Starting from scratch with new playbooks using different directory structure
This commit is contained in:
Alex Tavarez
@@ -1,139 +0,0 @@
|
||||
---
|
||||
- name: Configure virtual private servers
|
||||
hosts: vps
|
||||
gather_facts: yes
|
||||
vars:
|
||||
# # below is just to remind you to use '-u' instead
|
||||
# ansible_user: "{{ root_auths[0].username }}"
|
||||
# # below is just to remind you to use '--ask-pass' instead
|
||||
# ansible_password: "{{ root_auths[0].password }}"
|
||||
FAMILY: "{{ ansible_facts['os_family'] }}"
|
||||
CURRENT_HOST_IP4: "{{ ansible_facts['default_ipv4']['address'] }}"
|
||||
CURRENT_HOST_IP6: "{{ ansible_facts['default_ipv6']['address'] }}"
|
||||
FQDN: "{{ domain_name | default(inventory_hostname, true) }}"
|
||||
acme_challenge: no
|
||||
|
||||
pre_tasks:
|
||||
- name: Set timezone
|
||||
become: yes
|
||||
become_method: sudo
|
||||
community.general.timezone:
|
||||
name: "{{ tzone }}"
|
||||
register: timezone_set
|
||||
tags: ['baseconf', 'timezone_setting']
|
||||
- name: Set hostname
|
||||
become: yes
|
||||
become_method: sudo
|
||||
hostname:
|
||||
name: "{{ hname }}"
|
||||
use: "{{ FAMILY.lower() }}"
|
||||
register: hostname_set
|
||||
tags: ['baseconf', 'hostname_initialization']
|
||||
- name: Add remote host alias to hosts file
|
||||
become: yes
|
||||
become_method: sudo
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
search_string: "127.0.1.1"
|
||||
line: "127.0.1.1 {{ hname }}"
|
||||
state: present
|
||||
create: yes
|
||||
register: hosts_updated
|
||||
tags: ['baseconf', 'hostsfile_update']
|
||||
- name: Add remote host public address aliases to hosts file
|
||||
become: yes
|
||||
become_method: sudo
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
search_string: "{{ CURRENT_HOST_IP4 }}"
|
||||
line: "{{ CURRENT_HOST_IP4 }} {{ FQDN }} {{ hname }}"
|
||||
state: present
|
||||
create: yes
|
||||
register: hosts_updated
|
||||
when: CURRENT_HOST_IP4 is defined
|
||||
tags: ['baseconf', 'hostsfile_update']
|
||||
- name: Add remote host public address aliases to hosts file
|
||||
become: yes
|
||||
become_method: sudo
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
search_string: "{{ CURRENT_HOST_IP6 }}"
|
||||
line: "{{ CURRENT_HOST_IP6 }} {{ FQDN }} {{ hname }}"
|
||||
state: present
|
||||
create: yes
|
||||
register: hosts_updated
|
||||
when: CURRENT_HOST_IP6 is defined
|
||||
tags: ['baseconf', 'hostsfile_update']
|
||||
- name: Create a directory for client source code
|
||||
file:
|
||||
path: "{{ ansible_facts['user_dir'] }}/src/clients"
|
||||
state: directory
|
||||
- name: Create a directory for container service compose files
|
||||
file:
|
||||
path: "{{ compose_source_path }}"
|
||||
state: directory
|
||||
# - name: Create a directory for website or web server source code
|
||||
# file:
|
||||
# path: "{{ ansible_facts['user_dir'] }}/src/services/web"
|
||||
# state: directory
|
||||
|
||||
tasks:
|
||||
- name: Configure core packages
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: config@corepkgs.yml
|
||||
defaults_from: main
|
||||
vars_from: main
|
||||
vars:
|
||||
#@TODO improve filters for defining the two below variables
|
||||
official_name: "{{ [admin.actual_name if admin.username == ansible_facts['user_id'] for admin in admin_auths][0] }}"
|
||||
official_email: "{{ [admin.email if admin.username == ansible_facts['user_id'] for admin in admin_auths][0] }}"
|
||||
register: pkgs_configured
|
||||
tags: ['default', 'configure_pkgs']
|
||||
- name: Configure DNS using Certbot
