evolix/ansible-roles
22
2
Fork 2
Code Issues 61 Pull requests 19 Releases 33 Wiki Activity

evolinux-base: add conditions for most of tasks

Browse source
This commit is contained in:
Jérémy Lecour 2017-01-03 16:37:23 +01:00 committed by Jérémy Lecour
parent 475ccf3bd1
commit 130e1f2b0e
14 changed files with 183 additions and 98 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
evolinux-base/README.md
View file

@ -19,11 +19,11 @@ Various tasks for Evolinux setup.
* `provider_online` : * `provider_online` :
* `provider_orange_fce` : * `provider_orange_fce` :
Each task file is included in the `main.yml` file with a condition based on a variable like `evolinux_tasks_hostname` (mostly `True` by default). The variables can be set to `False` to disable groups of tasks. Finer grained tasks disabling is done in each group of tasks.
## Available variables ## Available variables
Main variables are : Each tasks group is included in the `main.yml` file with a condition based on a variable like `evolinux_hostname_include` (mostly `True` by default). The variables can be set to `False` to disable a . Finer grained tasks disabling is done in each group of tasks.
Main variables are:
* `general_alert_email`: email address to send various alert messages (default: `root@localhost`). * `general_alert_email`: email address to send various alert messages (default: `root@localhost`).
* `apt_alert_email`: email address to send APT messages to (default: `general_alert_email`). * `apt_alert_email`: email address to send APT messages to (default: `general_alert_email`).

97
evolinux-base/defaults/main.yml
View file

@ -11,7 +11,10 @@ postfix_alias_email: Null
# hostname # hostname
evolinux_tasks_hostname: True evolinux_hostname_include: True
evolinux_hostname_hosts: True
evolinux_hostname_mailname: True
evolinux_hostname: "{{ ansible_hostname }}" evolinux_hostname: "{{ ansible_hostname }}"
evolinux_domain: "{{ ansible_domain }}" evolinux_domain: "{{ ansible_domain }}"
@ -20,7 +23,7 @@ evolinux_internal_hostname: "{{ evolinux_hostname }}"
# kernel # kernel
evolinux_tasks_kernel: True evolinux_kernel_include: True
evolinux_kernel_reboot_after_panic: True evolinux_kernel_reboot_after_panic: True
evolinux_kernel_disable_tcp_timestamps: True evolinux_kernel_disable_tcp_timestamps: True
@ -29,65 +32,115 @@ evolinux_kernel_cve20165696: True
# apt # apt
evolinux_tasks_apt: True evolinux_apt_include: True
evolinux_apt_upgrade: True evolinux_apt_conf: True
evolinux_apt_repositories_components: "main"
evolinux_apt_hooks: True evolinux_apt_hooks: True
evolinux_apt_disable_originals: True
evolinux_apt_disable_debsrc: True
evolinux_apt_basic_sources: True
evolinux_apt_public_sources: True
evolinux_apt_upgrade: True
evolinux_apt_remove_aptitude: True evolinux_apt_remove_aptitude: True
evolinux_apt_repositories_components: "main"
# fstab # fstab
evolinux_tasks_fstab: True evolinux_fstab_include: True
evolinux_fstab_var_tmp: True
# packages # packages
evolinux_tasks_packages: True evolinux_packages_include: True
evolinux_delete_nfs: True evolinux_packages_system: True
evolinux_packages_diagnostic: True
evolinux_packages_hardware: True
evolinux_packages_common: True
evolinux_packages_serveur_base: True
evolinux_packages_invalid_mta: True
evolinux_packages_delete_nfs: True
evolinux_packages_listchanges: True
# system # system
evolinux_tasks_system: True evolinux_system_include: True
evolinux_ntp_server: Null evolinux_system_chmod_tmp: True
evolinux_timezone: "Europe/Paris" evolinux_system_locales: True
evolinux_system_timezone: "Europe/Paris"
evolinux_system_vim_default: True
evolinux_system_profile: True
evolinux_system_dirmode_adduser: True
evolinux_system_alert5_init: True
evolinux_system_alert5_enable: True
evolinux_system_eni_auto: True
evolinux_system_ntp_server: False
# root # root
evolinux_tasks_root: True evolinux_root_include: True
evolinux_root_chmod: True
evolinux_root_bashrc: True
evolinux_root_bash_history: True
evolinux_root_umask: True
evolinux_root_gitconfig: True
evolinux_root_bash_history_appendonly: True
evolinux_root_vim_default: True
evolinux_root_vim_conf: True
# ssh # ssh
evolinux_tasks_ssh: True evolinux_ssh_include: True
evolinux_ssh_password_auth_addresses: [] evolinux_ssh_password_auth_addresses: []
evolinux_ssh_match_address: True
evolinux_ssh_disable_root: True evolinux_ssh_disable_root: True
evolinux_ssh_disable_acceptenv: True
# postfix # postfix
evolinux_tasks_postfix: True evolinux_postfix_include: True
evolinux_postfix_packages: True
evolinux_postfix_users_alias_root: True
evolinux_postfix_mailer_alias_root: True
evolinux_postfix_root_alias: True
evolinux_postfix_purge_exim: True evolinux_postfix_purge_exim: True
# logs # logs
evolinux_tasks_logs: True evolinux_logs_include: True
evolinux_logs_logrotate_confs: True
evolinux_logs_default_rotate: True
evolinux_logs_disable_logrotate_rsyslog: True
evolinux_logs_rsyslog_conf: True
# default www # default www
evolinux_tasks_default_www: True evolinux_default_www_include: True
evolinux_default_www_files: True
evolinux_default_www_ssl_cert: True
evolinux_default_www_ssl_subject: "/CN={{ ansible_fqdn }}"
evolinux_default_www_nginx_vhost: True
evolinux_default_www_nginx_enabled: False
evolinux_default_www_apache_vhost: True
evolinux_default_www_apache_enabled: False
evolinux_default_www_redirect_url: "http://evolix.fr" evolinux_default_www_redirect_url: "http://evolix.fr"
evolinux_default_www_ssl_subject: "/CN={{ ansible_fqdn }}"
evolinux_default_www_nginx_enabled: False
evolinux_default_www_apache_enabled: False
# hardware # hardware
evolinux_tasks_hardware: True evolinux_hardware_include: True
# providers # providers
evolinux_tasks_provider_online: False evolinux_provider_online_include: False
evolinux_tasks_provider_orange_fce: False evolinux_provider_orange_fce_include: False

