Skip to content

Commit 5d43513

Browse files
hunleydhunleyd
authored
refactor(ansible): bring our ansible up to modern ansible-lint standards (#1861)
1 parent f028f3f commit 5d43513

File tree

1 file changed

+174
-194
lines changed

1 file changed

+174
-194
lines changed

‎ansible/tasks/setup-system.yml‎

Lines changed: 174 additions & 194 deletions
Original file line numberDiff line numberDiff line change
@@ -1,195 +1,189 @@
1-
- name: System - apt update and apt upgrade
2-
apt: update_cache=yes upgrade=yes
3-
when: debpkg_mode or nixpkg_mode
4-
# SEE http://archive.vn/DKJjs#parameter-upgrade
5-
6-
- name: Install required security updates
7-
apt:
8-
pkg:
9-
- tzdata
10-
- linux-libc-dev
11-
when: debpkg_mode or nixpkg_mode
12-
# SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
13-
# Without this, a similar error is faced
14-
- name: Install Ansible dependencies
15-
apt:
16-
pkg:
17-
- acl
18-
when: debpkg_mode or nixpkg_mode
19-
20-
- name: Install security tools
21-
apt:
22-
pkg:
23-
- nftables
24-
- fail2ban
25-
update_cache: yes
26-
cache_valid_time: 3600
27-
when: debpkg_mode or nixpkg_mode
28-
29-
- name: Use nftables backend
30-
shell: |
31-
update-alternatives --set iptables /usr/sbin/iptables-nft
32-
update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
33-
update-alternatives --set arptables /usr/sbin/arptables-nft
34-
update-alternatives --set ebtables /usr/sbin/ebtables-nft
35-
systemctl restart ufw
36-
when: debpkg_mode or nixpkg_mode
37-
38-
- name: Create Sysstat log directory
39-
file:
40-
path: /var/log/sysstat
41-
state: directory
42-
when: debpkg_mode or nixpkg_mode
43-
44-
- name: Install other useful tools
45-
apt:
46-
pkg:
47-
- bwm-ng
48-
- htop
49-
- net-tools
50-
- ngrep
51-
- sysstat
52-
- vim-tiny
53-
update_cache: yes
54-
when: debpkg_mode or nixpkg_mode
1+
- name: Execute tasks when (debpkg_mode or nixpkg_mode)
2+
when:
3+
- (debpkg_mode or nixpkg_mode)
4+
block:
5+
- name: System - apt update and apt upgrade
6+
ansible.builtin.apt:
7+
update_cache: true
8+
upgrade: true
9+
# SEE http://archive.vn/DKJjs#parameter-upgrade
10+
11+
- name: Install required security updates Ansible dependencies, security tools, and other useful things
12+
ansible.builtin.apt:
13+
cache_valid_time: 3600
14+
pkg:
15+
- acl
16+
- bwm-ng
17+
- fail2ban
18+
- htop
19+
- linux-libc-dev
20+
- net-tools
21+
- nftables
22+
- ngrep
23+
- sysstat
24+
- tzdata
25+
- vim
26+
update_cache: true
27+
# SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
28+
# Without this, a similar error is faced
29+
30+
- name: Use nftables backend
31+
community.general.alternatives:
32+
name: "{{ alternatives['name'] }}"
33+
path: "{{ alternatives['path'] }}"
34+
loop:
35+
- { name: 'iptables', path: '/usr/sbin/iptables-nft' }
36+
- { name: 'ip6tables', path: '/usr/sbin/ip6tables-nft' }
37+
- { name: 'arptables', path: '/usr/sbin/arptables-nft' }
38+
- { name: 'ebtables', path: '/usr/sbin/ebtables-nft' }
39+
loop_control:
40+
loop_var: 'alternatives'
41+
42+
- name: restart ufw
43+
ansible.builtin.systemd_service:
44+
name: 'ufw'
45+
state: 'restarted'
46+
47+
- name: Create Sysstat log directory
48+
ansible.builtin.file:
49+
path: '/var/log/sysstat'
50+
state: 'directory'
51+
52+
- name: Configure sysstat
53+
ansible.builtin.copy:
54+
dest: "/etc/{{ sysstat_item }}/sysstat"
55+
src: "files/{{ sysstat_item }}.sysstat"
56+
loop:
57+
- default
58+
- sysstat
59+
loop_control:
60+
loop_var: 'sysstat_item'
61+
62+
- name: Adjust APT update intervals
63+
ansible.builtin.copy:
64+
dest: '/etc/apt/apt.conf.d/10periodic'
65+
src: 'files/apt_periodic'
5566

