forked from evolix/ansible-roles
Merge remote-tracking branch 'origin/unstable' into unstable
This commit is contained in:
commit
9a93e8d449
|
@ -1,3 +0,0 @@
|
||||||
---
|
|
||||||
admin_users: {}
|
|
||||||
admin_users_group: adm
|
|
|
@ -1,11 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- include: user.yml
|
|
||||||
|
|
||||||
- include: profile.yml
|
|
||||||
|
|
||||||
- include: ssh.yml
|
|
||||||
|
|
||||||
- include: sudo.yml
|
|
||||||
|
|
||||||
- meta: flush_handlers
|
|
|
@ -1,48 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file presence (jessie)"
|
|
||||||
template:
|
|
||||||
src: sudoers_jessie.j2
|
|
||||||
dest: /etc/sudoers.d/evolinux
|
|
||||||
force: no
|
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
|
||||||
register: copy_sudoers_evolinux
|
|
||||||
when: ansible_distribution_release == "jessie"
|
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
|
||||||
template:
|
|
||||||
src: sudoers_stretch.j2
|
|
||||||
dest: /etc/sudoers.d/evolinux
|
|
||||||
force: no
|
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
|
||||||
register: copy_sudoers_evolinux
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file permissions"
|
|
||||||
file:
|
|
||||||
path: /etc/sudoers.d/evolinux
|
|
||||||
mode: "0440"
|
|
||||||
state: file
|
|
||||||
|
|
||||||
- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
|
|
||||||
replace:
|
|
||||||
dest: /etc/sudoers.d/evolinux
|
|
||||||
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
|
|
||||||
replace: '\1,{{ user.name }}'
|
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
|
||||||
when:
|
|
||||||
- ansible_distribution_release == "jessie"
|
|
||||||
- not copy_sudoers_evolinux.changed
|
|
||||||
|
|
||||||
- name: "Create evolinux-sudo group (Debian 9 or later)"
|
|
||||||
group:
|
|
||||||
name: evolinux-sudo
|
|
||||||
system: yes
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
|
||||||
user:
|
|
||||||
name: '{{ user.name }}'
|
|
||||||
groups: 'evolinux-sudo'
|
|
||||||
append: yes
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
|
@ -19,9 +19,6 @@
|
||||||
tags:
|
tags:
|
||||||
- apt
|
- apt
|
||||||
|
|
||||||
- debug:
|
|
||||||
var: apt_install_evolix_public
|
|
||||||
|
|
||||||
- name: Install Evolix Public APT repository
|
- name: Install Evolix Public APT repository
|
||||||
include: evolix_public.yml
|
include: evolix_public.yml
|
||||||
when: apt_install_evolix_public
|
when: apt_install_evolix_public
|
||||||
|
|
|
@ -5,23 +5,3 @@ Install tools to setup DRBD replication accross servers.
|
||||||
## Tasks
|
## Tasks
|
||||||
|
|
||||||
Everything is in the `tasks/main.yml` file.
|
Everything is in the `tasks/main.yml` file.
|
||||||
|
|
||||||
## Available variables
|
|
||||||
|
|
||||||
The variable `admin_users` must be a "dict" of one or more users :
|
|
||||||
|
|
||||||
```
|
|
||||||
admin_users:
|
|
||||||
foo:
|
|
||||||
name: foo
|
|
||||||
uid: 1001
|
|
||||||
fullname: 'Mr Foo'
|
|
||||||
password_hash: 'sdfgsdfgsdfgsdfg'
|
|
||||||
ssh_key: 'ssh-rsa AZERTYXYZ'
|
|
||||||
bar:
|
|
||||||
name: bar
|
|
||||||
uid: 1002
|
|
||||||
fullname: 'Mr Bar'
|
|
||||||
password_hash: 'gsdfgsdfgsdfgsdf'
|
|
||||||
ssh_key: 'ssh-rsa QWERTYUIOP'
|
|
||||||
```
|
|
||||||
|
|
|
@ -7,8 +7,10 @@
|
||||||
# Licence: AGPLv3
|
# Licence: AGPLv3
|
||||||
#
|
#
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
usage() {
|
usage() {
|
||||||
echo "Usage: $0 NAME"
|
echo "Usage: $0 [ --cron ] NAME"
|
||||||
echo ""
|
echo ""
|
||||||
echo "NAME must be correspond to :"
|
echo "NAME must be correspond to :"
|
||||||
echo "- a CSR in ${CSR_DIR}/NAME.csr"
|
echo "- a CSR in ${CSR_DIR}/NAME.csr"
|
||||||
|
@ -17,68 +19,97 @@ usage() {
|
||||||
}
|
}
|
||||||
|
|
||||||
mkconf_apache() {
|
mkconf_apache() {
|
||||||
|
echo "Apache detected... first configuration"
|
||||||
[ -f "/etc/apache2/ssl/${vhost}.conf" ] && sed -i "s~^SSLCertificateFile.*$~SSLCertificateFile $CRT_DIR/${vhost}/live/fullchain.pem~" "/etc/apache2/ssl/${vhost}.conf"
|
[ -f "/etc/apache2/ssl/${vhost}.conf" ] && sed -i "s~^SSLCertificateFile.*$~SSLCertificateFile $CRT_DIR/${vhost}/live/fullchain.pem~" "/etc/apache2/ssl/${vhost}.conf"
|
||||||
apache2ctl -t 2>/dev/null && service apache2 reload
|
apache2ctl -t
|
||||||
}
|
}
|
||||||
|
|
||||||
mkconf_nginx() {
|
mkconf_nginx() {
|
||||||
|
echo "Nginx detected... first configuration"
|
||||||
[ -f "/etc/nginx/ssl/${vhost}.conf" ] && sed -i "s~^ssl_certificate[^_].*$~ssl_certificate $CRT_DIR/${vhost}/live/fullchain.pem;~" "/etc/nginx/ssl/${vhost}.conf"
|
[ -f "/etc/nginx/ssl/${vhost}.conf" ] && sed -i "s~^ssl_certificate[^_].*$~ssl_certificate $CRT_DIR/${vhost}/live/fullchain.pem;~" "/etc/nginx/ssl/${vhost}.conf"
|
||||||
nginx -t 2>/dev/null && service nginx reload
|
nginx -t
|
||||||
}
|
|
||||||
|
|
||||||
mkconf_haproxy() {
|
|
||||||
mkdir -p /etc/ssl/haproxy -m 700
|
|
||||||
cat "$CRT_DIR/${vhost}/live/fullchain.pem" "$SSL_KEY_DIR/${vhost}.key" > "/etc/ssl/haproxy/${vhost}.pem"
|
|
||||||
[ -f "$DH_DIR/${vhost}.pem" ] && cat "$DH_DIR/${vhost}.pem" >> "/etc/ssl/haproxy/${vhost}.pem"
|
|
||||||
haproxy -c -f /etc/haproxy/haproxy.cfg >/dev/null && service haproxy reload
|
|
||||||
}
|
}
|
||||||
|
|
||||||
main() {
|
main() {
|
||||||
[ -f /etc/default/evoacme ] && . /etc/default/evoacme
|
[ -f /etc/default/evoacme ] && . /etc/default/evoacme
|
||||||
[ -z "${SSL_KEY_DIR}" ] && SSL_KEY_DIR='/etc/ssl/private'
|