0
evolinux-base/templates/apt/evolix_public.list.j2 → evolinux-base/files/apt/evolix_public.list
View file

9
evolinux-base/tasks/apt.yml
View file

@ -10,6 +10,7 @@
with_items: with_items:
- "APT::Install-Recommends \"0\";" - "APT::Install-Recommends \"0\";"
- "APT::Install-Suggests \"0\";" - "APT::Install-Suggests \"0\";"
when: evolinux_apt_conf
- name: DPKg invoke hooks - name: DPKg invoke hooks
lineinfile: lineinfile:
@ -31,12 +32,14 @@
with_items: with_items:
# - '.+\.debian\.org' # - '.+\.debian\.org'
- 'cdrom:' - 'cdrom:'
when: evolinux_apt_disable_originals
- name: deb-src repositories are disabled - name: deb-src repositories are disabled
replace: replace:
dest: /etc/apt/sources.list dest: /etc/apt/sources.list
regexp: '^(deb-src.+)' regexp: '^(deb-src.+)'
replace: '# \1' replace: '# \1'
when: evolinux_apt_disable_debsrc
- name: Basic sources list is installed - name: Basic sources list is installed
lineinfile: lineinfile:
@ -46,14 +49,16 @@
- "deb http://security.debian.org/ jessie/updates {{ evolinux_apt_repositories_components | mandatory }}" - "deb http://security.debian.org/ jessie/updates {{ evolinux_apt_repositories_components | mandatory }}"
- "deb http://mirror.evolix.org/debian/ jessie {{ evolinux_apt_repositories_components | mandatory }}" - "deb http://mirror.evolix.org/debian/ jessie {{ evolinux_apt_repositories_components | mandatory }}"
- "deb http://mirror.evolix.org/debian/ jessie-updates {{ evolinux_apt_repositories_components | mandatory }}" - "deb http://mirror.evolix.org/debian/ jessie-updates {{ evolinux_apt_repositories_components | mandatory }}"
when: evolinux_apt_basic_sources
- name: Evolix public list is installed - name: Evolix public list is installed
template: copy:
src: apt/evolix_public.list.j2 src: apt/evolix_public.list
dest: /etc/apt/sources.list.d/evolix_public.list dest: /etc/apt/sources.list.d/evolix_public.list
force: yes force: yes
backup: yes backup: yes
mode: 0640 mode: 0640
when: evolinux_apt_public_sources
- name: Remove Aptitude - name: Remove Aptitude
apt: apt:

56
evolinux-base/tasks/default_www.yml
View file

@ -4,6 +4,7 @@
path: /var/www path: /var/www
state: directory state: directory
mode: 0755 mode: 0755
when: evolinux_default_www_files
- name: images are copied - name: images are copied
copy: copy:
@ -12,37 +13,40 @@
mode: 0755 mode: 0755
directory_mode: 0755 directory_mode: 0755
follow: yes follow: yes
when: evolinux_default_www_files
- name: index is copied - name: index is copied
template: template:
src: default_www/index.html.j2 src: default_www/index.html.j2
dest: /var/www/index.html dest: /var/www/index.html
mode: 0755 mode: 0755
when: evolinux_default_www_files
# SSL cert # SSL cert
- name: ssl-cert package is installed - block:
apt: - name: ssl-cert package is installed
name: ssl-cert apt:
state: installed name: ssl-cert
state: installed
- name: Create private key and csr for default site ({{ ansible_fqdn }}) - name: Create private key and csr for default site ({{ ansible_fqdn }})
command: openssl req -newkey rsa:2048 -sha256 -nodes -keyout /etc/ssl/private/{{ ansible_fqdn }}.key -out /etc/ssl/{{ ansible_fqdn }}.csr -batch -subj "{{ evolinux_default_www_ssl_subject }}" command: openssl req -newkey rsa:2048 -sha256 -nodes -keyout /etc/ssl/private/{{ ansible_fqdn }}.key -out /etc/ssl/{{ ansible_fqdn }}.csr -batch -subj "{{ evolinux_default_www_ssl_subject }}"
args: args:
creates: "/etc/ssl/private/{{ ansible_fqdn }}.key" creates: "/etc/ssl/private/{{ ansible_fqdn }}.key"
- name: Adjust rights on private key - name: Adjust rights on private key
file: file:
path: /etc/ssl/private/{{ ansible_fqdn }}.key path: /etc/ssl/private/{{ ansible_fqdn }}.key
owner: root owner: root
group: ssl-cert group: ssl-cert
mode: 0640 mode: 0640
- name: Create certificate for default site
command: openssl x509 -req -days 3650 -sha256 -in /etc/ssl/{{ ansible_fqdn }}.csr -signkey /etc/ssl/private/{{ ansible_fqdn }}.key -out /etc/ssl/certs/{{ ansible_fqdn }}.crt
args:
creates: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
- name: Create certificate for default site
command: openssl x509 -req -days 3650 -sha256 -in /etc/ssl/{{ ansible_fqdn }}.csr -signkey /etc/ssl/private/{{ ansible_fqdn }}.key -out /etc/ssl/certs/{{ ansible_fqdn }}.crt
args:
creates: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
when: evolinux_default_www_ssl_cert
# Nginx vhost # Nginx vhost
@ -60,8 +64,7 @@
# force: yes # force: yes
notify: reload nginx notify: reload nginx
tags: tags:
- nginx - nginx
- name: nginx vhost is enabled - name: nginx vhost is enabled
file: file:
@ -71,9 +74,9 @@
notify: reload nginx notify: reload nginx
when: evolinux_default_www_nginx_enabled when: evolinux_default_www_nginx_enabled
tags: tags:
- nginx - nginx
when: nginx_sites_available.stat.exists when: evolinux_default_www_nginx_vhost and nginx_sites_available.stat.exists
# Apache vhost # Apache vhost
@ -92,8 +95,7 @@
# force: yes # force: yes
notify: reload apache notify: reload apache
tags: tags:
- apache - apache
- name: Apache vhost is enabled - name: Apache vhost is enabled
file: file:
@ -103,6 +105,6 @@
notify: reload apache notify: reload apache
when: evolinux_default_www_apache_enabled when: evolinux_default_www_apache_enabled
tags: tags:
- apache - apache
when: apache_sites_available.stat.exists when: evolinux_default_www_apache_vhost and apache_sites_available.stat.exists

