ansible-personal/roles/common/tasks/main.yml

---
#- name: Add hostname to /etc/hosts
#  lineinfile: dest=/etc/hosts insertafter=^127.0.0.1 line='127.0.1.1       {{ inventory_hostname }}'
#  tags: hostname

- name: Set timezone
  when: timezone is defined
  command: /usr/bin/timedatectl set-timezone {{ timezone }}
  tags: timezone

- name: Enable NTP
  service: name=systemd-timesyncd enabled=yes
  tags: ntp

- include: packages_{{ ansible_distribution }}.yml
  tags: packages

- include: iptables_{{ ansible_distribution }}.yml
  tags: firewall

- include: sshd.yml
  tags: sshd

# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
- name: Reconfigure /etc/sysctl.conf
  when: ansible_virtualization_role != 'host'
  template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
  notify:
    - reload sysctl
  tags: sysctl

- name: Reconfigure /etc/rc.local
  when: ansible_distribution == 'Ubuntu'
  template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755

- name: Set I/O scheduler
  template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
  tags: udev

- include: ssh-keys.yml
  tags: ssh-keys

# vim: set sw=2 ts=2:
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
			`#- name: Add hostname to /etc/hosts`
			`# lineinfile: dest=/etc/hosts insertafter=^127.0.0.1 line='127.0.1.1 {{ inventory_hostname }}'`
			`# tags: hostname`

roles/common: Use systemd's timedatectl for time stuff Debian 8 and Ubuntu 16.04 use systemd, so we can make use of its NTP stuff rather than using the standalone `ntp` package. 2016-06-27 09:30:11 +02:00			`- name: Set timezone`
			`when: timezone is defined`
			`command: /usr/bin/timedatectl set-timezone {{ timezone }}`
			`tags: timezone`

			`- name: Enable NTP`
roles/common: Use service module to enable systemd NTP client instead of timedatectl The `timedatectl set-ntp on` command is actually just enabling the systemd service anyways, so it's better we use Ansible's service module. 2016-08-22 11:49:00 +02:00			`service: name=systemd-timesyncd enabled=yes`
roles/common: Use systemd's timedatectl for time stuff Debian 8 and Ubuntu 16.04 use systemd, so we can make use of its NTP stuff rather than using the standalone `ntp` package. 2016-06-27 09:30:11 +02:00			`tags: ntp`

roles/common: Use ansible facts to reduce includes 2016-08-22 15:34:05 +02:00			`- include: packages_{{ ansible_distribution }}.yml`
roles/common: Add playbook for Debian packages Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-07-24 18:52:54 +02:00			`tags: packages`

roles/common: Use ansible facts to reduce includes 2016-08-22 15:34:05 +02:00			`- include: iptables_{{ ansible_distribution }}.yml`
roles/common: Move tags from subtask to main one Child tasks inherit the tag of the parent. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:33:48 +01:00			`tags: firewall`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
roles/common: Move sshd tasks to their own playbook Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:00:43 +02:00			`- include: sshd.yml`
roles/common: Add DSA/ECDSA cleanup to ssh tasks We don't want to support these signature algorithms! Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-01-20 14:28:06 +01:00			`tags: sshd`

roles/common: Add sysctl template for Debian hosts Note: I've only tested this on a Debian container, and you can't set these sysctls on containers (the host controls them). To make matters worse, there is no fact to make ansible skip this on hosts that are running in containers. For now I will just skip it on hosts that are "virtualization" servers... even though we actually do have KVM running on Debian on real hardware. sigh Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:12:17 +02:00			`# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`- name: Reconfigure /etc/sysctl.conf`
roles/common: Add sysctl template for Debian hosts Note: I've only tested this on a Debian container, and you can't set these sysctls on containers (the host controls them). To make matters worse, there is no fact to make ansible skip this on hosts that are running in containers. For now I will just skip it on hosts that are "virtualization" servers... even though we actually do have KVM running on Debian on real hardware. sigh Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:12:17 +02:00			`when: ansible_virtualization_role != 'host'`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644`
			`notify:`
roles/common: Indent some yaml stuff in main.yml Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:31:29 +01:00			`- reload sysctl`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`tags: sysctl`

			`- name: Reconfigure /etc/rc.local`
roles/common: Fix one logic mistake in rc.local task I think it was originally supposed to be `ansible_os_family` but we don't have anything other than Ubuntu, so let's just use that. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:43:21 +01:00			`when: ansible_distribution == 'Ubuntu'`
roles/common: Don't use ansible facts when we don't need to No use testing the distro version only to use an ansible fact to find the correct template. 2016-08-24 09:11:13 +02:00			`template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
roles/common: Set I/O scheduler via udev All servers with non-rotating disks (SSDs) should be running noop, and the rest should be running deadline. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:52:05 +01:00			`- name: Set I/O scheduler`
			`template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644`
			`tags: udev`

roles/common: Add functionality to copy user keys to provisioning user Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-10-11 11:13:45 +02:00			`- include: ssh-keys.yml`
			`tags: ssh-keys`

Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`# vim: set sw=2 ts=2:`