alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
aa63f5946c
ansible-personal/roles/common/tasks/main.yml

60 lines
1.7 KiB
YAML
Raw Normal View History

Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
---
Import OS-specific vars from task in common role We stopped being able to do dynamic includes from the playbooks around Ansible 2.4.0.0 if I recall correctly. Instead we can create a task to include the variables and make it always run by using the special tag. For now the Debian and Ubuntu vars files are the same, but I will keep them separate so that it is more flexible in the future.
2018-04-25 17:00:56 +02:00
- name: Import OS-specific variables
include_vars: "vars/{{ ansible_distribution }}.yml"
tags: always
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named
2017-10-03 14:02:38 +02:00
- name: Configure network time
import_tasks: ntp.yml
roles/common: Use systemd's timedatectl for time stuff Debian 8 and Ubuntu 16.04 use systemd, so we can make use of its NTP stuff rather than using the standalone `ntp` package.
2016-06-27 09:30:11 +02:00
tags: ntp
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named
2017-10-03 14:02:38 +02:00
- name: Install common packages
roles/common: Use dynamic include_tasks for packages Basically, when using conditionals or variables in your tasks you should use include_tasks instead of import_tasks. The down side is that you now need to tag all included tasks individually or with a block, unlike when using static imports (tags are applied to all imported child tasks). I would actually like to reduce this task to a single one that uses the host's ansible_distribution variable, but Ansible 2.5.1 currently gives the following error: ansible_distribution is undefined.
2018-04-25 17:46:28 +02:00
include_tasks: packages_Debian.yml
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14.
2017-11-05 00:51:49 +01:00
when: ansible_distribution == 'Debian'
tags: packages
- name: Install common packages
roles/common: Use dynamic include_tasks for packages Basically, when using conditionals or variables in your tasks you should use include_tasks instead of import_tasks. The down side is that you now need to tag all included tasks individually or with a block, unlike when using static imports (tags are applied to all imported child tasks). I would actually like to reduce this task to a single one that uses the host's ansible_distribution variable, but Ansible 2.5.1 currently gives the following error: ansible_distribution is undefined.
2018-04-25 17:46:28 +02:00
include_tasks: packages_Ubuntu.yml
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14.
2017-11-05 00:51:49 +01:00
when: ansible_distribution == 'Ubuntu'
roles/common: Add playbook for Debian packages Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-07-24 18:52:54 +02:00
tags: packages
roles/common: Add Alpine packages
2021-02-11 22:28:37 +01:00
- name: Install common packages
include_tasks: packages_Alpine.yml
when: ansible_distribution == 'Alpine'
tags: packages
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named
2017-10-03 14:02:38 +02:00
- name: Configure firewall
roles/common: Use dynamic include_tasks for firewall Use dynamic includes instead of static imports when you are running tasks conditionally or using variable interpolation. The down side is that you need to then tag the parent task as well as all child tasks, as tags only apply to children of statically imported tasks.
2018-04-25 17:58:31 +02:00
include_tasks: firewall_Debian.yml
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14.
2017-11-05 00:51:49 +01:00
when: ansible_distribution == 'Debian'
tags: firewall
- name: Configure firewall
roles/common: Use dynamic include_tasks for firewall Use dynamic includes instead of static imports when you are running tasks conditionally or using variable interpolation. The down side is that you need to then tag the parent task as well as all child tasks, as tags only apply to children of statically imported tasks.
2018-04-25 17:58:31 +02:00
include_tasks: firewall_Ubuntu.yml
Revert "Revert "roles/common: Use static imports for tasks"" This reverts commit 63c5477f852e3054c0423fa2193a183573e1672a. I'm actually still seeing this problem on Ansible 2.4.0.0 with Python 2.7.14.
2017-11-05 00:51:49 +01:00
when: ansible_distribution == 'Ubuntu'
roles/common: Move tags from subtask to main one Child tasks inherit the tag of the parent. Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-03-15 15:33:48 +01:00
tags: firewall
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named
2017-10-03 14:02:38 +02:00
- name: Configure secure shell daemon
import_tasks: sshd.yml
roles/common: Add DSA/ECDSA cleanup to ssh tasks We don't want to support these signature algorithms! Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-01-20 14:28:06 +01:00
tags: sshd
roles/common: Add sysctl template for Debian hosts Note: I've only tested this on a Debian container, and you can't set these sysctls on containers (the host controls them). To make matters worse, there is no fact to make ansible skip this on hosts that are running in containers. For now I will just skip it on hosts that are "virtualization" servers... even though we actually do have KVM running on Debian on real hardware. *sigh* Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-22 23:12:17 +02:00
# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
- name: Reconfigure /etc/sysctl.conf
roles/common: Add sysctl template for Debian hosts Note: I've only tested this on a Debian container, and you can't set these sysctls on containers (the host controls them). To make matters worse, there is no fact to make ansible skip this on hosts that are running in containers. For now I will just skip it on hosts that are "virtualization" servers... even though we actually do have KVM running on Debian on real hardware. *sigh* Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-22 23:12:17 +02:00
when: ansible_virtualization_role != 'host'
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
notify:
roles/common: Indent some yaml stuff in main.yml Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-03-15 15:31:29 +01:00
- reload sysctl
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
tags: sysctl
- name: Reconfigure /etc/rc.local
roles/common: Update list of abusive IP addresses This comes from the AbuseIPDB with a confidence level of 95%. I use the following command to download and sort the IPs: $ curl -G https://api.abuseipdb.com/api/v2/blacklist -d \ confidenceMinimum=95 -H "Key: $ABUSEIPDB_API_KEY" \ -H "Accept: text/plain" | sort | sed -e '/:/w /tmp/ipv6.txt' \ -e '/:/d' > /tmp/ipv4.txt I manually add the XML formatting to each file and run them through tidy: $ tidy -xml -utf8 -m -iq -w 0 roles/common/files/abusers-ipv4.xml $ tidy -xml -utf8 -m -iq -w 0 roles/common/files/abusers-ipv6.xml
2020-11-06 14:44:57 +01:00
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('19.04', '<=')
roles/common: Don't use ansible facts when we don't need to No use testing the distro version only to use an ansible fact to find the correct template.
2016-08-24 09:11:13 +02:00
template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
roles/common: Set I/O scheduler via udev All servers with non-rotating disks (SSDs) should be running noop, and the rest should be running deadline. Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-03-15 15:52:05 +01:00
- name: Set I/O scheduler
template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
tags: udev
Add names to include tasks Raised by ansible-lint in the following rule: [ANSIBLE0011] All tasks should be named
2017-10-03 14:02:38 +02:00
- name: Copy admin SSH keys
import_tasks: ssh-keys.yml
roles/common: Add functionality to copy user keys to provisioning user Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-10-11 11:13:45 +02:00
tags: ssh-keys
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
# vim: set sw=2 ts=2:
Reference in New Issue Copy Permalink