1
evolinux-base/tasks/fstab.yml
View file

@ -49,5 +49,6 @@
fstype: tmpfs fstype: tmpfs
opts: defaults,noexec,nosuid,nodev,size=1024m opts: defaults,noexec,nosuid,nodev,size=1024m
state: mounted state: mounted
when: evolinux_fstab_var_tmp
- meta: flush_handlers - meta: flush_handlers

12
evolinux-base/tasks/hostname.yml
View file

@ -8,6 +8,7 @@
dest: /etc/hosts dest: /etc/hosts
regexp: '^127.0.0.1(\s+)localhost.*$' regexp: '^127.0.0.1(\s+)localhost.*$'
replace: '127.0.0.1\1localhost.localdomain localhost' replace: '127.0.0.1\1localhost.localdomain localhost'
when: evolinux_hostname_hosts
- name: Set ip+fqdn+hostname in /etc/hosts - name: Set ip+fqdn+hostname in /etc/hosts
lineinfile: lineinfile:
@ -15,30 +16,35 @@
regexp: '^{{ ansible_default_ipv4.address }}\s+' regexp: '^{{ ansible_default_ipv4.address }}\s+'
line: "{{ ansible_default_ipv4.address }} {{ evolinux_fqdn }} {{ evolinux_hostname }}" line: "{{ ansible_default_ipv4.address }} {{ evolinux_fqdn }} {{ evolinux_hostname }}"
insertafter: '127.0.0.1\s+localhost.localdomain' insertafter: '127.0.0.1\s+localhost.localdomain'
when: evolinux_hostname_hosts
- name: 127.0.1.1 is removed - name: 127.0.1.1 is removed
lineinfile: lineinfile:
dest: /etc/hosts dest: /etc/hosts
regexp: '^127.0.1.1\s+' regexp: '^127.0.1.1\s+'
state: absent state: absent
when: evolinux_hostname_hosts
- name: /etc/mailname is up-to-date - name: /etc/mailname is up-to-date
copy: copy:
dest: /etc/mailname dest: /etc/mailname
content: "{{ evolinux_fqdn }}\n" content: "{{ evolinux_fqdn }}\n"
force: yes force: yes
when: evolinux_hostname_mailname
- name: override ansible_hostname fact # Override facts
- name: Override ansible_hostname fact
set_fact: set_fact:
ansible_hostname: "{{ evolinux_hostname }}" ansible_hostname: "{{ evolinux_hostname }}"
when: ansible_hostname != evolinux_hostname when: ansible_hostname != evolinux_hostname
- name: override ansible_domain fact - name: Override ansible_domain fact
set_fact: set_fact:
ansible_domain: "{{ evolinux_domain }}" ansible_domain: "{{ evolinux_domain }}"
when: ansible_domain != evolinux_domain when: ansible_domain != evolinux_domain
- name: override ansible_fqdn fact - name: Override ansible_fqdn fact
set_fact: set_fact:
ansible_fqdn: "{{ evolinux_fqdn }}" ansible_fqdn: "{{ evolinux_fqdn }}"
when: ansible_fqdn != evolinux_fqdn when: ansible_fqdn != evolinux_fqdn

4
evolinux-base/tasks/logs.yml
View file

@ -8,6 +8,7 @@
dest: /etc/rsyslog.conf dest: /etc/rsyslog.conf
mode: 0644 mode: 0644
notify: restart rsyslog notify: restart rsyslog
when: evolinux_logs_rsyslog_conf
- name: Disable logrotate default conf - name: Disable logrotate default conf
command: mv /etc/logrotate.d/rsyslog /etc/logrotate.d/rsyslog.disabled command: mv /etc/logrotate.d/rsyslog /etc/logrotate.d/rsyslog.disabled
@ -15,14 +16,17 @@
removes: /etc/logrotate.d/rsyslog removes: /etc/logrotate.d/rsyslog
creates: /etc/logrotate.d/rsyslog.disabled creates: /etc/logrotate.d/rsyslog.disabled
notify: restart rsyslog notify: restart rsyslog
when: evolinux_logs_disable_logrotate_rsyslog
- name: Copy many logrotate files - name: Copy many logrotate files
copy: copy:
src: logs/logrotate.d/ src: logs/logrotate.d/
dest: /etc/logrotate.d/ dest: /etc/logrotate.d/
when: evolinux_logs_logrotate_confs
- name: Configure logrotate.conf - name: Configure logrotate.conf
replace: replace:
dest: /etc/logrotate.conf dest: /etc/logrotate.conf
regexp: "rotate [0-9]*" regexp: "rotate [0-9]*"
replace: "rotate 12" replace: "rotate 12"
when: evolinux_logs_default_rotate

