alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
847 Commits 2 Branches 0 Tags 4.2 MiB
37901da5b5
Commit Graph

250 Commits

Author SHA1 Message Date
Alan Orth
36d6360eeb
roles/common: Fix error in conditional 2017-11-05 01:41:38 +02:00
Alan Orth
fec081d40a
roles/common: Use deb.debian.org instead of httpredir 
Seems to be the evolution of httpredir.
 2017-11-05 01:31:16 +02:00
Alan Orth
55b464e8f7
roles/common: Add apt-transport-https to base packages 
Allows fetching debian repositories over HTTPS.
 2017-11-05 01:29:00 +02:00
Alan Orth
547d808aea
roles/common: Remove ansible_os_family checks 
We're only supporting Debian family now so there's no point to check
this variable now.
 2017-11-05 01:19:28 +02:00
Alan Orth
5f8820bf9f
roles/common: Remove Ubuntu 14.04 logic 
We're only supporting Ubuntu 16.04 now.
 2017-11-05 01:11:37 +02:00
Alan Orth
7fd6127d29
roles/common: Remove check for CentOS in sshd task 
I'm not supporting CentOS here so we don't need to check this.
 2017-11-05 01:01:37 +02:00
Alan Orth
f76fc64afa
roles/common: Remove unused sshd_config templates 
We're not supporting Ubuntu 14.04 or 15.04 anymore so we don't need
these templates.
 2017-11-05 00:59:19 +02:00
Alan Orth
77a3b1cff7
roles/common: Remove Debian 8 sshd_config template 2017-11-05 00:58:03 +02:00
Alan Orth
b0524d2a2e
Remove references to Debian 8 
I don't need or want to support Debian 8 anymore so I can remove all
references to it in comments and code.
 2017-11-05 00:54:53 +02:00
Alan Orth
b87f2e2fb0
roles/common: Use command module instead of shell 
You should only use the "shell" module when you need shell functions
like flow control and redirects. Also, the "command" module is safer
because it is not affected by the user's environment.
 2017-11-05 00:49:03 +02:00
Alan Orth
b6a54ca4d1 roles/common: Reload firewalld instead of restart 
There is no need to bounce the service, just reload it.
 2017-11-05 00:27:44 +02:00
Alan Orth
0a92f3ae8f roles/common: Use systemd module instead of "service" 
This was new in Ansible 2.2 but I didn't notice until now. All of our
servers are running distributions with systemd so let's just use this.
 2017-11-05 00:27:44 +02:00
Alan Orth
7b60e6d24f
Revert "Import OS-specific vars in tasks instead of play" 
This reverts commit e30e4d4b1e.

I suspect this was a side effect of using Python 3 rather than an
issue in Ansible 2.4.0.0.
 2017-11-04 23:53:38 +02:00
Alan Orth
63c5477f85
Revert "roles/common: Use static imports for tasks" 
This reverts commit 5147f4029b.

I think this was a side effect of using Python 3, not a regression in
Ansible 2.4.0.0.
 2017-11-04 23:53:25 +02:00
Alan Orth
620e8258ac
roles/common: Remove duplicate option in sshd_config 2017-11-01 13:22:18 +02:00
Alan Orth
5147f4029b
roles/common: Use static imports for tasks 
Something seems to have happened as of Ansible 2.4.0.0 where this no
longer works. I suspect it is related to the major changes to static
and dynamic imports that landed around this same time.

In practice this achieves the same function, but without the "magic"
ability to use one task for different operating systems.
 2017-11-01 01:25:46 +02:00
Alan Orth
e30e4d4b1e
Import OS-specific vars in tasks instead of play 
Something seems to have happened as of Ansible 2.4.0.0 where this no
longer works. I suspect it is related to the major changes to static
and dynamic imports that landed around this same time.