[ -z "${SSL_KEY_DIR}" ] && SSL_KEY_DIR=/etc/ssl/private
|
||||||
[ -z "${CRT_DIR}" ] && CRT_DIR='/etc/letsencrypt'
|
[ -z "${ACME_DIR}" ] && ACME_DIR=/var/lib/letsencrypt
|
||||||
[ -z "${CSR_DIR}" ] && CSR_DIR='/etc/ssl/requests'
|
[ -z "${CSR_DIR}" ] && CSR_DIR=/etc/ssl/requests
|
||||||
[ -z "${SELF_SIGNED_DIR}" ] && SELF_SIGNED_DIR='/etc/ssl/self-signed'
|
[ -z "${CRT_DIR}" ] && CRT_DIR=/etc/letsencrypt
|
||||||
[ -z "${DH_DIR}" ] && DH_DIR='/etc/ssl/dhparam'
|
[ -z "${LOG_DIR}" ] && LOG_DIR=/var/log/evoacme
|
||||||
[ -z "${LOG_DIR}" ] && LOG_DIR='/var/log/evoacme'
|
[ -z "${SSL_MINDAY}" ] && SSL_MINDAY=30
|
||||||
|
[ -z "${SELF_SIGNED_DIR}" ] && SELF_SIGNED_DIR=/etc/ssl/self-signed
|
||||||
|
[ -z "${DH_DIR}" ] && DH_DIR=etc/ssl/dhparam
|
||||||
|
|
||||||
[ "$#" -ne 1 ] && usage && exit 1
|
# misc verifications
|
||||||
|
[ "$1" = "-h" ] || [ "$1" = "--help" ] && usage && exit 0
|
||||||
|
which openssl >/dev/null || ( echo "error: openssl command not installed" && exit 1 )
|
||||||
|
which certbot >/dev/null || ( echo "error: certbot command not installed" && exit 1 )
|
||||||
|
[ ! -d $ACME_DIR ] && echo "error: $ACME_DIR is not a directory" && exit 1
|
||||||
|
[ ! -d $CSR_DIR ] && echo "error: $CSR_DIR is not a directory" && exit 1
|
||||||
|
[ ! -d $LOG_DIR ] && echo "error: $LOG_DIR is not a directory" && exit 1
|
||||||
|
[ "$#" -ge 3 ] || [ "$#" -le 0 ] && echo "error: invalid argument(s)" && usage && exit 1
|
||||||
|
[ "$#" -eq 2 ] && [ "$1" != "--cron" ] && echo "error: invalid argument(s)" && usage && exit 1
|
||||||
|
|
||||||
vhost=$(basename "$1" .conf)
|
[ "$#" -eq 1 ] && vhost=$(basename "$1" .conf) && CRON=NO
|
||||||
|
[ "$#" -eq 2 ] && vhost=$(basename "$2" .conf) && CRON=YES
|
||||||
|
|
||||||
# Check master status for evoadmin-cluster
|
# verify .csr file
|
||||||
|
test ! -f "$CSR_DIR/${vhost}.csr" && echo "error: $CSR_DIR/${vhost}.csr absent" && exit 1
|
||||||
|
test ! -r "$CSR_DIR/${vhost}.csr" && echo "error: $CSR_DIR/${vhost}.csr is not readable" && exit 1
|
||||||
|
openssl req -noout -modulus -in "$CSR_DIR/${vhost}.csr" >/dev/null || ( echo "error: $CSR_DIR/${vhost}.csr is invalid" && exit 1 )
|
||||||
|
[ "$CRON" = "NO" ] && echo "Using CSR file: $CSR_DIR/${vhost}.csr"
|
||||||
|
|
||||||
|
# Hook for evoadmin-web in cluster mode : check master status
|
||||||
if [ -f "/home/${vhost}/state" ]; then
|
if [ -f "/home/${vhost}/state" ]; then
|
||||||
grep -q "STATE=master" "/home/${vhost}/state" || exit 0
|
grep -q "STATE=master" "/home/${vhost}/state" || exit 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
SSL_EMAIL=$(grep emailAddress "${CRT_DIR}/openssl.cnf"|cut -d'=' -f2|xargs)
|
|
||||||
if [ -n "$SSL_EMAIL" ]; then
|
if [ -n "$SSL_EMAIL" ]; then
|
||||||
emailopt="-m $SSL_EMAIL"
|
emailopt="-m $SSL_EMAIL"
|
||||||
else
|
else
|
||||||
emailopt="--register-unsafely-without-email"
|
emailopt="--register-unsafely-without-email"
|
||||||
fi
|
fi
|
||||||
DATE=$(date "+%Y%m%d")
|
|
||||||
|
|
||||||
|
DATE=$(date "+%Y%m%d")
|
||||||
|
[ ! -n "$DATE" ] && echo "error: invalid date" && exit 1
|
||||||
|
|
||||||
|
|
||||||
|
# If live link already exists, it's not our first time...
|
||||||
if [ -h "$CRT_DIR/${vhost}/live" ]; then
|
if [ -h "$CRT_DIR/${vhost}/live" ]; then
|
||||||
crt_end_date=$(openssl x509 -noout -enddate -in "$CRT_DIR/${vhost}/live/cert.crt"|sed -e "s/.*=//")
|
openssl x509 -noout -modulus -in "$CRT_DIR/${vhost}/live/cert.crt" >/dev/null || ( echo "error: $CRT_DIR/${vhost}/live/cert.crt is invalid" && exit 1 )
|
||||||
date_crt=$(date -ud "$crt_end_date" +"%s")
|
|
||||||
|
# Verify if our certificate will expire
|
||||||
|
crt_end_date=$(openssl x509 -noout -enddate -in "$CRT_DIR/${vhost}/live/cert.crt" | cut -d= -f2)
|
||||||
|
date_renew=$(date -ud "$crt_end_date - $SSL_MINDAY days" +"%s")
|
||||||
date_today=$(date +'%s')
|
date_today=$(date +'%s')
|
||||||
date_diff=$(((date_crt - date_today) / (60*60*24)))
|
[ "$date_today" -lt "$date_renew" ] && ( [ "$CRON" = "NO" ] && echo "Cert $CRT_DIR/${vhost}/live/cert.crt expires at $crt_end_date => more than $SSL_MINDAY days: thxbye." || true ) && exit 0
|
||||||
[ "$date_diff" -ge "$SSL_MINDAY" ] && exit 0
|
else
|
||||||
fi
|
|
||||||
rm -rf "$CRT_DIR/${vhost}/${DATE}"
|
|
||||||
mkdir -pm 755 "$CRT_DIR/${vhost}/${DATE}"
|
|
||||||
chown -R acme: "$CRT_DIR/${vhost}"
|
|
||||||
sudo -u acme certbot certonly --quiet --webroot --csr "$CSR_DIR/${vhost}.csr" --webroot-path "$ACME_DIR" -n --agree-tos --cert-path="$CRT_DIR/${vhost}/${DATE}/cert.crt" --fullchain-path="$CRT_DIR/${vhost}/${DATE}/fullchain.pem" --chain-path="$CRT_DIR/${vhost}/${DATE}/chain.pem" "$emailopt" --logs-dir "$LOG_DIR" 2>&1 | grep -v "certbot.crypto_util"
|
|
||||||
if [ -f "$CRT_DIR/${vhost}/${DATE}/fullchain.pem" ]; then
|
|
||||||
rm -f "$CRT_DIR/${vhost}/live"
|
|
||||||
ln -s "$CRT_DIR/${vhost}/${DATE}" "$CRT_DIR/${vhost}/live"
|
|
||||||
which apache2ctl >/dev/null && mkconf_apache
|
which apache2ctl >/dev/null && mkconf_apache
|
||||||
which nginx >/dev/null && mkconf_nginx
|
which nginx >/dev/null && mkconf_nginx
|
||||||
which haproxy >/dev/null && mkconf_haproxy
|
|
||||||
else
|
|
||||||
rmdir "$CRT_DIR/${vhost}/${DATE}"
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# renew certificate with certbot
|
||||||
|
[ -d "$CRT_DIR/${vhost}/${DATE}" ] && echo "error: $CRT_DIR/${vhost}/${DATE} directory already exists, remove it manually." && exit 1
|
||||||
|
mkdir -pm 755 "$CRT_DIR/${vhost}/${DATE}"
