tags:
|
||||
- kvm-guests
|
||||
- packages
|
||||
|
||||
|
||||
# The same commands for Alpine
|
||||
- name: Update and install packages on Alpine
|
||||
when: (ansible_facts['distribution'] == "Alpine")
|
||||
community.general.apk:
|
||||
name: vim ranger zsh rsync git curl kitty openssh
|
||||
update_cache: true
|
||||
remote_user: ansible
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
- name: Create and set up Ansible user and environment
|
||||
ansible.builtin.include_tasks: prepare_ansible_user.yaml
|
||||
|
||||
- name: Improve SSH configuration
|
||||
ansible.builtin.include_tasks: harden_ssh.yaml
|
||||
|
||||
- name: Install basic utils
|
||||
ansible.builtin.include_tasks: install_basic_utils.yaml
|
||||
|
||||
- name: Remove unnecessary packages
|
||||
ansible.builtin.include_tasks: remove_packages.yaml
|
||||
|
||||
- name: Create and set up a new user
|
||||
ansible.builtin.include_tasks: create_new_user.yaml
|
||||
|
||||
- name: Set locale and time
|
||||
ansible.builtin.include_tasks: set_locale_and_time.yaml
|
||||
+10
-10
@@ -3,18 +3,18 @@
|
||||
- name: Install sudo on apt systems
|
||||
when: (ansible_facts['distribution'] == "Debian") or
|
||||
(ansible_facts['distribution'] == "Ubuntu")
|
||||
apt:
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- sudo
|
||||
update-cache: yes
|
||||
update-cache: true
|
||||
|
||||
- name: Update Alpine packages
|
||||
# The same commands for Alpine
|
||||
- name: Update and install packages on Alpine
|
||||
when: (ansible_facts['distribution'] == "Alpine")
|
||||
command: /sbin/apk update
|
||||
|
||||
- name: Install sudo package on Alpine
|
||||
when: (ansible_facts['distribution'] == "Alpine")
|
||||
command: /sbin/apk add sudo
|
||||
community.general.apk:
|
||||
name: sudo
|
||||
update_cache: true
|
||||
remote_user: ansible
|
||||
|
||||
|
||||
## Creating and setting up the ansible user
|
||||
@@ -26,12 +26,12 @@
|
||||
|
||||
## Add the user to sshusers (for ssh access) and sudo (gain root access)
|
||||
- name: Create a new user with a password for Ansible
|
||||
user:
|
||||
ansible.builtin.user:
|
||||
name: ansible
|
||||
password: "{{ ansible_user_passwd_hash }}"
|
||||
|
||||
groups: sshusers,sudo
|
||||
append: yes
|
||||
append: true
|
||||
|
||||
## Since password authentication in SSH will be disabled, we need to add an authorized key
|
||||
- name: Set authorized key taken from file
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
# Remove multiple packages at once
|
||||
- name: Remove unnecessary packages
|
||||
remote_user: ansible
|
||||
when: (ansible_facts['distribution'] == "Debian") or
|
||||
(ansible_facts['distribution'] == "Ubuntu")
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- nano
|
||||
state: absent
|
||||
become: true
|
||||
|
||||
|
||||
# Clean up all orphaned packages
|
||||
- name: Remove all orphaned dependencies
|
||||
remote_user: ansible
|
||||
when: (ansible_facts['distribution'] == "Debian") or
|
||||
(ansible_facts['distribution'] == "Ubuntu")
|
||||
ansible.builtin.apt:
|
||||
autoremove: true
|
||||
purge: true
|
||||
|
||||
|
||||
- name: Install sudo package on Alpine
|
||||
remote_user: ansible
|
||||
when: (ansible_facts['distribution'] == "Alpine")
|
||||
community.general.apk:
|
||||
name:
|
||||
- nano
|
||||
state: absent
|
||||
become: true
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
- name: Generate locales
|
||||
community.general.locale_gen:
|
||||
name:
|
||||
- en_US.UTF-8
|
||||
- ru_RU.UTF-8
|
||||
state: present
|
||||
|
||||
- name: Set locale
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/locale.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
LANG=en_US.UTF-8
|
||||
LC_ALL=en_US.UTF-8
|
||||
|
||||
- name: Set time
|
||||
community.general.timezone:
|
||||
name: Europe/Samara
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
|
||||