28
evolinux-base/tasks/main.yml
View file

@ -1,56 +1,56 @@
--- ---
- name: Hostname - name: Hostname
include: hostname.yml include: hostname.yml
when: evolinux_tasks_hostname when: evolinux_hostname_include
- name: Kernel tuning - name: Kernel tuning
include: kernel.yml include: kernel.yml
when: evolinux_tasks_kernel when: evolinux_kernel_include
- name: Apt configuration and packages install - name: Apt configuration and packages install
include: apt.yml include: apt.yml
when: evolinux_tasks_apt when: evolinux_apt_include
- name: Fstab configuration - name: Fstab configuration
include: fstab.yml include: fstab.yml
when: evolinux_tasks_fstab when: evolinux_fstab_include
- name: Packages - name: Packages
include: packages.yml include: packages.yml
when: evolinux_tasks_packages when: evolinux_packages_include
- name: System settings - name: System settings
include: system.yml include: system.yml
when: evolinux_tasks_system when: evolinux_system_include
- name: Root user configuration - name: Root user configuration
include: root.yml include: root.yml
when: evolinux_tasks_root when: evolinux_root_include
- name: SSH configuration - name: SSH configuration
include: ssh.yml include: ssh.yml
when: evolinux_tasks_ssh when: evolinux_ssh_include
- name: Postfix - name: Postfix
include: postfix.yml include: postfix.yml
when: evolinux_tasks_postfix when: evolinux_postfix_include
- name: Logs management - name: Logs management
include: logs.yml include: logs.yml
when: evolinux_tasks_logs when: evolinux_logs_include
- name: Default index page - name: Default index page
include: default_www.yml include: default_www.yml
when: evolinux_tasks_default_www when: evolinux_default_www_include
- name: Hardware drivers and tools - name: Hardware drivers and tools
include: hardware.yml include: hardware.yml
when: evolinux_tasks_hardware when: evolinux_hardware_include
- name: Customize for Online.net - name: Customize for Online.net
include: provider_online.yml include: provider_online.yml
when: evolinux_tasks_provider_online when: evolinux_provider_online_include
- name: Customize for Orange FCE - name: Customize for Orange FCE
include: provider_orange_fce.yml include: provider_orange_fce.yml
when: evolinux_tasks_provider_orange_fce when: evolinux_provider_orange_fce_include