We make sure that this tasks always runs by using the special tag of
the same name.
 2017-11-01 01:21:48 +02:00
Alan Orth
15bf4727c1
roles/common: Add names to include tasks 
I'm not sure why these weren't caught by ansible-lint.
 2017-10-03 17:46:55 +03:00
Alan Orth
5281d41445
Add names to include tasks 
Raised by ansible-lint in the following rule:

[ANSIBLE0011] All tasks should be named
 2017-10-03 15:03:09 +03:00
Alan Orth
ff6253213a
roles/common: Rename "iptables" task to "firewall" 2017-09-26 14:32:21 +03:00
Alan Orth
818cbfd533
roles/common: Enable firewalld in Debian 9 2017-09-26 14:30:18 +03:00
Alan Orth
58245e3480
roles/common/tasks/main.yml: Remove comment 2017-09-22 15:53:01 +03:00
Alan Orth
16a9ebf97f
Adjust playbooks for Ansible 2.4 import changes 
Ansible 2.4 changes the way includes work. Now you have to use "import"
for playbooks and tasks that are static, and "include" for those that
are dynamic (ie, those that use variables, loops, etc).

See: http://docs.ansible.com/ansible/devel/playbooks_reuse_includes.html
 2017-09-21 21:30:47 +03:00
Alan Orth
b945240756
roles/common: Harden sshd_config template for Debian 9 and Ubuntu 16.04 
From: https://wiki.mozilla.org/Security/Guidelines/OpenSSH
 2017-06-19 10:13:24 +03:00
Alan Orth
4f22052afe
roles/common: Remove duplicate timezone task 
We set it in the separate ntp.yml playbook now, as there are a few
different systems we cater to (systemd, old ntp, etc).
 2017-06-18 09:30:05 +03:00
Alan Orth
ffac0b8afd
roles/common: Update apt cache in tarsnap step 
This fails on clean installs otherwise.
 2017-06-18 09:27:53 +03:00
Alan Orth
d766c3dbbe
roles/common: Add tasks to install tarsnap 
Now that Tarsnap has official packages this is one less thing that
needs to be manually installed from source after bringing a machine
up.

See: http://mail.tarsnap.com/tarsnap-announce/msg00037.html
 2017-02-07 07:28:35 -08:00
Alan Orth
1fef5c9b5a roles/common: Add sshd_config for Debian 9 (stretch) 
Taken from base install and diffed against the current Ubuntu 16.04
and Debian 8 config templates.
 2017-01-30 14:56:27 +02:00
Alan Orth
9ca685a6af
roles/common: Adjust allowed user logic for Ubuntu 16.04 sshd_config 2017-01-30 12:54:35 +02:00
Alan Orth
50536af990
Use Ansible's version_compare instead of doing math on strings 
I'm surprised this worked all these years actually. Since Ansible
version 1.6 it has been possible to use the version_compare filter
instead of doing math logic on strings.

See: https://docs.ansible.com/ansible/playbooks_tests.html
 2016-12-20 15:04:47 +02:00
Alan Orth
75ef77e3cc
roles/common: Don't set up apt sources on arm 
The package archives appear to be different for some reason.
 2016-09-29 16:47:44 +03:00
Alan Orth
5f656285c0
roles/common: Add a dedicated playbook for ntp tasks 
Hosts with systemd should use its NTP client and explicitly remove
the `ntp` packages. Hosts with older init systems should use `ntp`.
 2016-08-25 14:19:51 +03:00
Alan Orth
8851f8f631 Revert "Only update packages indexes if the cache is 1 hour old" 
This reverts commit 201165cff6.