5667
- name: Install other useful tools
57-
apt:
68+
ansible.builtin.apt:
5869
pkg:
5970
- less
60-
update_cache: yes
61-
when: qemu_mode is defined
62-
63-
- name: Configure sysstat
64-
copy:
65-
src: files/sysstat.sysstat
66-
dest: /etc/sysstat/sysstat
67-
when: debpkg_mode or nixpkg_mode
68-
69-
- name: Configure default sysstat
70-
copy:
71-
src: files/default.sysstat
72-
dest: /etc/default/sysstat
73-
when: debpkg_mode or nixpkg_mode
74-
75-
76-
- name: Adjust APT update intervals
77-
copy:
78-
src: files/apt_periodic
79-
dest: /etc/apt/apt.conf.d/10periodic
80-
when: debpkg_mode or nixpkg_mode
81-
82-
# Find platform architecture and set as a variable
83-
- name: finding platform architecture
84-
shell: if [ $(uname -m) = "aarch64" ]; then echo "arm64"; else echo "amd64"; fi
85-
register: platform_output
86-
tags:
87-
- update
88-
- update-only
89-
- set_fact:
90-
platform: "{{ platform_output.stdout }}"
71+
update_cache: true
72+
when:
73+
- qemu_mode is defined
74+
75+
- name: Set the platform arch as a fact
76+
ansible.builtin.set_fact:
77+
platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}"
9178
tags:
9279
- update
9380
- update-only
94-
when: debpkg_mode or nixpkg_mode or stage2_nix
95-
96-
- name: create overrides dir
97-
file:
98-
state: directory
99-
owner: root
100-
group: root
101-
path: /etc/systemd/system/systemd-resolved.service.d
102-
mode: '0700'
103-
when: debpkg_mode or nixpkg_mode
104-
105-
- name: Custom systemd overrides for resolved
106-
copy:
107-
src: files/systemd-resolved.conf
108-
dest: /etc/systemd/system/systemd-resolved.service.d/override.conf
109-
when: debpkg_mode or nixpkg_mode
110-
111-
- name: System - Create services.slice
112-
template:
113-
src: files/services.slice.j2
114-
dest: /etc/systemd/system/services.slice
115-
when: debpkg_mode or nixpkg_mode
116-
117-
118-
- name: System - systemd reload
119-
systemd: daemon_reload=yes
120-
when: debpkg_mode or nixpkg_mode
121-
122-
- name: Configure journald
123-
copy:
124-
src: files/journald.conf
125-
dest: /etc/systemd/journald.conf
126-
when: debpkg_mode or nixpkg_mode
127-
128-
- name: reload systemd-journald
129-
systemd:
130-
name: systemd-journald
131-
state: restarted
132-
when: debpkg_mode or nixpkg_mode
133-
134-
- name: Configure logind
135-
copy:
136-
src: files/logind.conf
137-
dest: /etc/systemd/logind.conf
138-
when: debpkg_mode or nixpkg_mode
139-
140-
- name: reload systemd-logind
141-
systemd:
142-
name: systemd-logind
143-
state: restarted
144-
when: debpkg_mode or nixpkg_mode
145-
146-
- name: enable timestamps for shell history
147-
copy:
148-
content: |
149-
export HISTTIMEFORMAT='%d/%m/%y %T '
150-
dest: /etc/profile.d/09-history-timestamps.sh
151-
mode: 0644
152-
owner: root
153-
group: root
154-
when: debpkg_mode or nixpkg_mode
155-
156-
- name: configure systemd's pager
157-
copy:
158-
content: |
159-
export SYSTEMD_LESS=FRXMK
160-
dest: /etc/profile.d/10-systemd-pager.sh
161-
mode: 0644
162-
owner: root
163-
group: root
164-
when: debpkg_mode or nixpkg_mode
81+
when:
82+
- (debpkg_mode or nixpkg_mode or stage2_nix)
83+
84+
- name: Execute more tasks when (debpkg_mode or nixpkg_mode)
85+
when:
86+
- (debpkg_mode or nixpkg_mode)
87+
block:
88+
- name: Custom systemd overrides for resolved
89+
ansible.builtin.copy:
90+
dest: '/etc/systemd/system/systemd-resolved.service.d/'
91+
directory_mode: '0700'
92+
group: 'root'
93+
mode: '0644'
94+
owner: 'root'
95+
src: 'files/systemd-resolved.conf'
96+
97+
- name: System - Create services.slice
98+
ansible.builtin.template:
99+
dest: '/etc/systemd/system/services.slice'
100+
src: 'files/services.slice.j2'
101+
102+
- name: System - systemd reload
103+
ansible.builtin.systemd_service:
104+
daemon_reload: true
105+
106+
- name: Configure journald and logind
107+
ansible.builtin.copy:
108+
dest: "/etc/systemd/{{ config_item }}.conf"
109+
src: "files/{{ config_item }}.conf"
110+
loop:
111+
- journald
112+
- logind
113+
loop_control:
114+
loop_var: 'config_item'
115+
116+
- name: reload systemd-journald
117+
ansible.builtin.systemd_service:
118+
name: "systemd-{{ config_item }}"
119+
state: 'restarted'
120+
loop:
121+
- journald
122+
- logind
123+
loop_control:
124+
loop_var: 'config_item'
125+
126+
- name: enable timestamps for shell history
127+
ansible.builtin.copy:
128+
content: |
129+
export HISTTIMEFORMAT='%d/%m/%y %T '
130+
dest: /etc/profile.d/09-history-timestamps.sh
131+
mode: '0644'
132+
owner: 'root'
133+
group: 'root'
134+
135+
- name: configure systemd's pager
136+
ansible.builtin.copy:
137+
content: |
138+
export SYSTEMD_LESS=FRXMK
139+
dest: /etc/profile.d/10-systemd-pager.sh
140+
mode: '0644'
141+
owner: 'root'
142+
group: 'root'
143+
144+
# Set Sysctl params specific to keepalives
145+
- name: Set net.ipv4.tcp_keepalive_time=1800
146+
ansible.builtin.sysctl:
147+
name: 'net.ipv4.tcp_keepalive_time'
148+
value: 1800
149+
state: 'present'
150+
151+
- name: Set net.ipv4.tcp_keepalive_intvl=60
152+
ansible.builtin.sysctl:
153+
name: 'net.ipv4.tcp_keepalive_intvl'
154+
value: 60
155+
state: 'present'
156+
157+
- name: Execute tasks when (debpkg_mode or nixpkg_mode)
158+
when:
159+
- (debpkg_mode or nixpkg_mode)
160+
block:
161+
# Set Sysctl params for restarting the OS on OOM after 10
162+
- name: Set vm.panic_on_oom=1
163+
ansible.builtin.sysctl:
164+
name: 'vm.panic_on_oom'
165+
reload: true
166+
state: 'present'
167+
value: '1'
168+
169+
- name: Set kernel.panic=10
170+
ansible.builtin.sysctl:
171+
name: 'kernel.panic'
172+
reload: true
173+
state: 'present'
174+
value: '10'
165175