|
||||||
|
chown -R acme: "$CRT_DIR/${vhost}/${DATE}"
|
||||||
|
[ "$CRON" = "YES" ] && CERTBOT_OPTS="--quiet"
|
||||||
|
sudo -u acme certbot certonly $CERTBOT_OPTS --webroot --csr "$CSR_DIR/${vhost}.csr" --webroot-path "$ACME_DIR" -n --agree-tos --cert-path="$CRT_DIR/${vhost}/${DATE}/cert.crt" --fullchain-path="$CRT_DIR/${vhost}/${DATE}/fullchain.pem" --chain-path="$CRT_DIR/${vhost}/${DATE}/chain.pem" "$emailopt" --logs-dir "$LOG_DIR" 2>&1 | grep -v "certbot.crypto_util"
|
||||||
|
|
||||||
|
# verify if all is right
|
||||||
|
openssl x509 -noout -modulus -in "$CRT_DIR/${vhost}/${DATE}/cert.crt" >/dev/null || ( echo "error: new $CRT_DIR/${vhost}/${DATE}/cert.crt is invalid" && exit 1 )
|
||||||
|
openssl x509 -noout -modulus -in "$CRT_DIR/${vhost}/${DATE}/fullchain.pem" >/dev/null || ( echo "error: new $CRT_DIR/${vhost}/${DATE}/fullchain.pem is invalid" && exit 1 )
|
||||||
|
openssl x509 -noout -modulus -in "$CRT_DIR/${vhost}/${DATE}/chain.pem" >/dev/null || ( echo "error: new $CRT_DIR/${vhost}/${DATE}/chain.pem is invalid" && exit 1 )
|
||||||
|
|
||||||
|
# link dance
|
||||||
|
[ -h "$CRT_DIR/${vhost}/live" ] && rm "$CRT_DIR/${vhost}/live"
|
||||||
|
ln -s "$CRT_DIR/${vhost}/${DATE}" "$CRT_DIR/${vhost}/live"
|
||||||
|
openssl x509 -noout -modulus -in "$CRT_DIR/${vhost}/live/cert.crt" >/dev/null || ( echo "error: new $CRT_DIR/{vhost}/live/cert.crt is invalid" && exit 1 )
|
||||||
|
|
||||||
|
# reload apache or nginx (TODO: need improvments)
|
||||||
|
pidof apache2 >/dev/null && apache2ctl -t 2>/dev/null && ( [ "$CRON" = "NO" ] && echo "Apache detected... reloading" || true ) && systemctl reload apache2
|
||||||
|
pidof nginx >/dev/null && nginx -t 2>/dev/null && ( [ "$CRON" = "NO" ] && echo "Nginx detected... reloading" || true ) && systemctl reload apache2
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
main "$@"
|
main "$@"
|
||||||
|
|
|
@ -42,6 +42,18 @@
|
||||||
path: /usr/local/bin/certbot
|
path: /usr/local/bin/certbot
|
||||||
state: absent
|
state: absent
|
||||||
|
|
||||||
|
- name: stat /etc/cron.d/certbot
|
||||||
|
stat:
|
||||||
|
path: /etc/cron.d/certbot
|
||||||
|
register: etc_cron_d_certbot
|
||||||
|
|
||||||
|
- name: Rename certbot dpkg cron to .disabled
|
||||||
|
copy:
|
||||||
|
remote_src: True
|
||||||
|
src: /etc/cron.d/certbot
|
||||||
|
dest: /etc/cron.d/certbot.disabled
|
||||||
|
when: etc_cron_d_certbot.stat.exists
|
||||||
|
|
||||||
- name: Remove certbot dpkg cron
|
- name: Remove certbot dpkg cron
|
||||||
file:
|
file:
|
||||||
path: /etc/cron.d/certbot
|
path: /etc/cron.d/certbot
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
- ini_file:
|
- ini_file:
|
||||||
dest: /etc/letsencrypt/openssl.cnf
|
dest: "{{ evoacme_crt_dir }}/openssl.cnf"
|
||||||
section: 'req'
|
section: 'req'
|
||||||
option: "{{ item.name }}"
|
option: "{{ item.name }}"
|
||||||
value: "{{ item.var }}"
|
value: "{{ item.var }}"
|
||||||
|
|
|
@ -13,7 +13,17 @@
|
||||||
|
|
||||||
- include: scripts.yml
|
- include: scripts.yml
|
||||||
|
|
||||||
- include: webserver.yml
|
- name: Determine Apache presence
|
||||||
|
stat:
|
||||||
|
path: /etc/apache2/apache2.conf
|
||||||
|
check_mode: no
|
||||||
|
register: sta
|
||||||
|
|
||||||
|
- name: Determine Nginx presence
|
||||||
|
stat:
|
||||||
|
path: /etc/nginx/nginx.conf
|
||||||
|
check_mode: no
|
||||||
|
register: stn
|
||||||
|
|
||||||
- include: apache.yml
|
- include: apache.yml
|
||||||
when: sta.stat.isreg is defined and sta.stat.isreg
|
when: sta.stat.isreg is defined and sta.stat.isreg
|
||||||
|
|
|
@ -9,7 +9,7 @@
|
||||||
|
|
||||||
- name: Copy make-csr.sh script
|
- name: Copy make-csr.sh script
|
||||||
copy:
|
copy:
|
||||||
src: files/make-csr.sh
|
src: make-csr.sh
|
||||||
dest: /usr/local/sbin/make-csr
|
dest: /usr/local/sbin/make-csr
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
|
@ -17,7 +17,7 @@
|
||||||
|
|
||||||
- name: Copy evoacme script
|
- name: Copy evoacme script
|
||||||
copy:
|
copy:
|
||||||
src: files/evoacme.sh
|
src: evoacme.sh
|
||||||
dest: /usr/local/sbin/evoacme
|
dest: /usr/local/sbin/evoacme
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
---
|
|
||||||
- name: Determine Nginx presence
|
|
||||||
stat:
|
|
||||||
path: /etc/nginx/nginx.conf
|
|
||||||
check_mode: no
|
|
||||||
register: stn
|
|
||||||
|
|
||||||
- name: Determine Apache presence
|
|
||||||
stat:
|
|
||||||
path: /etc/apache2/apache2.conf
|
|
||||||
check_mode: no
|
|
||||||
register: sta
|
|
|
@ -36,6 +36,6 @@ Main variables are:
|
||||||
* `evolinux_additional_packages`: optional additional packages to install (default: `[]`)
|
* `evolinux_additional_packages`: optional additional packages to install (default: `[]`)
|
||||||
* `evolinux_postfix_purge_exim`: purge Exim packages (default: `True`) ;
|
* `evolinux_postfix_purge_exim`: purge Exim packages (default: `True`) ;
|
||||||
* `evolinux_ssh_password_auth_addresses`: list of addresses that can authenticate with a password (default: `[]`)
|
* `evolinux_ssh_password_auth_addresses`: list of addresses that can authenticate with a password (default: `[]`)
|
||||||
* `evolinux_ssh_disable_root`: disable SSH access for root (default: `True`)
|
* `evolinux_ssh_disable_root`: disable SSH access for root (default: `False`)
|
||||||
|
|
||||||
The full list of variables (with default values) can be found in `defaults/main.yml`.
|
The full list of variables (with default values) can be found in `defaults/main.yml`.