Turns out this actually breaks initial deployments, because the
cache gets updated in the first task, then you add sources for
nginx and mariadb, but it doesn't update the indexes because the
cache is < 3600 seconds old, so you end up getting the distro's
versions of nginx and mariadb.
 2016-08-25 12:58:15 +03:00
Alan Orth
da6d1e05b9
roles/common: Don't use ansible facts when we don't need to 
No use testing the distro version only to use an ansible fact to
find the correct template.
 2016-08-24 10:11:13 +03:00
Alan Orth
861b5c5413
roles/common: Remove old comment from main playbook 2016-08-22 16:35:02 +03:00
Alan Orth
6c6ff1b112
roles/common: Use ansible facts to reduce includes 2016-08-22 16:34:05 +03:00
Alan Orth
bd318c5754
Use long GPG key id fingerprints 2016-08-22 16:30:20 +03:00
Alan Orth
14de9caed8
roles/common: Use https for Ubuntu Extras repo signing key 
Missed this in the earlier commit where I changed to https:// for
transporting apt keys.
 2016-08-22 16:28:24 +03:00
Alan Orth
201165cff6
Only update packages indexes if the cache is 1 hour old 
I have added cache_valid_time=3600 for the first task in each
tag that could be possibly running apt-related commands. For ex,
the "nginx" tag is also in the "packages" tag, but sometimes you
run the nginx tag by itself (perhaps repeatadely), so you'd want
to limit the update unless the cache was 1 hour old
 2016-08-22 15:33:57 +03:00
Alan Orth
8a70b526ee
roles/common: Remove extra systemd-timesyncd task 
Now it runs in the main play for all Ubuntu and Debian hosts, as
currently they all use systemd.
 2016-08-22 15:29:36 +03:00
Alan Orth
d3a6e71ab8
roles/common: Use service module to enable systemd NTP client instead of timedatectl 
The `timedatectl set-ntp on` command is actually just enabling the
systemd service anyways, so it's better we use Ansible's service
module.
 2016-08-22 12:49:00 +03:00
Alan Orth
b7c92e4dc1
roles/common: Remove 128-bit Ciphers and MACs from sshd_config 
I had removed them from Debian 8 and Ubuntu 14.04 configs last year
when the NSA's Suite B crypto guidelines dropped 128-bit algorithms
but those changes didn't make it to my new Ubuntu 16.04 config.

It is probably overkill and paranoid, but this server is mine, so I
can make those decisions (and I only connect from modern clients).
 2016-08-16 14:28:58 +03:00
Alan Orth
33cdcc9ad1
roles/common: Add a few SHA-2 MACs to sshd_config 
Fixes a problem with Paramiko, which Ansible uses for transport.

See: http://www.paramiko.org/changelog.html#1.16.0
See: https://github.com/ilri/rmg-ansible-public/issues/37
 2016-08-16 14:24:53 +03:00
Alan Orth
e343ddc9a6
Add 'packages' tag to any task doing package stuff 
For idempotence we need to run all apt-related tasks, like editing
source files, adding keys, installing packages, etc, when running
the 'packages' tag.
 2016-08-14 16:33:48 +03:00
Alan Orth
06034a8b8b
roles/common: Use systemd's timedatectl for time stuff 
Debian 8 and Ubuntu 16.04 use systemd, so we can make use of its
NTP stuff rather than using the standalone `ntp` package.
 2016-06-27 10:30:11 +03:00
Alan Orth
33f22b32a4
roles/common: Update sources for cron-apt 
The system's apt configuration is using restricted and multiverse
so the security sources list should as well.
 2016-05-05 12:16:37 +03:00
Alan Orth
a0bb4c2f57 roles/common: Add sshd_config for Ubuntu 16.04 2016-04-22 11:25:35 +03:00
Alan Orth
d265b522e8 roles/common: Update iptables for Ubuntu 16.04 
Basically, anything after 15.04 is using firewalld.
 2016-04-22 11:25:35 +03:00
Alan Orth
ad232a7a8b
roles/common: Remove old SSH key 2016-04-22 11:24:35 +03:00
Alan Orth
5f71991259
roles/common: Use httpredir.debian.org as default Debian mirror 
Automatically uses the best mirror for your location, see:

    http://httpredir.debian.org/demo.html

Should be much better than any hardcoded default for most hosts.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-11-30 09:34:16 +02:00
Alan Orth
973b37be4e
roles/common: Tweak sshd_config to match NSA Suite B recommendations 
NSA stopped recommending AES-128 in August, 2015...

Before: https://web.archive.org/web/20150403110658/https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
After: https://web.archive.org/web/20150815072948/https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml

I don't see why we shouldn't follow suit; maybe they know something
we don't!