12
evolinux-base/tasks/packages.yml
View file

@ -13,6 +13,7 @@
- pv - pv
- apg - apg
- conntrack - conntrack
when: evolinux_packages_system
- name: Install/Update diagnostic tools - name: Install/Update diagnostic tools
apt: apt:
@ -26,6 +27,7 @@
- iotop - iotop
- tcpdump - tcpdump
- mtr-tiny - mtr-tiny
when: evolinux_packages_diagnostic
- name: Install/Update hardware tools - name: Install/Update hardware tools
apt: apt:
@ -34,7 +36,7 @@
- hdparm - hdparm
- smartmontools - smartmontools
- lm-sensors - lm-sensors
when: evolinux_packages_hardware
- name: Install/Update common tools - name: Install/Update common tools
apt: apt:
@ -50,12 +52,13 @@
- rsync - rsync
- bc - bc
- pinentry-curses - pinentry-curses
when: evolinux_packages_common
- name: Install/Update serveur-base meta-package - name: Install/Update serveur-base meta-package
command: "apt-get install -yq --allow-unauthenticated serveur-base" command: "apt-get install -yq --allow-unauthenticated serveur-base"
register: install_server_base register: install_server_base
changed_when: not (install_server_base.stdout | search("0 upgraded") and install_server_base.stdout | search("0 newly installed")) changed_when: not (install_server_base.stdout | search("0 upgraded") and install_server_base.stdout | search("0 newly installed"))
when: evolinux_packages_serveur_base
- name: is an MTA installed? - name: is an MTA installed?
command: "dpkg -S /usr/sbin/sendmail" command: "dpkg -S /usr/sbin/sendmail"
@ -66,7 +69,7 @@
- name: Install lsb-invalid-mta - name: Install lsb-invalid-mta
apt: apt:
name: lsb-invalid-mta name: lsb-invalid-mta
when: mta_installed.rc != 0 when: evolinux_packages_invalid_mta and mta_installed.rc != 0
- name: Deleting rpcbin and nfs-common - name: Deleting rpcbin and nfs-common
@ -76,7 +79,7 @@
with_items: with_items:
- rpcbind - rpcbind
- nfs-common - nfs-common
when: evolinux_delete_nfs when: evolinux_packages_delete_nfs
# TODO: use ini_file when Ansible > 2.1 (no_extra_spaces: yes) # TODO: use ini_file when Ansible > 2.1 (no_extra_spaces: yes)
@ -89,3 +92,4 @@
with_items: with_items:
- { option: "confirm", value: "1" } - { option: "confirm", value: "1" }
- { option: "which", value: "both" } - { option: "which", value: "both" }
when: evolinux_packages_listchanges

5
evolinux-base/tasks/postfix.yml
View file

@ -7,6 +7,7 @@
with_items: with_items:
- postfix - postfix
- mailgraph - mailgraph
when: evolinux_postfix_packages
tags: tags:
- packages - packages
- postfix - postfix
@ -25,6 +26,7 @@
line: "{{ item }}: root" line: "{{ item }}: root"
with_items: "{{ non_root_users_list.stdout_lines }}" with_items: "{{ non_root_users_list.stdout_lines }}"
notify: newaliases notify: newaliases
when: evolinux_postfix_users_alias_root
tags: tags:
- postfix - postfix
@ -38,6 +40,7 @@
- abuse - abuse
- mailer-daemon - mailer-daemon
notify: newaliases notify: newaliases
when: evolinux_postfix_mailer_alias_root
tags: tags:
- postfix - postfix
@ -47,6 +50,7 @@
regexp: "^root:" regexp: "^root:"
line: "root: {{ postfix_alias_email or general_alert_email | mandatory }}" line: "root: {{ postfix_alias_email or general_alert_email | mandatory }}"
notify: newaliases notify: newaliases
when: evolinux_postfix_root_alias
tags: tags:
- postfix - postfix
@ -66,4 +70,3 @@
tags: tags:
- packages - packages
- postfix - postfix

23
evolinux-base/tasks/root.yml
View file

@ -5,8 +5,7 @@
path: /root path: /root
state: directory state: directory
mode: 0700 mode: 0700
tags: when: evolinux_root_chmod
- root
- name: "Customize root's bashrc..." - name: "Customize root's bashrc..."
lineinfile: lineinfile:
@ -18,8 +17,7 @@
- "export HISTCONTROL=$HISTCONTROL${HISTCONTROL+,}ignoreboth" - "export HISTCONTROL=$HISTCONTROL${HISTCONTROL+,}ignoreboth"
- "export HISTSIZE=65535" - "export HISTSIZE=65535"
- "export HISTTIMEFORMAT=\"%c : \"" - "export HISTTIMEFORMAT=\"%c : \""
tags: when: evolinux_root_bashrc
- root
## .bash_history should be append-only ## .bash_history should be append-only
@ -28,38 +26,31 @@
content: "" content: ""
dest: "/root/.bash_history" dest: "/root/.bash_history"
force: no force: no
tags: when: evolinux_root_bash_history
- root
- name: Set umask in /root/.profile - name: Set umask in /root/.profile
lineinfile: lineinfile:
dest: "/root/.profile" dest: "/root/.profile"
line: "umask 0077" line: "umask 0077"
regexp: "umask [0-9]+" regexp: "umask [0-9]+"
tags: when: evolinux_root_umask
- root
- name: Custom git config for root - name: Custom git config for root
copy: copy:
src: root/gitconfig src: root/gitconfig
dest: "/root/.gitconfig" dest: "/root/.gitconfig"
force: no force: no
tags: when: evolinux_root_gitconfig
- root
- name: Is .bash_history append-only - name: Is .bash_history append-only
shell: lsattr /root/.bash_history | grep -E "^.*a.* " shell: lsattr /root/.bash_history | grep -E "^.*a.* "
register: bash_history_append_only register: bash_history_append_only
failed_when: False failed_when: False
changed_when: False changed_when: False
tags:
- root
- name: Set .bash_history append-only - name: Set .bash_history append-only
command: chattr +a /root/.bash_history command: chattr +a /root/.bash_history
when: bash_history_append_only.rc != 0 when: evolinux_root_bash_history_appendonly and bash_history_append_only.rc != 0
tags:
- root
- name: Setting vim as selected-editor - name: Setting vim as selected-editor
lineinfile: lineinfile:
@ -67,6 +58,7 @@
regexp: '^SELECTED_EDITOR=' regexp: '^SELECTED_EDITOR='
line: "SELECTED_EDITOR=\"/usr/bin/vim.basic\"" line: "SELECTED_EDITOR=\"/usr/bin/vim.basic\""
create: yes create: yes
when: evolinux_root_vim_default
- name: Setting vim root configuration - name: Setting vim root configuration
lineinfile: lineinfile:
@ -83,3 +75,4 @@
- "set softtabstop=0" - "set softtabstop=0"
- "set shiftwidth=4" - "set shiftwidth=4"
- "set smarttab" - "set smarttab"
when: evolinux_root_vim_conf