|
||||||
|
|
|
@ -10,6 +10,21 @@ logcheck_alert_email: Null
|
||||||
raid_alert_email: Null
|
raid_alert_email: Null
|
||||||
postfix_alias_email: Null
|
postfix_alias_email: Null
|
||||||
|
|
||||||
|
# apt
|
||||||
|
|
||||||
|
evolinux_apt_include: True
|
||||||
|
|
||||||
|
evolinux_apt_conf: True
|
||||||
|
evolinux_apt_hooks: True
|
||||||
|
evolinux_apt_replace_default_sources: True
|
||||||
|
evolinux_apt_public_sources: True
|
||||||
|
evolinux_apt_upgrade: True
|
||||||
|
evolinux_apt_remove_aptitude: True
|
||||||
|
|
||||||
|
# etc-git
|
||||||
|
|
||||||
|
evolinux_etcgit_include: True
|
||||||
|
|
||||||
# hostname
|
# hostname
|
||||||
|
|
||||||
evolinux_hostname_include: True
|
evolinux_hostname_include: True
|
||||||
|
@ -31,17 +46,6 @@ evolinux_kernel_disable_tcp_timestamps: True
|
||||||
evolinux_kernel_reduce_swapiness: True
|
evolinux_kernel_reduce_swapiness: True
|
||||||
evolinux_kernel_cve20165696: True
|
evolinux_kernel_cve20165696: True
|
||||||
|
|
||||||
# apt
|
|
||||||
|
|
||||||
evolinux_apt_include: True
|
|
||||||
|
|
||||||
evolinux_apt_conf: True
|
|
||||||
evolinux_apt_hooks: True
|
|
||||||
evolinux_apt_replace_default_sources: True
|
|
||||||
evolinux_apt_public_sources: True
|
|
||||||
evolinux_apt_upgrade: True
|
|
||||||
evolinux_apt_remove_aptitude: True
|
|
||||||
|
|
||||||
# fstab
|
# fstab
|
||||||
|
|
||||||
evolinux_fstab_include: True
|
evolinux_fstab_include: True
|
||||||
|
@ -96,6 +100,22 @@ evolinux_system_alert5_init: True
|
||||||
evolinux_system_alert5_enable: True
|
evolinux_system_alert5_enable: True
|
||||||
evolinux_system_eni_auto: True
|
evolinux_system_eni_auto: True
|
||||||
|
|
||||||
|
# evomaintenance
|
||||||
|
|
||||||
|
evolinux_evomaintenance_include: True
|
||||||
|
|
||||||
|
# ssh
|
||||||
|
|
||||||
|
evolinux_ssh_include: True
|
||||||
|
|
||||||
|
evolinux_ssh_password_auth_addresses: []
|
||||||
|
evolinux_ssh_match_address: True
|
||||||
|
evolinux_ssh_disable_acceptenv: True
|
||||||
|
|
||||||
|
# evolinux users
|
||||||
|
|
||||||
|
evolinux_users_include: True
|
||||||
|
|
||||||
# root
|
# root
|
||||||
|
|
||||||
evolinux_root_include: True
|
evolinux_root_include: True
|
||||||
|
@ -108,15 +128,7 @@ evolinux_root_gitconfig: True
|
||||||
evolinux_root_bash_history_appendonly: True
|
evolinux_root_bash_history_appendonly: True
|
||||||
evolinux_root_vim_default: True
|
evolinux_root_vim_default: True
|
||||||
evolinux_root_vim_conf: True
|
evolinux_root_vim_conf: True
|
||||||
|
evolinux_root_disable_ssh: True
|
||||||
# ssh
|
|
||||||
|
|
||||||
evolinux_ssh_include: True
|
|
||||||
|
|
||||||
evolinux_ssh_password_auth_addresses: []
|
|
||||||
evolinux_ssh_match_address: True
|
|
||||||
evolinux_ssh_disable_root: True
|
|
||||||
evolinux_ssh_disable_acceptenv: True
|
|
||||||
|
|
||||||
# postfix
|
# postfix
|
||||||
|
|
||||||
|
|
9
evolinux-base/files/alert5.service
Normal file
9
evolinux-base/files/alert5.service
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Evolix alert5 script
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=/usr/share/scripts/alert5.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
|
@ -12,6 +12,7 @@ galaxy_info:
|
||||||
- name: Debian
|
- name: Debian
|
||||||
versions:
|
versions:
|
||||||
- jessie
|
- jessie
|
||||||
|
- stretch
|
||||||
|
|
||||||
dependencies: []
|
dependencies: []
|
||||||
# List your role dependencies here, one per line.
|
# List your role dependencies here, one per line.
|
||||||
|
|
|
@ -16,7 +16,7 @@
|
||||||
replace: '\1{{ evolinux_fstab_home_options | mandatory }}\3'
|
replace: '\1{{ evolinux_fstab_home_options | mandatory }}\3'
|
||||||
notify: remount /home
|
notify: remount /home
|
||||||
when:
|
when:
|
||||||
- "' /home ' in fstab_content.stdout"
|
- fstab_content.stdout | regex_search('\s/home\s')
|
||||||
- evolinux_fstab_home
|
- evolinux_fstab_home
|
||||||
|
|
||||||
- name: /tmp partition is customized
|
- name: /tmp partition is customized
|
||||||
|
@ -25,7 +25,7 @@
|
||||||
regexp: '([^#]\s+/tmp\s+\S+\s+)([a-z,]+)(\s+)'
|
regexp: '([^#]\s+/tmp\s+\S+\s+)([a-z,]+)(\s+)'
|
||||||
replace: '\1{{ evolinux_fstab_tmp_options | mandatory }}\3'
|
replace: '\1{{ evolinux_fstab_tmp_options | mandatory }}\3'
|
||||||
when:
|
when:
|
||||||
- "' /tmp ' in fstab_content.stdout"
|
- fstab_content.stdout | regex_search('\s/tmp\s')
|
||||||
- evolinux_fstab_tmp
|
- evolinux_fstab_tmp
|
||||||
|
|
||||||
- name: /usr partition is customized
|
- name: /usr partition is customized
|
||||||
|
@ -34,7 +34,7 @@
|
||||||
regexp: '([^#]\s+/usr\s+\S+\s+)([a-z,]+)(\s+)'
|
regexp: '([^#]\s+/usr\s+\S+\s+)([a-z,]+)(\s+)'
|
||||||
replace: '\1{{ evolinux_fstab_usr_options | mandatory }}\3'
|
replace: '\1{{ evolinux_fstab_usr_options | mandatory }}\3'
|
||||||
when:
|
when:
|
||||||
- "' /usr ' in fstab_content.stdout"
|
- fstab_content.stdout | regex_search('\s/usr\s')
|
||||||
- evolinux_fstab_usr
|
- evolinux_fstab_usr
|
||||||
|
|
||||||
- name: /var partition is customized
|
- name: /var partition is customized
|
||||||
|
@ -44,7 +44,7 @@
|
||||||
replace: '\1{{ evolinux_fstab_var_options | mandatory }}\3'
|
replace: '\1{{ evolinux_fstab_var_options | mandatory }}\3'