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-09-02 16:55:51 +03:00
Alan Orth
8b336352d7
roles/common: Only allow ssh access by provisioning user 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-09-02 12:24:11 +03:00
Alan Orth
c480075789
roles/common: Use "interface" instead of "alias" to get interface name in firewalld template 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 12:06:47 +03:00
Alan Orth
9266d48c9f
roles/common: Separate firewalld tasks for Ubuntu and Debian 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 12:06:25 +03:00
Alan Orth
18ca44193d
roles/common: Add sysctl template for Debian hosts 
Note: I've only tested this on a Debian container, and you can't
set these sysctls on containers (the host controls them). To make
matters worse, there is no fact to make ansible skip this on hosts
that are running in containers. For now I will just skip it on
hosts that are "virtualization" servers... even though we actually
do have KVM running on Debian on real hardware. *sigh*

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:12:17 +03:00
Alan Orth
56df8b38ca roles/common: Use new cron-apt tasks 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:40 +03:00
Alan Orth
96fe209843 roles/common: Fix mode on Debian 8 sshd_config 
Accidentally added it with 777.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:39 +03:00
Alan Orth
7519995153 roles/common: Add Debian 8 sshd_config 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:39 +03:00
Alan Orth
dc24285ec6 roles/common: Use apt_mirror variable in Debian sources 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:39 +03:00
Alan Orth
28f61d589e roles/common: Add Debian support to sources.list template 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:39 +03:00
Alan Orth
e15d1be867 roles/common: Add playbook for Debian packages 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:39 +03:00
Alan Orth
1fc2453703 roles/common: Add firewalld support 
Needed in Ubuntu 15.04 where iptables-persistent is going away. I
have added translations of the current IPv4 and IPv6 iptables rules.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:39 +03:00
Alan Orth
9aaad366f5 roles/common: Only add extras repo on Ubuntu 14.04 
The Extras repo was discontinued after 14.10 (but the latest we
deploy is 14.04).

See: https://lists.ubuntu.com/archives/technical-board/2015-January/002063.html

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:38 +03:00
Alan Orth
e84f777a6b roles/common: Bring Ubuntu 15.04 sshd_config up to date with standards 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:38 +03:00
Alan Orth
b2dbd138f7 roles/common: Add Ubuntu 15.04 sshd_config 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:02:38 +03:00
Alan Orth
68493beba3
roles/common: Reload sshd instead of restarting 
No need to restart for a config change.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:01:17 +03:00
Alan Orth
8e0a292b1d
roles/common: Move sshd tasks to their own playbook 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-23 00:00:43 +03:00
Alan Orth
7f929d5b80
roles/common: Remove unused cron-apt files 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-22 23:42:03 +03:00
Alan Orth
fc586a2297
roles/common: Adjust cron-apt stuff 
- Don't run the static files as templates
- Use a separate playbook for related tasks
- Use a template for security.sources.list

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-08-22 23:39:22 +03:00
Alan Orth
ae10677b65
roles/common: Specify default apt_mirror for fallback in sources.list template 
New hosts often fail due to not having an apt_mirror, because there
isn't one defined for their group and their host_vars haven't over-
ridden it.

We want new hosts to deploy successfully, so let's just use a default
apt_mirror if there isn't one defined. Rather have a slow mirror than
a failed deployment. And in any case, Linode can download from KENET's
mirror at 10MB/sec. ;)

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-06-04 21:57:11 +03:00
Alan Orth
a8f4500567 Add IPv6 support to firewall tasks / template 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-05-25 18:17:23 +03:00
Alan Orth
aa5a9f5dd8
roles/common: Add vim modeline 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-05-24 23:55:04 +03:00
Alan Orth
3a5b50f941
roles/common: Set I/O scheduler via udev 
All servers with non-rotating disks (SSDs) should be running noop,
and the rest should be running deadline.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:52:05 +03:00
Alan Orth
9fda345a24
roles/common: Fix one logic mistake in rc.local task 
I think it was originally supposed to be `ansible_os_family` but
we don't have anything other than Ubuntu, so let's just use that.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:43:21 +03:00
Alan Orth
2367b843d9
roles/common: Remove I/O scheduler logic from rc.local 
It's better to set this using udev rules anyways

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:40:54 +03:00
Alan Orth
4a1158e163
roles/common: Remove CentOS rclocal task 
No CentOS hosts here!