- name: Create new container with minimal options defining network interface with static ip
|
||||
become: false
|
||||
community.proxmox.proxmox:
|
||||
validate_certs: false
|
||||
node: proxmox-server
|
||||
api_user: root@pam
|
||||
api_host: 192.168.0.2
|
||||
api_token_id: ansible
|
||||
api_token_secret: "{{ proxmox_token_secret }}"
|
||||
|
||||
cmode: "shell"
|
||||
vmid: 1040
|
||||
password: ansible-test
|
||||
hostname: "ansible-test"
|
||||
# ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst'
|
||||
ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
|
||||
memory: 2048
|
||||
cores: 5
|
||||
state: present
|
||||
disk_volume:
|
||||
size: 2 # 2GB rootfs
|
||||
storage: local
|
||||
pubkey: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
|
||||
netif:
|
||||
net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0"
|
||||
|
||||
- name: Make sure the container has started
|
||||
become: false
|
||||
community.proxmox.proxmox:
|
||||
validate_certs: false
|
||||
node: proxmox-server
|
||||
api_user: root@pam
|
||||
api_host: 192.168.0.2
|
||||
api_token_id: ansible
|
||||
api_token_secret: "{{ proxmox_token_secret }}"
|
||||
|
||||
vmid: 1040
|
||||
state: started
|
||||
|
||||
- name: Sleep for a minute to ensure that ssh is ready
|
||||
become: false
|
||||
ansible.builtin.wait_for:
|
||||
timeout: 60
|
||||
delegate_to: localhost
|
||||
changed_when: false
|
||||
@@ -0,0 +1,53 @@
|
||||
---
|
||||
- name: Create a new VM with minimal options
|
||||
become: false
|
||||
community.proxmox.proxmox_kvm:
|
||||
validate_certs: false
|
||||
node: proxmox-server
|
||||
api_user: root@pam
|
||||
api_host: 192.168.0.2
|
||||
api_token_id: ansible
|
||||
api_token_secret: "{{ proxmox_token_secret }}"
|
||||
|
||||
clone: debian-13-cloud-init-template
|
||||
newid: 1041
|
||||
name: ansible-ci-test
|
||||
storage: main
|
||||
format: qcow2
|
||||
full: true
|
||||
timeout: 500
|
||||
|
||||
- name: Tweak the hardware settings
|
||||
become: false
|
||||
community.proxmox.proxmox_kvm:
|
||||
validate_certs: false
|
||||
node: proxmox-server
|
||||
api_user: root@pam
|
||||
api_host: 192.168.0.2
|
||||
api_token_id: ansible
|
||||
api_token_secret: "{{ proxmox_token_secret }}"
|
||||
|
||||
vmid: 1041
|
||||
cores: 4
|
||||
memory: 4096 # Minimal value for debian based OS for smooth workflow
|
||||
update: true
|
||||
|
||||
- name: Make sure the VM has started
|
||||
become: false
|
||||
community.proxmox.proxmox_kvm:
|
||||
validate_certs: false
|
||||
node: proxmox-server
|
||||
api_user: root@pam
|
||||
api_host: 192.168.0.2
|
||||
api_token_id: ansible
|
||||
api_token_secret: "{{ proxmox_token_secret }}"
|
||||
|
||||
vmid: 1041
|
||||
state: started
|
||||
|
||||
- name: Sleep for 3 minutes to ensure that cloud-init's done its thing
|
||||
become: false
|
||||
ansible.builtin.wait_for:
|
||||
timeout: 180
|
||||
delegate_to: localhost
|
||||
changed_when: false
|
||||
@@ -0,0 +1,31 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFRTCCAy2gAwIBAgIUEYfbZs1nFB1sEyTb/W2AcKn9whwwDQYJKoZIhvcNAQEL
|
||||
BQAwMTEQMA4GA1UEAwwHaG9tZS5jYTELMAkGA1UEBhMCUlUxEDAOBgNVBAcMB25v
|
||||
d2hlcmUwIBcNMjYwMjAzMTg0NTA3WhgPMjA1MzA2MjAxODQ1MDdaMDExEDAOBgNV
|
||||
BAMMB2hvbWUuY2ExCzAJBgNVBAYTAlJVMRAwDgYDVQQHDAdub3doZXJlMIICIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhZJPmln1+iZ5b35U1KBPxGdfd2ra
|
||||
V55vzjBA+9EeVJ7SgHqwvE6T7uXc/ZOpum/TiGAeU1bBtqilCwxXLLiL4Mkn6p1m
|
||||
/ePosqE4lb7vMaZmAwxTcjmvekqnrcme+V1DSY5PtQljp+YBn/npOCHWe3WHNppc
|
||||
3dUW6Y06hWk26C5xq4xdcIbs5LohMcJmMYI1kcaJPtys7RyW13Wy5dH8wF4Efdco
|
||||
J4CU0yWBhF0Ys56YPbkWu1u2DqrFRiJr53LfJ90P88R4sSeBtLZVvEzWj+kWZEfJ
|
||||
Oke7B1jXVJ40yBJ+brGQoFsD9o2x9JyNXHOUVcx1XH3a+NUFVKMJRCYPa5uaxq9h
|
||||
B2gCBD4rBlOADchwSdNk1oGmtDg8xs3fcLxUqsO2jVA2T7w9iP4arvzqHuIWwVss
|
||||
WdtcyQ/x8tjVC6cp8I8WH5CV8iWptH9exGnKbVjAWEkL6xbT7f09WDAheaXY1b59
|
||||