|
||||||
notify: remount /var
|
notify: remount /var
|
||||||
when:
|
when:
|
||||||
- "' /var ' in fstab_content.stdout"
|
- fstab_content.stdout | regex_search('\s/var\s')
|
||||||
- evolinux_fstab_var
|
- evolinux_fstab_var
|
||||||
|
|
||||||
- name: /var/tmp is created
|
- name: /var/tmp is created
|
||||||
|
|
|
@ -5,6 +5,15 @@
|
||||||
when:
|
when:
|
||||||
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')
|
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')
|
||||||
|
|
||||||
|
- name: Apt configuration
|
||||||
|
include: apt.yml
|
||||||
|
when: evolinux_apt_include
|
||||||
|
|
||||||
|
- name: /etc versioning with Git
|
||||||
|
include_role:
|
||||||
|
name: etc-git
|
||||||
|
when: evolinux_etcgit_include
|
||||||
|
|
||||||
- name: Hostname
|
- name: Hostname
|
||||||
include: hostname.yml
|
include: hostname.yml
|
||||||
when: evolinux_hostname_include
|
when: evolinux_hostname_include
|
||||||
|
@ -13,10 +22,6 @@
|
||||||
include: kernel.yml
|
include: kernel.yml
|
||||||
when: evolinux_kernel_include
|
when: evolinux_kernel_include
|
||||||
|
|
||||||
- name: Apt configuration and packages install
|
|
||||||
include: apt.yml
|
|
||||||
when: evolinux_apt_include
|
|
||||||
|
|
||||||
- name: Fstab configuration
|
- name: Fstab configuration
|
||||||
include: fstab.yml
|
include: fstab.yml
|
||||||
when: evolinux_fstab_include
|
when: evolinux_fstab_include
|
||||||
|
@ -29,14 +34,24 @@
|
||||||
include: system.yml
|
include: system.yml
|
||||||
when: evolinux_system_include
|
when: evolinux_system_include
|
||||||
|
|
||||||
- name: Root user configuration
|
- name: Evomaintenance
|
||||||
include: root.yml
|
include_role:
|
||||||
when: evolinux_root_include
|
name: evomaintenance
|
||||||
|
when: evolinux_evomaintenance_include
|
||||||
|
|
||||||
- name: SSH configuration
|
- name: SSH configuration
|
||||||
include: ssh.yml
|
include: ssh.yml
|
||||||
when: evolinux_ssh_include
|
when: evolinux_ssh_include
|
||||||
|
|
||||||
|
- name: Create evolinux users
|
||||||
|
include_role:
|
||||||
|
name: evolinux-users
|
||||||
|
when: evolinux_users_include
|
||||||
|
|
||||||
|
- name: Root user configuration
|
||||||
|
include: root.yml
|
||||||
|
when: evolinux_root_include
|
||||||
|
|
||||||
- name: Postfix
|
- name: Postfix
|
||||||
include: postfix.yml
|
include: postfix.yml
|
||||||
when: evolinux_postfix_include
|
when: evolinux_postfix_include
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- name: packages are installed
|
- name: Postfix packages are installed
|
||||||
apt:
|
apt:
|
||||||
name: "{{ item }}"
|
name: "{{ item }}"
|
||||||
state: present
|
state: present
|
||||||
|
|
|
@ -80,4 +80,12 @@
|
||||||
- "set shiftwidth=4"
|
- "set shiftwidth=4"
|
||||||
when: evolinux_root_vim_conf
|
when: evolinux_root_vim_conf
|
||||||
|
|
||||||
|
- name: disable SSH access for root
|
||||||
|
replace:
|
||||||
|
dest: /etc/ssh/sshd_config
|
||||||
|
regexp: '^PermitRootLogin (yes|without-password)'
|
||||||
|
replace: "PermitRootLogin no"
|
||||||
|
notify: reload sshd
|
||||||
|
when: evolinux_root_disable_ssh
|
||||||
|
|
||||||
- meta: flush_handlers
|
- meta: flush_handlers
|
||||||
|
|
|
@ -17,48 +17,6 @@
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
when: not evolinux_ssh_password_auth_addresses == []
|
when: not evolinux_ssh_password_auth_addresses == []
|
||||||
|
|
||||||
# - name: verify Match Address directive
|
|
||||||
# command: "grep 'Match Address' /etc/ssh/sshd_config"
|
|
||||||
# changed_when: False
|
|
||||||
# failed_when: False
|
|
||||||
# check_mode: no
|
|
||||||
# register: grep_matchaddress_ssh
|
|
||||||
#
|
|
||||||
# - name: Add Match Address sshd directive
|
|
||||||
# lineinfile:
|
|
||||||
# dest: /etc/ssh/sshd_config
|
|
||||||
# line: "\nMatch Address {{ evolinux_ssh_password_auth_addresses | join(',') }}\n PasswordAuthentication yes"
|
|
||||||
# insertafter: '# +ForceCommand cvs server'
|
|
||||||
# validate: '/usr/sbin/sshd -T -f %s'
|
|
||||||
# notify: reload sshd
|
|
||||||
# when: evolinux_ssh_match_address and grep_matchaddress_ssh.rc != 0 and evolinux_ssh_password_auth_addresses != []
|
|
||||||
#
|
|
||||||
# - name: Modify Match Address sshd directive
|
|
||||||
# replace:
|
|
||||||
# dest: /etc/ssh/sshd_config
|
|
||||||
# regexp: '^(Match Address ((?!{{ item }}).)*)$'
|
|
||||||
# replace: '\1,{{ item }}'
|
|
||||||
# validate: '/usr/sbin/sshd -T -f %s'
|
|
||||||
# with_items: "{{ evolinux_ssh_password_auth_addresses }}"
|
|
||||||
# notify: reload sshd
|
|
||||||
# when: evolinux_ssh_match_address and grep_matchaddress_ssh.rc == 0
|
|
||||||
#
|
|
||||||
# - name: Add Match Group sudo without password
|
|
||||||
# lineinfile:
|
|
||||||
# dest: /etc/ssh/sshd_config
|
|
||||||
# line: "\nMatch Group sudo\n PasswordAuthentication no"
|
|
||||||
# insertbefore: '^Match Address'
|
|
||||||
# validate: '/usr/sbin/sshd -T -f %s'
|
|
||||||
# notify: reload sshd
|
|
||||||
|
|
||||||
- name: disable SSH access for root
|
|
||||||
replace:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
regexp: '^PermitRootLogin (yes|without-password)'
|
|
||||||
replace: "PermitRootLogin no"
