diff --git a/inventory/group_vars/all/main.yaml b/inventory/group_vars/all/main.yaml index a1632cc..8e4ba15 100644 --- a/inventory/group_vars/all/main.yaml +++ b/inventory/group_vars/all/main.yaml @@ -1,3 +1,3 @@ --- -ansible_become_passwd: "{{ ansible_password }}" \ No newline at end of file +ansible_become_passwd: "{{ ansible_password }}" diff --git a/inventory/group_vars/all/secrets template.yaml b/inventory/group_vars/all/secrets template.yaml index a36dbc8..5fb266d 100644 --- a/inventory/group_vars/all/secrets template.yaml +++ b/inventory/group_vars/all/secrets template.yaml @@ -12,4 +12,4 @@ ntfy_topic_token: t0ken # Home Assistant Webhook token ha_webhook_token: h@_t0ken # Proxmox API token secret -proxmox_token_secret: t0ken_$ecret \ No newline at end of file +proxmox_token_secret: t0ken_$ecret diff --git a/roles/basic_postinstall/tasks/create_new_user.yaml b/roles/basic_postinstall/tasks/create_new_user.yaml index e86d789..8ba891b 100644 --- a/roles/basic_postinstall/tasks/create_new_user.yaml +++ b/roles/basic_postinstall/tasks/create_new_user.yaml @@ -1,7 +1,7 @@ --- - name: Create a new user with a password, set shell remote_user: ansible - user: + ansible.builtin.user: name: max groups: sshusers,sudo password: "{{ user_passwd_hash }}" @@ -12,12 +12,12 @@ ansible.posix.authorized_key: user: max state: present - key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}" - name: Copy omz installation wrapper script to the target machine remote_user: ansible - copy: - src: ../files/install_omz.sh + ansible.builtin.copy: + src: "{{ role_path }}/files/install_omz.sh" dest: /home/max/install_omz.sh owner: max group: max @@ -26,13 +26,14 @@ # WARNING: UNPRIVILEGED USER (not ansible) COMMANDS - name: Install oh my zsh remote_user: max - become: no - command: /home/max/install_omz.sh + become: false + ansible.builtin.command: /home/max/install_omz.sh + changed_when: true - name: Configure oh my zsh, by pushing the config file remote_user: ansible - copy: - src: ../files/.zshrc + ansible.builtin.copy: + src: "{{ role_path }}/files/.zshrc" dest: /home/max/.zshrc owner: max group: max @@ -40,8 +41,8 @@ - name: Configure vim, by pushing the config remote_user: ansible - copy: - src: ../files/.vimrc + ansible.builtin.copy: + src: "{{ role_path }}/files/.vimrc" dest: /home/max/.vimrc owner: max group: max @@ -55,11 +56,11 @@ ansible.posix.authorized_key: user: max state: absent - key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}" - name: Set authorized key taken from file remote_user: ansible ansible.posix.authorized_key: user: max state: present - key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/max_regular_key.pub') }}" + key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}" diff --git a/roles/basic_postinstall/tasks/main.yaml b/roles/basic_postinstall/tasks/main.yaml index 5114da1..b886049 100644 --- a/roles/basic_postinstall/tasks/main.yaml +++ b/roles/basic_postinstall/tasks/main.yaml @@ -15,4 +15,4 @@ ansible.builtin.include_tasks: create_new_user.yaml - name: Set locale and time - ansible.builtin.include_tasks: set_locale_and_time.yaml \ No newline at end of file + ansible.builtin.include_tasks: set_locale_and_time.yaml diff --git a/roles/basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml index b44f405..2097ae9 100644 --- a/roles/basic_postinstall/tasks/prepare_ansible_user.yaml +++ b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml @@ -1,20 +1,20 @@ --- ## Installing packages - name: Install sudo on apt systems - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: + ansible.builtin.apt: name: - sudo - update-cache: yes + update-cache: true -- name: Update Alpine packages +# The same commands for Alpine +- name: Update and install packages on Alpine when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk update - -- name: Install sudo package on Alpine - when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk add sudo + community.general.apk: + name: sudo + update_cache: true + remote_user: ansible ## Creating and setting up the ansible user @@ -26,16 +26,16 @@ ## Add the user to sshusers (for ssh access) and sudo (gain root access) - name: Create a new user