From ca15a298d0cc0ec8223ac7900514fd59b741f085 Mon Sep 17 00:00:00 2001 From: Mark Hoekveen Date: Sun, 5 Jan 2025 17:02:29 +0100 Subject: [PATCH] update --- ansible.cfg | 1 + group_vars/cloud.yml | 6 +++ group_vars/debian.yml | 3 ++ group_vars/home.yml | 2 + host_vars/todd-test.yml | 2 + inventory.yml | 15 +++++++ playbook.yml | 78 ++++++++++++++++++++++++++++----- preprovision.yml | 61 ++++++++++++++++++++++++++ tasks/install_docker_debian.yml | 36 +++++++++++++++ 9 files changed, 192 insertions(+), 12 deletions(-) create mode 100644 group_vars/cloud.yml create mode 100644 group_vars/home.yml create mode 100644 host_vars/todd-test.yml create mode 100644 preprovision.yml create mode 100644 tasks/install_docker_debian.yml diff --git a/ansible.cfg b/ansible.cfg index e731516..da1f5cc 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -3,6 +3,7 @@ inventory=inventory.yml host_key_checking=False editor=vim nocows=1 +remote_user=nerevar # (string) Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are ``auto`` (the default), ``auto_silent``, ``auto_legacy``, and ``auto_legacy_silent``. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting ``auto_silent`` or ``auto_legacy_silent``. The value of ``auto_legacy`` provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to ``/usr/bin/python``, will use that interpreter if present. interpreter_python=auto_silent diff --git a/group_vars/cloud.yml b/group_vars/cloud.yml new file mode 100644 index 0000000..f653cd1 --- /dev/null +++ b/group_vars/cloud.yml @@ -0,0 +1,6 @@ +users: + - mark + - martijn + - jp + - lourens + - guus diff --git a/group_vars/debian.yml b/group_vars/debian.yml index 3c59fa4..c327fd7 100644 --- a/group_vars/debian.yml +++ b/group_vars/debian.yml @@ -1,5 +1,8 @@ common_packages: - vim + - git + - ca-certificates + - curl - tmux - python3 - python3-pip diff --git a/group_vars/home.yml b/group_vars/home.yml new file mode 100644 index 0000000..d7c99a6 --- /dev/null +++ b/group_vars/home.yml @@ -0,0 +1,2 @@ +users: + - mark diff --git a/host_vars/todd-test.yml b/host_vars/todd-test.yml new file mode 100644 index 0000000..d7c99a6 --- /dev/null +++ b/host_vars/todd-test.yml @@ -0,0 +1,2 @@ +users: + - mark diff --git a/inventory.yml b/inventory.yml index 772d1e6..5552eb0 100644 --- a/inventory.yml +++ b/inventory.yml @@ -1,19 +1,31 @@ rpi: hosts: vaermina: + ansible_host: 192.168.178.95 azura: + ansible_host: 192.168.178.94 kynareth: + ansible_host: 192.168.178.96 nocturnal: + ansible_host: 192.168.178.56 x86: hosts: talos: + ansible_host: 192.168.178.64 meridia: + ansible_host: 62.171.176.43 dibella: + ansible_host: 45.88.188.77 + todd-test: debian: hosts: vaermina: talos: nocturnal: + todd-test: + # Local test VM + ansible_port: 3022 + ansible_host: 127.0.0.1 arch: hosts: azura: @@ -27,6 +39,9 @@ home: kynareth: nocturnal: talos: +virtual: + hosts: + todd-test: cloud: hosts: meridia: diff --git a/playbook.yml b/playbook.yml index bda1d0e..a334004 100644 --- a/playbook.yml +++ b/playbook.yml @@ -2,20 +2,74 @@ hosts: all become: true tasks: - - name: >- - Allow mark to passwordless sudo all commands. - (First run should be with --ask-become-pass) - community.general.sudoers: - name: mark-sudo - state: present - user: mark - commands: ALL - name: Set hostname hostname: name: "{{ inventory_hostname }}" - - name: Update debian + - name: Print distribution + ansible.builtin.debug: + #var: ansible_facts ansible_distribution_release + var: ansible_distribution_release + - name: Add aurbis group + ansible.builtin.group: + name: aurbis + state: present + - name: Create users + ansible.builtin.user: + name: "{{ item }}" + groups: + - aurbis + - sudo + - wheel + append: true + shell: /bin/bash + state: present + when: users is defined + loop: "{{ users }}" + - name: Add IP address of relevant hosts to /etc/hosts + lineinfile: + dest: /etc/hosts + regexp: ".