|
|
||||||
notify: reload sshd
|
|
||||||
when: evolinux_ssh_disable_root
|
|
||||||
|
|
||||||
# We disable AcceptEnv because it can be a security issue, but also because we
|
# We disable AcceptEnv because it can be a security issue, but also because we
|
||||||
# do not want clients to push their environment variables like LANG.
|
# do not want clients to push their environment variables like LANG.
|
||||||
- name: disable AcceptEnv in ssh config
|
- name: disable AcceptEnv in ssh config
|
||||||
|
|
|
@ -116,29 +116,56 @@
|
||||||
|
|
||||||
## alert5
|
## alert5
|
||||||
|
|
||||||
- name: Install alert5 init script
|
- name: Install alert5 init script (jessie/stretch)
|
||||||
template:
|
template:
|
||||||
src: system/init_alert5.j2
|
src: system/alert5.sysvinit.j2
|
||||||
dest: /etc/init.d/alert5
|
dest: /etc/init.d/alert5
|
||||||
force: no
|
force: no
|
||||||
mode: "0755"
|
mode: "0755"
|
||||||
when: evolinux_system_alert5_init
|
when:
|
||||||
|
- evolinux_system_alert5_init
|
||||||
|
- ansible_distribution_release == "jessie" or ansible_distribution_release == "stretch"
|
||||||
|
|
||||||
|
- name: Enable alert5 init script (jessie/stretch)
|
||||||
#TODO: switch service/systemd modules with Ansible 2.2+
|
|
||||||
|
|
||||||
- name: Enable alert5 init script
|
|
||||||
service:
|
service:
|
||||||
name: alert5
|
name: alert5
|
||||||
enabled: yes
|
enabled: yes
|
||||||
when: evolinux_system_alert5_init and evolinux_system_alert5_enable
|
when:
|
||||||
|
- evolinux_system_alert5_init
|
||||||
|
- evolinux_system_alert5_enable
|
||||||
|
- ansible_distribution_release == "jessie" or ansible_distribution_release == "stretch"
|
||||||
|
|
||||||
# - name: Enable alert5 init script
|
|
||||||
# systemd:
|
|
||||||
# name: alert5
|
- name: Install alert5 init script (buster)
|
||||||
# daemon_reload: yes
|
template:
|
||||||
# enabled: yes
|
src: system/alert5.sh.j2
|
||||||
# when: evolinux_system_alert5_init and evolinux_system_alert5_enable
|
dest: /usr/share/scripts/alert5.sh
|
||||||
|
force: no
|
||||||
|
mode: "0755"
|
||||||
|
when:
|
||||||
|
- evolinux_system_alert5_init
|
||||||
|
- ansible_distribution_major_version | version_compare('10', '>=')
|
||||||
|
|
||||||
|
- name: Install alert5 service (buster)
|
||||||
|
copy:
|
||||||
|
src: alert5.service
|
||||||
|
dest: /etc/systemd/system/alert5.service
|
||||||
|
force: yes
|
||||||
|
mode: "0755"
|
||||||
|
when:
|
||||||
|
- evolinux_system_alert5_init
|
||||||
|
- ansible_distribution_major_version | version_compare('10', '>=')
|
||||||
|
|
||||||
|
- name: Enable alert5 init script (buster)
|
||||||
|
systemd:
|
||||||
|
name: alert5
|
||||||
|
daemon_reload: yes
|
||||||
|
enabled: yes
|
||||||
|
when:
|
||||||
|
- evolinux_system_alert5_init
|
||||||
|
- evolinux_system_alert5_enable
|
||||||
|
- ansible_distribution_major_version | version_compare('10', '>=')
|
||||||
|
|
||||||
## network interfaces
|
## network interfaces
|
||||||
|
|
||||||
|
|
7
evolinux-base/templates/system/alert5.sh.j2
Normal file
7
evolinux-base/templates/system/alert5.sh.j2
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
## sends a mail when booting
|
||||||
|
date | mail -s'boot/reboot' {{ reboot_alert_email or general_alert_email | mandatory }}
|
||||||
|
|
||||||
|
## starts the firewall
|
||||||
|
#/etc/init.d/minifirewall start
|
|
@ -31,7 +31,7 @@ suites:
|
||||||
playbook: ./tests/test.yml
|
playbook: ./tests/test.yml
|
||||||
verifier:
|
verifier:
|
||||||
patterns:
|
patterns:
|
||||||
- admin-users/tests/spec/admin-users_spec.rb
|
- evolinux-users/tests/spec/evolinux-users_spec.rb
|
||||||
bundler_path: '/usr/local/bin'
|
bundler_path: '/usr/local/bin'
|
||||||
rspec_path: '/usr/local/bin'
|
rspec_path: '/usr/local/bin'
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
# admin-users
|
# evolinux-users
|
||||||
|
|
||||||
Creates admin users accounts, based on a configuration data structure.
|
Creates evolinux users accounts, based on a configuration data structure.
|
||||||
|
|
||||||
## Tasks
|
## Tasks
|
||||||
|
|
||||||
|
@ -8,20 +8,26 @@ Everything is in the `tasks/main.yml` file.
|
||||||
|
|
||||||
## Available variables
|
## Available variables
|
||||||
|
|
||||||
The variable `admin_users` must be a "dict" of one or more users :
|
The variable `evolinux_users` must be a "dict" of one or more users :
|
||||||
|
|
||||||
```
|
```
|
||||||
admin_users:
|
evolinux_users:
|
||||||
foo:
|
foo:
|
||||||
name: foo
|
name: foo
|
||||||
uid: 1001
|
uid: 1001
|
||||||
fullname: 'Mr Foo'
|
fullname: 'Mr Foo'
|
||||||
|
groups: "baz"
|
||||||
password_hash: 'sdfgsdfgsdfgsdfg'
|
password_hash: 'sdfgsdfgsdfgsdfg'
|
||||||
ssh_key: 'ssh-rsa AZERTYXYZ'
|
ssh_key: 'ssh-rsa AZERTYXYZ'
|
||||||
bar:
|
bar:
|
||||||
name: bar
|
name: bar
|
||||||
uid: 1002
|
uid: 1002
|
||||||
fullname: 'Mr Bar'
|
fullname: 'Mr Bar'
|
||||||
|
groups:
|
||||||
|
- "baz"
|
||||||
|
- "qux"
|
||||||
password_hash: 'gsdfgsdfgsdfgsdf'
|
password_hash: 'gsdfgsdfgsdfgsdf'
|
||||||
ssh_key: 'ssh-rsa QWERTYUIOP'
|
ssh_keys:
|
||||||
|
- 'ssh-rsa QWERTYUIOP'
|
||||||
|
- 'ssh-ed25519 QWERTYUIOP'
|
||||||
```
|
```
|
3
evolinux-users/defaults/main.yml
Normal file
3
evolinux-users/defaults/main.yml
Normal file
|
@ -0,0 +1,3 @@
|
||||||
|
---
|
||||||
|
evolinux_users: {}
|
||||||
|
evolinux_sudo_group: "evolinux-sudo"
|
|
@ -1,6 +1,6 @@
|
||||||
galaxy_info:
|
galaxy_info:
|
||||||
author: Evolix
|
author: Evolix
|
||||||
description: Creates admin users accounts.
|
description: Creates evolinux users accounts.
|
||||||
|
|
||||||
issue_tracker_url: https://forge.evolix.org/projects/ansible-roles/issues
|
issue_tracker_url: https://forge.evolix.org/projects/ansible-roles/issues
|
||||||
|
|
|
@ -35,19 +35,22 @@
|
||||||
update_password: on_create
|
update_password: on_create
|
||||||
when: loginisbusy.rc != 0 and uidisbusy.rc == 0
|
when: loginisbusy.rc != 0 and uidisbusy.rc == 0
|
||||||
|
|
||||||
- name: "Create {{ admin_users_group }} group (Debian 9 or later)"
|
- name: "Create secondary groups"
|
||||||
group:
|
group:
|
||||||
name: "{{ admin_users_group }}"
|
name: "{{ group }}"
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
with_items: "{{ user.groups }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: group
|
||||||
|
when: user.groups is defined
|
||||||
|
|
||||||
- name: "Add user to {{ admin_users_group }} group (Debian 9 or later)"
|
- name: "Add user '{{ user.name }}' to secondary groups"
|
||||||
user:
|
user:
|
||||||
name: '{{ user.name }}'
|
name: '{{ user.name }}'
|
||||||
groups: '{{ admin_users_group }}'
|
groups: "{{ user.groups }}"
|
||||||
append: yes
|
append: yes
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
when: user.groups is defined
|
||||||
|
|
||||||
- name: "Fix perms on homedirectory for '{{ user.name }}'"
|
- name: "Fix perms on home directory for '{{ user.name }}'"
|
||||||
file:
|
file:
|
||||||
name: '/home/{{ user.name }}'
|
name: '/home/{{ user.name }}'
|
||||||
mode: "0700"
|
mode: "0700"
|
|
@ -6,11 +6,11 @@
|
||||||
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')
|
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')
|
||||||
|
|
||||||
- debug:
|
- debug:
|
||||||
msg: "Warning: empty 'admin_users' variable, tasks will be skipped!"
|
msg: "Warning: empty 'evolinux_users' variable, tasks will be skipped!"
