ansible-personal/roles/common/tasks/main.yml

---
- name: Import OS-specific variables
  ansible.builtin.include_vars: "vars/{{ ansible_distribution }}.yml"
  tags: always

- name: Configure network time
  ansible.builtin.import_tasks: ntp.yml
  tags: ntp

- name: Install common packages
  ansible.builtin.include_tasks: packages_Debian.yml
  when: ansible_distribution == 'Debian'
  tags: packages

- name: Install common packages
  ansible.builtin.include_tasks: packages_Ubuntu.yml
  when: ansible_distribution == 'Ubuntu'
  tags: packages

- name: Configure firewall
  ansible.builtin.include_tasks: firewall_Debian.yml
  when: ansible_distribution == 'Debian'
  tags: firewall

- name: Configure firewall
  ansible.builtin.include_tasks: firewall_Ubuntu.yml
  when: ansible_distribution == 'Ubuntu'
  tags: firewall

- name: Configure secure shell daemon
  ansible.builtin.import_tasks: sshd.yml
  tags: sshd

# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
- name: Reconfigure /etc/sysctl.conf
  when: ansible_virtualization_role != 'host'
  ansible.builtin.template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
  notify:
    - reload sysctl
  tags: sysctl

- name: Reconfigure /etc/rc.local
  when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('19.04', '<=')
  ansible.builtin.template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755

- name: Set I/O scheduler
  ansible.builtin.template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
  tags: udev

- name: Copy admin SSH keys
  ansible.builtin.import_tasks: ssh-keys.yml
  tags: ssh-keys

# vim: set sw=2 ts=2:
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
Import OS-specific vars from task in common role We stopped being able to do dynamic includes from the playbooks around Ansible 2.4.0.0 if I recall correctly. Instead we can create a task to include the variables and make it always run by using the special tag. For now the Debian and Ubuntu vars files are the same, but I will keep them separate so that it is more flexible in the future. 2018-04-25 17:00:56 +02:00			`- name: Import OS-specific variables`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.include_vars: "vars/{{ ansible_distribution }}.yml"`
Import OS-specific vars from task in common role We stopped being able to do dynamic includes from the playbooks around Ansible 2.4.0.0 if I recall correctly. Instead we can create a task to include the variables and make it always run by using the special tag. For now the Debian and Ubuntu vars files are the same, but I will keep them separate so that it is more flexible in the future. 2018-04-25 17:00:56 +02:00			`tags: always`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named 2017-10-03 14:02:38 +02:00			`- name: Configure network time`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.import_tasks: ntp.yml`
roles/common: Use systemd's timedatectl for time stuff Debian 8 and Ubuntu 16.04 use systemd, so we can make use of its NTP stuff rather than using the standalone `ntp` package. 2016-06-27 09:30:11 +02:00			`tags: ntp`

Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named 2017-10-03 14:02:38 +02:00			`- name: Install common packages`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.include_tasks: packages_Debian.yml`
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14. 2017-11-05 00:51:49 +01:00			`when: ansible_distribution == 'Debian'`
			`tags: packages`

			`- name: Install common packages`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.include_tasks: packages_Ubuntu.yml`
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14. 2017-11-05 00:51:49 +01:00			`when: ansible_distribution == 'Ubuntu'`
roles/common: Add playbook for Debian packages Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-07-24 18:52:54 +02:00			`tags: packages`

Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named 2017-10-03 14:02:38 +02:00			`- name: Configure firewall`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.include_tasks: firewall_Debian.yml`
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14. 2017-11-05 00:51:49 +01:00			`when: ansible_distribution == 'Debian'`
			`tags: firewall`

			`- name: Configure firewall`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.include_tasks: firewall_Ubuntu.yml`
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14. 2017-11-05 00:51:49 +01:00			`when: ansible_distribution == 'Ubuntu'`
roles/common: Move tags from subtask to main one Child tasks inherit the tag of the parent. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:33:48 +01:00			`tags: firewall`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named 2017-10-03 14:02:38 +02:00			`- name: Configure secure shell daemon`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.import_tasks: sshd.yml`
roles/common: Add DSA/ECDSA cleanup to ssh tasks We don't want to support these signature algorithms! Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-01-20 14:28:06 +01:00			`tags: sshd`

roles/common: Add sysctl template for Debian hosts Note: I've only tested this on a Debian container, and you can't set these sysctls on containers (the host controls them). To make matters worse, there is no fact to make ansible skip this on hosts that are running in containers. For now I will just skip it on hosts that are "virtualization" servers... even though we actually do have KVM running on Debian on real hardware. sigh Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:12:17 +02:00			`# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`- name: Reconfigure /etc/sysctl.conf`
roles/common: Add sysctl template for Debian hosts Note: I've only tested this on a Debian container, and you can't set these sysctls on containers (the host controls them). To make matters worse, there is no fact to make ansible skip this on hosts that are running in containers. For now I will just skip it on hosts that are "virtualization" servers... even though we actually do have KVM running on Debian on real hardware. sigh Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:12:17 +02:00			`when: ansible_virtualization_role != 'host'`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`notify:`
roles/common: Indent some yaml stuff in main.yml Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:31:29 +01:00			`- reload sysctl`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`tags: sysctl`

			`- name: Reconfigure /etc/rc.local`
roles/common: Update list of abusive IP addresses This comes from the AbuseIPDB with a confidence level of 95%. I use the following command to download and sort the IPs: $ curl -G https://api.abuseipdb.com/api/v2/blacklist -d \ confidenceMinimum=95 -H "Key: $ABUSEIPDB_API_KEY" \ -H "Accept: text/plain" \| sort \| sed -e '/:/w /tmp/ipv6.txt' \ -e '/:/d' > /tmp/ipv4.txt I manually add the XML formatting to each file and run them through tidy: $ tidy -xml -utf8 -m -iq -w 0 roles/common/files/abusers-ipv4.xml $ tidy -xml -utf8 -m -iq -w 0 roles/common/files/abusers-ipv6.xml 2020-11-06 14:44:57 +01:00			`when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('19.04', '<=')`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
roles/common: Set I/O scheduler via udev All servers with non-rotating disks (SSDs) should be running noop, and the rest should be running deadline. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:52:05 +01:00			`- name: Set I/O scheduler`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644`
roles/common: Set I/O scheduler via udev All servers with non-rotating disks (SSDs) should be running noop, and the rest should be running deadline. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-03-15 15:52:05 +01:00			`tags: udev`

Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named 2017-10-03 14:02:38 +02:00			`- name: Copy admin SSH keys`
roles: use fully qualified module names 2022-09-10 17:09:12 +02:00			`ansible.builtin.import_tasks: ssh-keys.yml`
roles/common: Add functionality to copy user keys to provisioning user Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-10-11 11:13:45 +02:00			`tags: ssh-keys`

Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`# vim: set sw=2 ts=2:`