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: configure_core/certbot.yml
|
||||
defaults_from: options/certbot.yml
|
||||
vars_from: options/certbot.yml
|
||||
register: dns_challenge_made
|
||||
when: acme_challenge
|
||||
tags: ['default', 'with_porkbun_api']
|
||||
- name: Import DNS certificates and keys
|
||||
block:
|
||||
- name: Create SSL certificate
|
||||
become: yes
|
||||
become_method: sudo
|
||||
copy:
|
||||
src: ssl/domain.cert.pem
|
||||
dest: "{{ web_root }}/domain.cert.pem"
|
||||
force: yes
|
||||
backup: yes
|
||||
- name: Create private key
|
||||
become: yes
|
||||
become_method: sudo
|
||||
copy:
|
||||
src: ssl/private.key.pem
|
||||
dest: "{{ web_root }}/private.key.pem"
|
||||
force: yes
|
||||
backup: yes
|
||||
- name: Create public key
|
||||
become: yes
|
||||
become_method: sudo
|
||||
copy:
|
||||
src: ssl/public.key.pem
|
||||
dest: "{{ web_root }}/public.key.pem"
|
||||
force: yes
|
||||
backup: yes
|
||||
when: not acme_challenge
|
||||
tags: ['default']
|
||||
|
||||
post_tasks:
|
||||
- name: Do a system upgrade
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: "upgrade@{{ FAMILY }}.yml"
|
||||
vars:
|
||||
upgrade_type: dist
|
||||
register: system_initialized
|
||||
tags: ['default', 'initial_system_upgrade']
|
||||
199
extended@vps.yml
199
extended@vps.yml
@@ -1,199 +0,0 @@
|
||||
---
|
||||
- name: Additional tasks to do on the VPS
|
||||
hosts: vps
|
||||
gather_facts: yes
|
||||
vars:
|
||||
want_recc_cimages: yes
|
||||
want_custom_cimages: no
|
||||
source_repo: ~
|
||||
# source_repo:
|
||||
# utility: git
|
||||
# url: senpai@ipv6.sukaato:repos/sukaato.git
|
||||
|
||||
tasks:
|
||||
- name: Install core podman images
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: core_installations@podman.yml
|
||||
defaults_from: core_images@podman.yml
|
||||
register: core_podman_images_installed
|
||||
tags: [default, with_containers]
|
||||
- name: Install additional recommended podman images
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: extra_installations@podman.yml
|
||||
defaults_from: core_images@podman.yml
|
||||
register: recc_podman_images_installed
|
||||
when: want_recc_cimages
|
||||
tags: [default, with_containers]
|
||||
- name: Get variable for custom podman image package list
|
||||
include_vars:
|
||||
file: "{{ roles_path }}/bootstrap/defaults/custom_images@podman.yml"
|
||||
name: podman_cimages
|
||||
tags: [default, with_containers]
|
||||
- name: Install custom podman images
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: extra_installations@podman.yml
|
||||
vars:
|
||||
recc_cimages: "{{ podman_cimages.my_cimages }}"
|
||||
register: extra_podman_images_installed
|
||||
when: want_custom_cimages
|
||||
tags: [default, with_containers]
|
||||
- name: Configure ProFTPd
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: configure_core/proftpd.yml
|
||||
defaults_from: options/proftpd.yml
|
||||
vars_from: options/proftpd.yml
|
||||
register: proftpd_configured
|
||||
tags: [default, with_ftp]
|
||||
- name: Create FTP root
|
||||
become: yes
|
||||
become_method: sudo
|
||||
file:
|
||||
path: "{{ ftp_root }}"
|
||||
state: directory
|
||||
owner: ftpd
|
||||
group: nogroup
|
||||
register: ftp_root_created
|
||||
tags: [default, with_ftp]
|
||||
- name: Create a directory for website or web server source code
|
||||
file:
|
||||
path: "{{ domain_source_path }}"
|
||||
state: directory
|
||||
tags: [default, with_webserver]
|
||||
register: domain_srcdir_created
|
||||