5
evolinux-base/tasks/ssh.yml
View file

@ -11,7 +11,7 @@
line: "\nMatch Address {{ evolinux_ssh_password_auth_addresses | join(',') }}\n PasswordAuthentication yes" line: "\nMatch Address {{ evolinux_ssh_password_auth_addresses | join(',') }}\n PasswordAuthentication yes"
validate: '/usr/sbin/sshd -T -f %s' validate: '/usr/sbin/sshd -T -f %s'
notify: reload sshd notify: reload sshd
when: grep_matchaddress_ssh.rc != 0 and evolinux_ssh_password_auth_addresses != [] when: evolinux_ssh_match_address and grep_matchaddress_ssh.rc != 0 and evolinux_ssh_password_auth_addresses != []
- name: Modify Match Address sshd directive - name: Modify Match Address sshd directive
replace: replace:
@ -21,7 +21,7 @@
validate: '/usr/sbin/sshd -T -f %s' validate: '/usr/sbin/sshd -T -f %s'
with_items: "{{ evolinux_ssh_password_auth_addresses }}" with_items: "{{ evolinux_ssh_password_auth_addresses }}"
notify: reload sshd notify: reload sshd
when: grep_matchaddress_ssh.rc == 0 when: evolinux_ssh_match_address and grep_matchaddress_ssh.rc == 0
- name: disable SSH access for root - name: disable SSH access for root
replace: replace:
@ -35,3 +35,4 @@
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
regexp: '^AcceptEnv' regexp: '^AcceptEnv'
replace: "#AcceptEnv" replace: "#AcceptEnv"
when: evolinux_ssh_disable_acceptenv