*{{ item }}$" + line: "{{ hostvars[item].ansible_host }} {{item}}" + state: present + when: + - hostvars[item].ansible_host is defined + - (inventory_hostname in groups['home'] and (item in groups['home'] or item in groups['cloud'])) or + (inventory_hostname not in groups['home'] and item in groups['cloud']) + with_items: "{{ groups.all }}" +- name: Update Debian hosts + hosts: debian + become: true + tasks: + - name: Update include_tasks: tasks/update_debian.yml - when: ansible_os_family == "Debian" - - name: Update arch +- name: Update Arch hosts + hosts: arch + become: true + tasks: + - name: Update include_tasks: tasks/update_arch.yml - when: ansible_os_family == "Archlinux" +- name: Docker + hosts: debian + become: true + tasks: + - name: Update + include_tasks: tasks/install_docker_debian.yml +- name: Add utility scripts + hosts: all + become: true + tasks: + - name: Git clone + ansible.builtin.git: + repo: https://git.hoekveen.net/mark/scripts.git + dest: /opt/scripts + force: true + - name: Set permissions and ownership for scripts folder + file: + path: /opt/scripts + state: directory + recurse: true + group: aurbis + mode: "0775" + - name: Add scripts directory to safe.directory + ansible.builtin.command: + cmd: git config --system --add safe.directory /opt/scripts diff --git a/preprovision.yml b/preprovision.yml new file mode 100644 index 0000000..424aa5b --- /dev/null +++ b/preprovision.yml @@ -0,0 +1,61 @@ +# Creates ansible user with passwordless sudo +# Needs root ssh access +# ensures that login is possible +# disables root user. +- name: >- + Pre-provision a bare host. + Adds execution user. + hosts: all + vars: + ansible_user: root + # Put root password in here temporarily, just don't commit it + ansible_password: root + # Root password will be cleared later + tasks: + # - name: Print all available facts + # ansible.builtin.debug: + # var: ansible_facts + - name: Add sudo group + ansible.builtin.group: + name: sudo + state: present + - name: Add wheel group + ansible.builtin.group: + name: wheel + state: present + - name: Add ansible user + ansible.builtin.user: + name: nerevar + append: true + generate_ssh_key: true + groups: + - sudo + - wheel + - name: Add local user key + ansible.posix.authorized_key: + user: nerevar + state: present + key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}" + - name: >- + Allow ansible user to passwordless sudo all commands. + community.general.sudoers: + name: nerevar-sudo + state: present + user: nerevar + commands: ALL + - name: Lock root password + ansible.builtin.user: + name: root + password_lock: true + - name: Disable root SSH login + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: "^PermitRootLogin" + line: "PermitRootLogin no" + validate: "/usr/sbin/sshd -t -f %s" + notify: Restart sshd + handlers: + - name: Restart sshd + ansible.builtin.service: + name: ssh + state: restarted diff --git a/tasks/install_docker_debian.yml b/tasks/install_docker_debian.yml new file mode 100644 index 0000000..9dbe52e --- /dev/null +++ b/tasks/install_docker_debian.yml @@ -0,0 +1,36 @@ +- name: Install required system packages + apt: + name: + - ca-certificates + - curl + state: latest + update_cache: true +- name: Create /etc/apt/keyrings directory + file: + path: /etc/apt/keyrings + state: directory + mode: "0755" +- name: Add Docker GPG apt Key + get_url: + url: https://download.docker.com/linux/debian/gpg + dest: /etc/apt/keyrings/docker.asc + mode: "0755" +- name: Add Docker Repository + apt_repository: + repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian {{ansible_distribution_release}} stable + state: present +- name: Update apt and install Docker packages + apt: + name: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-buildx-plugin + - docker-compose-plugin + state: latest + update_cache: true +- name: Add mark to the Docker group + user: + name: mark + groups: docker + append: yes