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:40:07 +03:00
Alan Orth
891bd35171 roles/common: Move tags from subtask to main one 
Child tasks inherit the tag of the parent.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:34:13 +03:00
Alan Orth
4efb6edb7e
roles/common: Indent some yaml stuff in main.yml 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:31:29 +03:00
Alan Orth
b70ae58f48
roles/common: Simplify when logic in main template 
Less syntax is more readable syntax.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:29:41 +03:00
Alan Orth
58222706ba
roles/common: Remove logic for TCP congestion avoidance on early kernels in sysctl 
We don't have anything near 2.6.32 anymore.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:25:33 +03:00
Alan Orth
60ba4dacbd
roles/common: Add TCP/IP tweaks to sysctl template 
Disable TCP slow start and increase the number of ports available
for client connections.

See: http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html
See: http://www.chromium.org/spdy/spdy-best-practices

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-03-15 17:23:10 +03:00
Alan Orth
19f5b60cb7
Remove references to provisioning.yml 
We aren't managing the provisioning user anymore, it is just assumed
to be there.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-02-26 16:53:48 +03:00
Alan Orth
55fddf03b3
Remove provisioning user management 
It's just too tricky to manage this. Ubuntu / RedHat preseeds and
kickstarts can create the user and add it to groups, but only when
we control the initial boot environment (ie not on Linode, Digital
Ocean, etc), so let's just say we assume this user exists and can
get root with sudo by the some we are running ansible on it.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-02-20 15:06:45 +03:00
Alan Orth
171798c76d roles/common: Add DSA/ECDSA cleanup to ssh tasks 
We don't want to support these signature algorithms!

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-20 16:31:37 +03:00
Alan Orth
0d2763fb59
roles/common: Remove ECDSA SSH public key for aorth@noma 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-12 18:19:49 +03:00
Alan Orth
d7dd81bc84
roles/common: Add ED25519 SSH public key for aorth@noma 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-12 18:19:21 +03:00
Alan Orth
13b592dfcd roles/common: Tune sshd_config to be more strict 
Disable ECDSA as a signature algorithm and drop some older message
authentication algorithms.

See: https://stribika.github.io/2015/01/04/secure-secure-shell.html

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-07 01:47:06 +03:00
Alan Orth
a80cb49957 roles/common: Update sshd_config template to explicitly allow the provisioning user 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-06 17:45:06 +03:00
Alan Orth
3b6c9745ab
roles/common: Add provisioning user to sudoers 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-05 08:24:13 +03:00
Alan Orth
0f5b088c08 roles/common: Add createhome:yes to provisioning user task 
Need to make sure the user gets created on a fresh install, like on
Amazon EC2 or OpenStack images where the first user is `ubuntu' and
you can't assume `provisioning' is already created.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2015-01-04 02:24:53 +03:00
Alan Orth
c3f5e27642
roles/common: Add ECDSA public key for noma 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-12 13:25:48 +03:00
Alan Orth
a265e48a9f
roles/common: Remove RSA public key 
Both client and server support ed25519, so there's no need to even
have the RSA key here.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-12 13:23:01 +03:00
Alan Orth
5e0da37542
roles/common: Remove task which removes irqbalance 
Prevailing wisdom is actually that this *can* help virtual hosts,
especially when the VM guest has multiple CPUs.

See: http://wiki.xen.org/wiki/Network_Throughput_and_Performance_Guide

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 13:31:23 +03:00
Alan Orth
1ee7b385bf
roles/common: Rename SSH keys 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 13:19:32 +03:00
Alan Orth
1e2193efc9
roles/common: Add functionality to copy user keys to provisioning user 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 12:13:45 +03:00
Alan Orth
c53dd18181
roles/common: Add role to manage provisioning user 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 12:11:44 +03:00
Alan Orth
e741a77c00
roles/common: Add unzip to Ubuntu base packages 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-05 15:21:47 +03:00
Alan Orth
be0e0ea21a
roles/common: Remove irqbalance 
We're a VM, we don't have IRQs.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-07 23:51:52 +03:00
Alan Orth
df65172952
roles/common: Add lrzip to base packages 
Provides good mix of compression/decompression speed with size,
see: http://ck.kolivas.org/apps/lrzip/README.benchmarks

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-07 16:32:06 +03:00
Alan Orth
60b8ecdd4c
Initial commit 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-17 00:35:57 +03:00