- name: Pull website source code
|
||||
block:
|
||||
- name: Git pull website git repository
|
||||
become_user: git
|
||||
become_method: sudo
|
||||
git:
|
||||
repo: "{{ source_repo.url }}"
|
||||
dest: "{{ domain_source_path }}"
|
||||
single_branch: yes
|
||||
version: main
|
||||
when: source_repo.utility == 'git'
|
||||
register: website_src_available
|
||||
when: source_repo is defined
|
||||
tags: [default, with_webserver]
|
||||
- name: Create fstab entry for rbind mount for web root
|
||||
become: yes
|
||||
become_method: sudo
|
||||
ansible.posix.mount:
|
||||
src: "{{ domain_source_path }}"
|
||||
path: "{{ domain_root }}"
|
||||
fstype: none
|
||||
opts: rbind
|
||||
state: mounted
|
||||
register: webmount_created
|
||||
tags: [default, with_webserver]
|
||||
- name: Create a gocryptfs vault for mounting under FTP root
|
||||
command:
|
||||
argv: [/usr/bin/gocryptfs, -init, "{{ ansible_facts['user_dir'] }}/secrets"]
|
||||
stdin: "{{ gocrypt_password }}"
|
||||
register: secrets_masterkey_created
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
- name: Get gocryptfs decryption configuration file metadata
|
||||
stat:
|
||||
path: "{{ ansible_facts['user_dir'] }}/secrets"
|
||||
register: secrets_vault
|
||||
when: secrets_masterkey_created.rc == 0
|
||||
- name: Create a file to store password for secrets gocryptfs vault
|
||||
file:
|
||||
path: "{{ ansible_facts['user_dir'] }}/config/.secrets_vault.key"
|
||||
state: touch
|
||||
register: secrets_passfile_created
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
- name: Put password in aforementioned file
|
||||
lineinfile:
|
||||
path: "{{ gcfs_passfile_created.path }}"
|
||||
line: "{{ gocrypt_password }}"
|
||||
state: present
|
||||
when: secrets_passfile_created
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
- name: Copy gocryptfs decryption configuration of secrets vault to hidden directory
|
||||
copy:
|
||||
remote_src: "{{ ansible_facts['user_dir'] }}/secrets/gocryptfs.conf"
|
||||
dest: "{{ ansible_facts['user_dir'] }}/.fskeys/ciphers/secrets.conf"
|
||||
force: yes
|
||||
backup: yes
|
||||
register: secrets_conf_copied
|
||||
when: secrets_vault.stat.exists and secrets_masterkey_created.rc == 0
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
- name: Remove gocryptfs decryption configuration from vault
|
||||
file:
|
||||
path: "{{ ansible_facts['user_dir'] }}/secrets/gocryptfs.conf"
|
||||
state: absent
|
||||
when: secrets_conf_copied
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
- name: Mount the gocryptfs secrets vault
|
||||
ansible.posix.mount:
|
||||
src: "{{ ansible_facts['user_dir'] }}/secrets"
|
||||
path: "{{ ansible_facts['user_dir'] }}/.mnt/secrets.plain"
|
||||
state: mounted
|
||||
fstype: fuse./usr/bin/gocryptfs
|
||||
opts: "nofail,passfile={{ secrets_passfile_created.path }},config={{ ansible_facts['user_dir'] }}/.fskeys/ciphers/secrets.conf"
|
||||
register: secrets_mounted
|
||||
when: secrets_vault.stat.exists and secrets_masterkey_created.rc == 0
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
#@TODO create handler that sends copy of gcfs_masterkey_created somehow
|
||||
- name: Create users for ProFTPd
|
||||
block:
|
||||
- name: Create ProFTPd user webmaster for website
|
||||
become: yes
|
||||
become_method: sudo
|
||||
command:
|
||||
argv:
|
||||
- /usr/local/bin/ftpasswd
|
||||
- --passwd
|
||||
- --file=/etc/proftpd/ftpd.passwd
|
||||
- --name=webmaster
|
||||
- "--home={{ domain_root }}/public"
|
||||
- --shell=/bin/false
|
||||
- --sha256
|
||||