|
||||||
when: admin_users == {}
|
when: evolinux_users == {}
|
||||||
|
|
||||||
- include: admin_user.yml
|
- include: user.yml
|
||||||
vars:
|
vars:
|
||||||
user: "{{ item.value }}"
|
user: "{{ item.value }}"
|
||||||
with_dict: "{{ admin_users }}"
|
with_dict: "{{ evolinux_users }}"
|
||||||
when: admin_users != {}
|
when: evolinux_users != {}
|
|
@ -14,6 +14,17 @@
|
||||||
user: "{{ user.name }}"
|
user: "{{ user.name }}"
|
||||||
key: "{{ user.ssh_key }}"
|
key: "{{ user.ssh_key }}"
|
||||||
state: present
|
state: present
|
||||||
|
when: user.ssh_key is defined
|
||||||
|
|
||||||
|
- name: "Add user's SSH public keys for '{{ user.name }}'"
|
||||||
|
authorized_key:
|
||||||
|
user: "{{ user.name }}"
|
||||||
|
key: "{{ ssk_key }}"
|
||||||
|
state: present
|
||||||
|
with_items: "{{ user.ssh_keys }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: ssk_key
|
||||||
|
when: user.ssh_keys is defined
|
||||||
|
|
||||||
# we must double-escape caracters, because python
|
# we must double-escape caracters, because python
|
||||||
- name: verify AllowUsers directive
|
- name: verify AllowUsers directive
|
18
evolinux-users/tasks/sudo_jessie.yml
Normal file
18
evolinux-users/tasks/sudo_jessie.yml
Normal file
|
@ -0,0 +1,18 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- name: "Verify Evolinux sudoers file presence (jessie)"
|
||||||
|
template:
|
||||||
|
src: sudoers_jessie.j2
|
||||||
|
dest: /etc/sudoers.d/evolinux
|
||||||
|
force: no
|
||||||
|
mode: "0440"
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
register: copy_sudoers_evolinux
|
||||||
|
|
||||||
|
- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
|
||||||
|
replace:
|
||||||
|
dest: /etc/sudoers.d/evolinux
|
||||||
|
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
|
||||||
|
replace: '\1,{{ user.name }}'
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
when: not copy_sudoers_evolinux.changed
|
20
evolinux-users/tasks/sudo_stretch.yml
Normal file
20
evolinux-users/tasks/sudo_stretch.yml
Normal file
|
@ -0,0 +1,20 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
||||||
|
template:
|
||||||
|
src: sudoers_stretch.j2
|
||||||
|
dest: /etc/sudoers.d/evolinux
|
||||||
|
force: no
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
register: copy_sudoers_evolinux
|
||||||
|
|
||||||
|
- name: "Create evolinux-sudo group (Debian 9 or later)"
|
||||||
|
group:
|
||||||
|
name: "{{ evolinux_sudo_group }}"
|
||||||
|
system: yes
|
||||||
|
|
||||||
|
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
||||||
|
user:
|
||||||
|
name: '{{ user.name }}'
|
||||||
|
groups: "{{ evolinux_sudo_group }}"
|
||||||
|
append: yes
|
15
evolinux-users/tasks/user.yml
Normal file
15
evolinux-users/tasks/user.yml
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- include: account.yml
|
||||||
|
|
||||||
|
- include: profile.yml
|
||||||
|
|
||||||
|
- include: ssh.yml
|
||||||
|
|
||||||
|
- include: sudo_jessie.yml
|
||||||
|
when: ansible_distribution_release == "jessie"
|
||||||
|
|
||||||
|
- include: sudo_stretch.yml
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||||
|
|
||||||
|
- meta: flush_handlers
|
|
@ -5,5 +5,5 @@ Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh, /usr/share/scripts
|
||||||
nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs
|
nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs
|
||||||
nagios ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt
|
nagios ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt
|
||||||
|
|
||||||
%evolinux-sudo ALL=(ALL:ALL) ALL
|
%{{ evolinux_sudo_group }} ALL=(ALL:ALL) ALL
|
||||||
%evolinux-sudo ALL = NOPASSWD: MAINT
|
%{{ evolinux_sudo_group }} ALL = NOPASSWD: MAINT
|
|
@ -2,7 +2,7 @@
|
||||||
- hosts: test-kitchen
|
- hosts: test-kitchen
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
admin_users:
|
evolinux_users:
|
||||||
foo:
|
foo:
|
||||||
name: foo
|
name: foo
|
||||||
uid: 1001
|
uid: 1001
|
||||||
|
@ -20,4 +20,4 @@
|
||||||
# state: directory
|
# state: directory
|
||||||
|
|
||||||
roles:
|
roles:
|
||||||
- role: admin-users
|
- role: evolinux-users
|
|
@ -1,4 +1,4 @@
|
||||||
# PHP-FPM
|
# Memcached
|
||||||
|
|
||||||
Installation and basic configuration of memcached
|
Installation and basic configuration of memcached
|
||||||
|
|
||||||
|
|
|
@ -17,6 +17,7 @@
|
||||||
dest: /etc/nagios/nrpe.d/evolix.cfg
|
dest: /etc/nagios/nrpe.d/evolix.cfg
|
||||||
group: nagios
|
group: nagios
|
||||||
mode: "0640"
|
mode: "0640"
|
||||||
|
force: no
|
||||||
notify: restart nagios-nrpe-server
|
notify: restart nagios-nrpe-server
|
||||||
|
|
||||||
- name: Nagios config is secured
|
- name: Nagios config is secured
|
||||||
|
|
|
@ -4,7 +4,7 @@ Install the web pack, with Apache.
|
||||||
|
|
||||||
## Tasks
|
## Tasks
|
||||||
|
|
||||||
Everything is in the `tasks/main.yml` file for now.
|
See `tasks/main.yml`.