23
evolinux-base/tasks/system.yml
View file

@ -12,6 +12,7 @@
path: /tmp path: /tmp
state: directory state: directory
mode: 01777 mode: 01777
when: evolinux_system_chmod_tmp
- name: Setting default locales - name: Setting default locales
lineinfile: lineinfile:
@ -24,23 +25,25 @@
- "fr_FR ISO-8859-1" - "fr_FR ISO-8859-1"
- "fr_FR.UTF-8 UTF-8" - "fr_FR.UTF-8 UTF-8"
register: default_locales register: default_locales
when: evolinux_system_locales
- name: Reconfigure locales - name: Reconfigure locales
command: /usr/sbin/locale-gen command: /usr/sbin/locale-gen
when: default_locales | changed when: evolinux_system_locales and default_locales | changed
- name: Setting default timezone - name: Setting default timezone
lineinfile: lineinfile:
dest: /etc/timezone dest: /etc/timezone
regexp: '^\w+/\w+$' regexp: '^\w+/\w+$'
line: "{{ evolinux_timezone | mandatory }}" line: "{{ evolinux_system_timezone | mandatory }}"
insertbefore: BOF insertbefore: BOF
create: yes create: yes
register: change_timezone register: change_timezone
when: evolinux_system_timezone != False
- name: Reconfigure tzdata - name: Reconfigure tzdata
command: dpkg-reconfigure --frontend noninteractive tzdata command: dpkg-reconfigure --frontend noninteractive tzdata
when: change_timezone | changed when: evolinux_system_timezone != False and change_timezone | changed
# TODO : find a way to force the console-data configuration # TODO : find a way to force the console-data configuration
# non-interactively (like tzdata ↑) # non-interactively (like tzdata ↑)
@ -49,6 +52,7 @@
alternatives: alternatives:
name: editor name: editor
path: /usr/bin/vim.basic path: /usr/bin/vim.basic
when: evolinux_system_vim_default
- name: Add "umask 027" to /etc/profile.d/evolinux.sh - name: Add "umask 027" to /etc/profile.d/evolinux.sh
lineinfile: lineinfile:
@ -56,12 +60,14 @@
line: "umask 027" line: "umask 027"
create: yes create: yes
state: present state: present
when: evolinux_system_profile
- name: Set /etc/adduser.conf DIR_MODE to 0700 - name: Set /etc/adduser.conf DIR_MODE to 0700
replace: replace:
dest: /etc/adduser.conf dest: /etc/adduser.conf
regexp: "^DIR_MODE=.*$" regexp: "^DIR_MODE=.*$"
replace: "DIR_MODE=0700" replace: "DIR_MODE=0700"
when: evolinux_system_dirmode_adduser
# TODO: trouver comment ne pas faire ça sur Xen Dom-U # TODO: trouver comment ne pas faire ça sur Xen Dom-U
@ -71,12 +77,14 @@
line: "tty2" line: "tty2"
create: yes create: yes
state: present state: present
when: evolinux_system_dirmode_adduser
- name: Setting TMOUT to deconnect inactive users - name: Setting TMOUT to deconnect inactive users
lineinfile: lineinfile:
dest: /etc/profile dest: /etc/profile
line: "export TMOUT=36000" line: "export TMOUT=36000"
state: present state: present
when: evolinux_system_dirmode_adduser
#- name: Customizing /etc/fstab #- name: Customizing /etc/fstab
@ -86,6 +94,7 @@
line: "umask 022" line: "umask 022"
create: yes create: yes
state: present state: present
when: evolinux_system_dirmode_adduser
- name: Randomize periodic crontabs - name: Randomize periodic crontabs
replace: replace:
@ -98,6 +107,7 @@
- {regexp: '^25\s*6((\s*\*){3})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1', backup: "no"} - {regexp: '^25\s*6((\s*\*){3})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1', backup: "no"}
- {regexp: '^47\s*6((\s*\*){2}\s*7)', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1', backup: "no"} - {regexp: '^47\s*6((\s*\*){2}\s*7)', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1', backup: "no"}
- {regexp: '^52\s*6(\s*1(\s*\*){2})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1', backup: "no"} - {regexp: '^52\s*6(\s*1(\s*\*){2})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1', backup: "no"}
when: evolinux_system_dirmode_adduser
# NTP server address # NTP server address
@ -105,9 +115,9 @@
replace: replace:
dest: /etc/ntp.conf dest: /etc/ntp.conf
regexp: "^server .*$" regexp: "^server .*$"
replace: "server {{ evolinux_ntp_server }}" replace: "server {{ evolinux_system_ntp_server }}"
backup: yes backup: yes
when: evolinux_ntp_server | default(False) when: evolinux_system_ntp_server != False
## alert5 ## alert5
@ -117,11 +127,13 @@
dest: /etc/init.d/alert5 dest: /etc/init.d/alert5
force: no force: no
mode: 0755 mode: 0755
when: evolinux_system_alert5_init
- name: Enable alert5 init script - name: Enable alert5 init script
service: service:
name: alert5 name: alert5
enabled: yes enabled: yes
when: evolinux_system_alert5_init and evolinux_system_alert5_enable
## network interfaces ## network interfaces
@ -131,3 +143,4 @@
regexp: "allow-hotplug" regexp: "allow-hotplug"
replace: "auto" replace: "auto"
backup: yes backup: yes
when: evolinux_system_eni_auto