166176
- name: set hosts file
167-
copy:
177+
ansible.builtin.copy:
168178
content: |
169179
127.0.0.1 localhost
170180
::1 localhost
171-
dest: /etc/hosts
172-
mode: 0644
173-
owner: root
174-
group: root
175-
when: debpkg_mode or stage2_nix
176-
177-
#Set Sysctl params for restarting the OS on oom after 10
178-
- name: Set vm.panic_on_oom=1
179-
ansible.builtin.sysctl:
180-
name: vm.panic_on_oom
181-
value: '1'
182-
state: present
183-
reload: yes
184-
when: debpkg_mode or nixpkg_mode
185-
186-
- name: Set kernel.panic=10
187-
ansible.builtin.sysctl:
188-
name: kernel.panic
189-
value: '10'
190-
state: present
191-
reload: yes
192-
when: debpkg_mode or nixpkg_mode
181+
dest: '/etc/hosts'
182+
mode: '0644'
183+
owner: 'root'
184+
group: 'root'
185+
when:
186+
- (debpkg_mode or stage2_nix)
193187

194188
- name: configure system
195189
ansible.posix.sysctl:
@@ -200,17 +194,3 @@
200194
ansible.posix.sysctl:
201195
name: 'net.ipv4.ip_local_port_range'
202196
value: '1025 65000'
203-
204-
#Set Sysctl params specific to keepalives
205-
- name: Set net.ipv4.tcp_keepalive_time=1800
206-
ansible.builtin.sysctl:
207-
name: net.ipv4.tcp_keepalive_time
208-
value: 1800
209-
state: present
210-
when: debpkg_mode or nixpkg_mode
211-
- name: Set net.ipv4.tcp_keepalive_intvl=60
212-
ansible.builtin.sysctl:
213-
name: net.ipv4.tcp_keepalive_intvl
214-
value: 60
215-
state: present
216-
when: debpkg_mode or nixpkg_mode

0 commit comments

Comments
 (0)