4d9e1af40f
All checks were successful
Ansible Lint |Total|New|Outstanding|Fixed|Trend
|:-:|:-:|:-:|:-:|:-:
|2653|5|2648|6|:+1:
Reference build: <a href="https://jenkins.evolix.org/job/gitea/job/ansible-roles/job/unstable/413//ansiblelint">Evolix » ansible-roles » unstable #413</a>
gitea/ansible-roles/pipeline/head This commit looks good
95 lines
2.7 KiB
YAML
95 lines
2.7 KiB
YAML
---
|
|
|
|
- name: "Use Cloud kernel on virtual servers"
|
|
ansible.builtin.apt:
|
|
name: "linux-image-cloud-amd64"
|
|
state: present
|
|
register: _use_cloud_kernel
|
|
when:
|
|
- ansible_machine == "x86_64"
|
|
- ansible_virtualization_role == "guest"
|
|
- evolinux_kernel_cloud_auto | bool
|
|
- ansible_distribution_major_version is version('10', '>=')
|
|
|
|
- name: "Remove non-Cloud kernel on virtual servers"
|
|
ansible.builtin.apt:
|
|
name: "linux-image-amd64"
|
|
state: absent
|
|
when:
|
|
- ansible_machine == "x86_64"
|
|
- ansible_virtualization_role == "guest"
|
|
- evolinux_kernel_cloud_auto | bool
|
|
|
|
- name: "Reboot the server to enable the new kernel"
|
|
ansible.builtin.reboot:
|
|
reboot_timeout: 600
|
|
search_paths: ['/lib/molly-guard', '/sbin']
|
|
when:
|
|
- _use_cloud_kernel is changed
|
|
- evolinux_kernel_cloud_reboot | bool
|
|
|
|
- name: Reboot after panic
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.name }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
loop:
|
|
- { name: kernel.panic_on_oops, value: 1 }
|
|
- { name: kernel.panic, value: 60 }
|
|
when: evolinux_kernel_reboot_after_panic | bool
|
|
|
|
- name: Don't reboot after panic
|
|
ansible.posix.sysctl:
|
|
name: "{{ item }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: absent
|
|
reload: yes
|
|
loop:
|
|
- kernel.panic_on_oops
|
|
- kernel.panic
|
|
when: not evolinux_kernel_reboot_after_panic | bool
|
|
|
|
- name: Disable net.ipv4.tcp_timestamps
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.tcp_timestamps
|
|
value: '0'
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
when: evolinux_kernel_disable_tcp_timestamps | bool
|
|
|
|
- name: Customize the swappiness
|
|
ansible.posix.sysctl:
|
|
name: vm.swappiness
|
|
value: "{{ evolinux_kernel_swappiness }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
when: evolinux_kernel_customize_swappiness | bool
|
|
|
|
- name: Patch for TCP stack vulnerability CVE-2016-5696
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.tcp_challenge_ack_limit
|
|
value: "1073741823"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
when: evolinux_kernel_cve20165696 | bool
|
|
|
|
- name: Patch for TCP stack vulnerability CVE-2018-5391 (FragmentSmack)
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.name }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
loop:
|
|
- { name: "net.ipv4.ipfrag_low_thresh", value: "196608" }
|
|
- { name: "net.ipv6.ip6frag_low_thresh", value: "196608" }
|
|
- { name: "net.ipv4.ipfrag_high_thresh", value: "262144" }
|
|
- { name: "net.ipv6.ip6frag_high_thresh", value: "262144" }
|
|
|
|
- ansible.builtin.meta: flush_handlers
|