with a password for Ansible - user: + ansible.builtin.user: name: ansible password: "{{ ansible_user_passwd_hash }}" groups: sshusers,sudo - append: yes + append: true -## Since password authentication in SSH will be disabled, we need to add an authorized key +## Since password authentication in SSH will be disabled, we need to add an authorized key - name: Set authorized key taken from file ansible.posix.authorized_key: user: ansible state: present - key: "{{ ansible_ssh_key }}" \ No newline at end of file + key: "{{ ansible_ssh_key }}" diff --git a/roles/basic_postinstall/tasks/remove_packages.yaml b/roles/basic_postinstall/tasks/remove_packages.yaml index ac5835e..c0116fd 100644 --- a/roles/basic_postinstall/tasks/remove_packages.yaml +++ b/roles/basic_postinstall/tasks/remove_packages.yaml @@ -2,26 +2,30 @@ # Remove multiple packages at once - name: Remove unnecessary packages remote_user: ansible - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: + ansible.builtin.apt: name: - nano state: absent - become: yes + become: true # Clean up all orphaned packages - name: Remove all orphaned dependencies remote_user: ansible - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: - autoremove: yes - purge: yes + ansible.builtin.apt: + autoremove: true + purge: true - name: Install sudo package on Alpine remote_user: ansible when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk del nano + community.general.apk: + name: + - nano + state: absent + become: true diff --git a/roles/basic_postinstall/tasks/set_locale_and_time.yaml b/roles/basic_postinstall/tasks/set_locale_and_time.yaml index cffbf2e..37eb4f6 100644 --- a/roles/basic_postinstall/tasks/set_locale_and_time.yaml +++ b/roles/basic_postinstall/tasks/set_locale_and_time.yaml @@ -1,9 +1,9 @@ --- - name: Generate locales - ansible.builtin.locale_gen: + community.general.locale_gen: name: - - en_US.UTF-8 - - ru_RU.UTF-8 + - en_US.UTF-8 + - ru_RU.UTF-8 state: present - name: Set locale @@ -15,5 +15,5 @@ LC_ALL=en_US.UTF-8 - name: Set time - ansible.builtin.timezone: - name: Europe/Samara \ No newline at end of file + community.general.timezone: + name: Europe/Samara diff --git a/roles/common_healthcheck/tasks/main.yaml b/roles/common_healthcheck/tasks/main.yaml index 826a285..e06a136 100644 --- a/roles/common_healthcheck/tasks/main.yaml +++ b/roles/common_healthcheck/tasks/main.yaml @@ -2,14 +2,14 @@ - name: Internet connection test block block: - name: Test reachability to ya.ru - become: yes # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine - shell: ping -c 5 ya.ru > /dev/null + become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine + ansible.builtin.shell: ping -c 5 ya.ru > /dev/null changed_when: false # This task does not change the system - + rescue: - # This won't work for now. CA certificate reissuing is required!git + # This won't work for now. CA certificate reissuing is required! - name: Create a test file - become: no + become: false ansible.builtin.uri: url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}" ca_path: ../files/ca.pem @@ -20,19 +20,25 @@ - name: Disk free space test block block: - name: Test free disk space in root - become: no - shell: df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' - register: result - failed_when: result.stdout | int > 85 + become: false + ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' + register: common_healthcheck_result + failed_when: common_healthcheck_result.stdout | int > 1 changed_when: false # This task does not change the system - + rescue: - name: Notify with ntfy - become: no - ansible.builtin.command: | - curl -H "Authorization: Bearer {{ ntfy_topic_token }}" \ - -d "{{ ansible_facts['hostname'] }}: Disk space is low" \ - {{ ntfy_topic }} - delegate_to: 127.0.0.1 - failed_when: false + become: false + ansible.builtin.uri: + url: "{{ ntfy_topic }}" + method: POST + body_format: json + status_code: [200, 202] + return_content: true + headers: + Authorization: "Bearer {{ ntfy_topic_token }}" + body: + - "{{ ansible_facts['hostname'] }}: Disk space is low" + delegate_to: 127.0.0.1 + failed_when: false changed_when: false # This task does not change the system