Opuw9KAGIvqj4NCPpdd7zwDivNFJWYfz7SkEiM9I6NMDP9BoYBVMIyxJR83NOgl0
|
||||
0gUPoEFT81k5w8k4S7kqa7YdMj3PLxGowIQb9xoQuXyAFtPhbXbHn/igKx62H/Lq
|
||||
IOBvm55+GOaSnWAlVoze6rE+qCRWr6fS4bTcGEDb8INHPriwxX+YehqxLdqcGRLG
|
||||
n8fd6ldOvS/BfXkCAwEAAaNTMFEwHQYDVR0OBBYEFBehubXS/4xlJz1AA6iVi2HA
|
||||
HPfFMB8GA1UdIwQYMBaAFBehubXS/4xlJz1AA6iVi2HAHPfFMA8GA1UdEwEB/wQF
|
||||
MAMBAf8wDQYJKoZIhvcNAQELBQADggIBACH/M9xbPuKmluznwtwofLod+4w5nTtU
|
||||
bFpGmqSRNRjnL4j0aL+Gr/lcD2tGQXf01dOVdSbBjmBmW1p/2trVdVPxTLTaIhCw
|
||||
Q8QuVmQJUkwnG1uv7W9Of9akJ4TadPKc5GfzYJJ+e71Z8sFXxFqfr0nF1fPdpPp8
|
||||
xkKsIwZopcjqLEzJydGOcHUbDWvR2fkG01DjgSevP34ZJQBm/bSAwlSs6b1119jw
|
||||
ofQD462YLtXfavSz/MzRNNgCZlEAGVNt42CDOES6aZvOIt1pCKo8hIhptKgU4GpQ
|
||||
vTE0kdekJWTUNQzbfWSF42FwllxVa4LJYXzmW7Jf30Q5xCZICH1Ofdk3qLK/B7tf
|
||||
Fo/bNP3aLU4qBWShmCzYAyW4LPKL6AfODL5X45nESQDoAlfcdfeSXrbdG7P0NAcN
|
||||
g4nROb5NNy/CgLNq2zDnq/JKdW3xvvNKT2FsNvOf3+9a99gB/L2dt8nX5SSLiWlN
|
||||
50ynzOK21Z/YHCXutLiK2ugQf9dqj2rw7/C9oktoyvqwoVILhcsA0mhpN4343zI4
|
||||
PK2/zIjd0nZWaZLpJCj0yREnhhqgV3Par9d5biRfgFUuIoBnXIh4fr75xdkxqECX
|
||||
pKu2rt3D0YGkPsP5lausvPbUy4nYcT1UkMwtdi0JZLNx04m22ZTzXpATo96LoWob
|
||||
9eRPR6uW/Kmp
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
- name: Internet connection test block
|
||||
block:
|
||||
- name: Test reachability to ya.ru
|
||||
become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine
|
||||
ansible.builtin.shell: ping -c 5 ya.ru > /dev/null
|
||||
changed_when: false # This task does not change the system
|
||||
|
||||
rescue:
|
||||
# This won't work for now. CA certificate reissuing is required!
|
||||
- name: Create a test file
|
||||
become: false
|
||||
ansible.builtin.uri:
|
||||
url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}"
|
||||
ca_path: ../files/ca.pem
|
||||
delegate_to: 127.0.0.1
|
||||
# TODO: REMOVE THIS AFTER REISSUING CA CERTIFICATE!
|
||||
failed_when: false
|
||||
|
||||
- name: Disk free space test block
|
||||
block:
|
||||
- name: Test free disk space in root
|
||||
become: false
|
||||
ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
|
||||
register: common_healthcheck_result
|
||||
failed_when: common_healthcheck_result.stdout | int > 85
|
||||
changed_when: false # This task does not change the system
|
||||
|
||||
rescue:
|
||||
- name: Notify with ntfy
|
||||
become: false
|
||||
ansible.builtin.uri:
|
||||
url: "{{ ntfy_topic }}"
|
||||
method: POST
|
||||
body_format: json
|
||||
status_code: [200, 202]
|
||||
return_content: true
|
||||
headers:
|
||||
Authorization: "Bearer {{ ntfy_topic_token }}"
|
||||
body:
|
||||
- "{{ ansible_facts['hostname'] }}: Disk space is low"
|
||||
delegate_to: 127.0.0.1
|
||||
failed_when: false
|
||||
changed_when: false # This task does not change the system
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
#!/bin/sh
|
||||
ansible-playbook -i inventory/hosts.yaml playbooks/deploy.yaml \
|
||||
ansible-playbook -i inventory/hosts.yaml $1 \
|
||||
--private-key inventory/group_vars/secret/ansible_key \
|
||||
--vault-password-file inventory/group_vars/secret/.vault_pass
|
||||
@@ -0,0 +1,19 @@
|
||||
[Unit]
|
||||
Description=Run Ansible playbook for daily maintenance
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
# CAHNGE TO MATCH YOUR REQUIREMENTS
|
||||
User=max
|
||||
Group=max
|
||||
WorkingDirectory=/home/max/projects/ansible_home
|
||||
ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
# Optional: prevent runaway if the playbook hangs
|
||||
TimeoutStopSec=3600
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,11 @@
|
||||
[Unit]
|
||||
Description=Timer for Ansible maintenance playbook, runs every 10 minutes
|
||||
Requires=ansible-maintenance.service
|
||||
|
||||
[Timer]
|
||||
OnUnitActiveSec=10min
|
||||
Persistent=true
|
||||
Unit=ansible-maintenance.service
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
Reference in New Issue
Block a user