|
||||||
|
|
||||||
## Available variables
|
## Available variables
|
||||||
|
|
||||||
|
|
|
@ -9,4 +9,4 @@ postgresql_random_page_cost: 1.5
|
||||||
postgresql_effective_cache_size: "{{ (ansible_memtotal_mb * 0.5) | int }}MB"
|
postgresql_effective_cache_size: "{{ (ansible_memtotal_mb * 0.5) | int }}MB"
|
||||||
|
|
||||||
# PostgreSQL version
|
# PostgreSQL version
|
||||||
postgresql_version: '9.4'
|
postgresql_version: '9.6'
|
||||||
|
|
|
@ -1,9 +1,10 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- include: pgdg-repo.yml
|
- include: packages_jessie.yml
|
||||||
when: postgresql_version != '9.4'
|
when: ansible_distribution_release == "jessie"
|
||||||
|
|
||||||
- include: packages.yml
|
- include: packages_stretch.yml
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||||
|
|
||||||
- include: config.yml
|
- include: config.yml
|
||||||
|
|
||||||
|
|
11
postgresql/tasks/packages_jessie.yml
Normal file
11
postgresql/tasks/packages_jessie.yml
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- include: pgdg-repo.yml
|
||||||
|
when: postgresql_version != '9.4'
|
||||||
|
|
||||||
|
- name: Install postgresql package
|
||||||
|
apt:
|
||||||
|
name: '{{item}}'
|
||||||
|
with_items:
|
||||||
|
- "postgresql-{{postgresql_version}}"
|
||||||
|
- ptop
|
|
@ -4,5 +4,5 @@
|
||||||
apt:
|
apt:
|
||||||
name: '{{item}}'
|
name: '{{item}}'
|
||||||
with_items:
|
with_items:
|
||||||
- "postgresql-{{postgresql_version}}"
|
- postgresql
|
||||||
- ptop
|
- ptop
|
|
@ -3,7 +3,7 @@ shared_buffers = {{ postgresql_shared_buffers }}
|
||||||
work_mem = {{ postgresql_work_mem }}
|
work_mem = {{ postgresql_work_mem }}
|
||||||
#shared_preload_libraries = 'pg_stat_statements'
|
#shared_preload_libraries = 'pg_stat_statements'
|
||||||
#synchronous_commit = off
|
#synchronous_commit = off
|
||||||
{% if postgresql_version |version_compare('9.5', '<') %}
|
{% if postgresql_version | version_compare('9.5', '<') %}
|
||||||
checkpoint_segments = 30
|
checkpoint_segments = 30
|
||||||
{% else %}
|
{% else %}
|
||||||
max_wal_size = 15GB
|
max_wal_size = 15GB
|
||||||
|
|
1
proftpd/files/vpasswd
Normal file
1
proftpd/files/vpasswd
Normal file
|
@ -0,0 +1 @@
|
||||||
|
# username:password:uid:gid:gecos:homedir:shell
|
|
@ -32,3 +32,12 @@
|
||||||
notify: restart proftpd
|
notify: restart proftpd
|
||||||
tags:
|
tags:
|
||||||
- proftpd
|
- proftpd
|
||||||
|
|
||||||
|
- name: Put empty vpasswd file if missing
|
||||||
|
copy:
|
||||||
|
src: vpasswd
|
||||||
|
dest: /etc/proftpd/vpasswd
|
||||||
|
force: no
|
||||||
|
mode: "0440"
|
||||||
|
tags:
|
||||||
|
- proftpd
|
||||||
|
|
|
@ -16,6 +16,7 @@ Main variables are :
|
||||||
* `redis_conf_path`: config file location ;
|
* `redis_conf_path`: config file location ;
|
||||||
* `redis_port`: listening TCP port ;
|
* `redis_port`: listening TCP port ;
|
||||||
* `redis_bind_interface`: listening IP address ;
|
* `redis_bind_interface`: listening IP address ;
|
||||||
|
* `redis_password`: password for redis. Empty means no password ;
|
||||||
* `redis_unixsocket`: Unix socket ;
|
* `redis_unixsocket`: Unix socket ;
|
||||||
* `redis_loglevel`: log verbosity ;
|
* `redis_loglevel`: log verbosity ;
|
||||||
* `redis_logfile`: log file location.
|
* `redis_logfile`: log file location.
|
||||||
|
|
|
@ -7,6 +7,8 @@ redis_bind_interface: 127.0.0.1
|
||||||
redis_unixsocket: '/var/run/redis/redis.sock'
|
redis_unixsocket: '/var/run/redis/redis.sock'
|
||||||
redis_timeout: 300
|
redis_timeout: 300
|
||||||
|
|
||||||
|
redis_password: NULL
|
||||||
|
|
||||||
redis_loglevel: "notice"
|
redis_loglevel: "notice"
|
||||||
redis_logfile: /var/log/redis/redis-server.log
|
redis_logfile: /var/log/redis/redis-server.log
|
||||||
|
|
||||||
|
|
|
@ -8,3 +8,8 @@
|
||||||
service:
|
service:
|
||||||
name: munin-node
|
name: munin-node
|
||||||
state: restarted
|
state: restarted
|
||||||
|
|
||||||
|
- name: restart nagios-nrpe-server
|
||||||
|
service:
|
||||||
|
name: nagios-nrpe-server
|
||||||
|
state: restarted
|
||||||
|
|
|
@ -1,8 +1,11 @@
|
||||||
---
|
---
|
||||||
- name: Redis is installed.
|
- name: Redis is installed.
|
||||||
apt:
|
apt:
|
||||||
name: redis-server
|
name: "{{ item }}"
|
||||||
state: present
|
state: present
|
||||||
|
with_items:
|
||||||
|
- redis-server
|
||||||
|
- redis-tools
|
||||||
tags:
|
tags:
|
||||||
- redis
|
- redis
|
||||||
- packages
|
- packages
|
||||||
|
@ -31,3 +34,12 @@
|
||||||
|
|
||||||
- include: munin.yml
|
- include: munin.yml
|
||||||
when: _munin_installed.stat.exists and _munin_installed.stat.isdir
|
when: _munin_installed.stat.exists and _munin_installed.stat.isdir
|
||||||
|
|
||||||
|
- name: is NRPE present ?
|
||||||
|
stat:
|
||||||
|
path: /etc/nagios/nrpe.d/evolix.cfg
|
||||||
|
check_mode: no
|
||||||
|
register: nrpe_evolix_config
|
||||||
|
|
||||||
|
- include: nrpe_stretch.yml
|
||||||
|
when: ansible_distribution_release == "stretch" and nrpe_evolix_config.stat.exists == true
|
||||||
|
|
|
@ -60,3 +60,25 @@
|
||||||
- used_memory
|
- used_memory
|
||||||
notify: restart munin-node
|
notify: restart munin-node
|
||||||
tags: redis
|
tags: redis
|
||||||
|
|
||||||
|
- name: Count redis condif blocks in munin-node configuration
|
||||||
|
command: grep -c "\[redis_" /etc/munin/plugin-conf.d/munin-node
|
||||||
|
register: munin_redis_blocs_in_config
|
||||||
|
failed_when: False
|
||||||
|
changed_when: False
|
||||||
|
|
||||||
|
- name: Add redis password for munin (if no more than 1 config block)
|
||||||
|
ini_file:
|
||||||
|
dest: /etc/munin/plugin-conf.d/munin-node
|
||||||
|
section: 'redis_*'
|
||||||
|
option: env.password
|
||||||
|
value: '{{ redis_password }}'
|
||||||
|
notify: restart munin-node
|
||||||
|
when: "redis_password != '' and redis_password != None and {{munin_redis_blocs_in_config.stdout | int}} <= 1"
|
||||||
|
tags: redis
|
||||||
|
|
||||||
|
|
||||||
|
- name: Warn if multiple instance in munin-plugins configuration
|
||||||
|
debug:
|
||||||
|
msg: "WARNING - It seems you have multiple redis sections in your munin-node configuration - Munin config NOT changed"
|
||||||
|
when: "redis_password != '' and redis_password != None and {{munin_redis_blocs_in_config.stdout | int}} > 1 "
|
||||||
|
|
15
redis/tasks/nrpe_stretch.yml
Normal file
15
redis/tasks/nrpe_stretch.yml
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
- name: Install perl lib-redis (needed by check_redis)
|
||||||
|
apt:
|
||||||
|
name: libredis-perl
|
||||||
|
state: present
|
||||||
|
tags:
|
||||||
|
- redis
|
||||||
|
- nrpe
|
||||||
|
|
||||||
|
- name: Replace check_tcp by check_redis for NRPE
|
||||||
|
replace:
|
||||||
|
dest: /etc/nagios/nrpe.d/evolix.cfg
|
||||||
|
regexp: '^command\[check_redis\]=\/usr\/lib\/nagios\/plugins\/check_tcp -p 6379'
|
||||||
|
replace: 'command[check_redis]=/usr/lib/nagios/plugins/check_redis -H 127.0.0.1'
|
||||||
|
notify: restart nagios-nrpe-server
|
|
@ -7,6 +7,10 @@ bind {{ redis_bind_interface }}
|
||||||
unixsocket {{ redis_unixsocket }}
|
unixsocket {{ redis_unixsocket }}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
|
{% if redis_password %}
|
||||||
|
requirepass {{ redis_password }}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
timeout {{ redis_timeout }}
|
timeout {{ redis_timeout }}
|
||||||
|
|
||||||
loglevel {{ redis_loglevel }}
|
loglevel {{ redis_loglevel }}
|
||||||
|
|
Loading…
Reference in a new issue