- --stdin
|
||||
stdin: "{{ ftp_web_password }}"
|
||||
register: proftpd_webmaster_created
|
||||
tags: [with_webserver]
|
||||
- name: Create home directory for ProFTPd user cybersmuggler
|
||||
become: yes
|
||||
become_method: sudo
|
||||
file:
|
||||
path: "{{ ftp_root }}/black_market"
|
||||
state: directory
|
||||
owner: "{{ ansible_facts['user_id'] }}"
|
||||
group: "{{ ansible_facts['user_id'] }}"
|
||||
register: cybersmuggler_home_created
|
||||
- name: Create ProFTPd user cybersmuggler for file-sharing
|
||||
become: yes
|
||||
become_method: sudo
|
||||
command:
|
||||
argv:
|
||||
- /usr/local/bin/ftpasswd
|
||||
- --passwd
|
||||
- --file=/etc/proftpd/ftpd.passwd
|
||||
- --name=cybersmuggler
|
||||
- --uid=1000
|
||||
- "--home={{ ftp_root }}/black_market"
|
||||
- --shell=/bin/false
|
||||
- --sha256
|
||||
- --stdin
|
||||
stdin: "{{ ftp_password }}"
|
||||
register: proftpd_cybersmuggler_created
|
||||
register: proftpd_users_created
|
||||
tags: [default, with_ftp]
|
||||
- name: Create fstab entry for rbind mount for secrets decrypted vault
|
||||
become: yes
|
||||
become_method: sudo
|
||||
ansible.posix.mount:
|
||||
src: "{{ ansible_facts['user_dir'] }}/.mnt/secrets.plain"
|
||||
path: "{{ ftp_root }}/black_market/secrets"
|
||||
fstype: none
|
||||
opts: rbind
|
||||
state: mounted
|
||||
when: secrets_mounted
|
||||
tags: ['default', 'with_ftp', 'with_ftp_crypt_dir']
|
||||
#@TODO create tasks for setting up Caddy--maybe?
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
---
|
||||
- name: Bootstrap virtual private servers
|
||||
hosts: vps
|
||||
gather_facts: yes
|
||||
vars:
|
||||
# # below is just to remind you to use '-u' instead
|
||||
# ansible_user: "{{ root_auths[0].username }}"
|
||||
# # below is just to remind you to use '--ask-pass' instead
|
||||
# ansible_password: "{{ root_auths[0].password }}"
|
||||
FAMILY: "{{ ansible_facts['os_family'] }}"
|
||||
|
||||
tasks:
|
||||
- name: Create users
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: "users@{{ FAMILY }}.yml"
|
||||
vars:
|
||||
admins: "{{ admin_auths }}"
|
||||
guests: "{{ guest_auths }}"
|
||||
users: "{{ user_auths }}"
|
||||
register: accts_created
|
||||
tags: ['default', 'userbase_creation']
|
||||
- name: Require authorized keys for SSH access to accounts
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: auth@ssh.yml
|
||||
defaults_from: options/ssh.yml
|
||||
vars_from: options/ssh.yml
|
||||
register: ssh_authorized
|
||||
tags: ['default', 'ssh_uthorization']
|
||||
- name: Disable SSH login for this account
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: denyroot@ssh.yml
|
||||
defaults_from: options/ssh.yml
|
||||
vars_from: options/ssh.yml
|
||||
register: sshroot_disabled
|
||||
tags: ['default', 'root_denial']
|
||||
when: not ssh_root_login
|
||||
- name: Disable root account
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: denyroot.yml
|
||||
defaults_from: options/ssh.yml
|
||||
vars_from: options/ssh.yml
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
- name: Install packages
|
||||
hosts: vps
|
||||
gather_facts: yes
|
||||
vars:
|
||||
# # below is just to remind you to use '-u' instead
|
||||
# ansible_user: "{{ admin_auths[0].username }}"
|
||||
# # below is just to remind you to use '--ask-pass' instead
|
||||
# ansible_password: "{{ admin_auths[0].password }}"
|
||||
FAMILY: "{{ ansible_facts['os_family'] }}"
|
||||
CORE_PKGS: "core_pkgs@{{ ansible_facts['os_family'] }}.yml"
|
||||
want_extra_pkgs: no
|
||||
porkbun_certbot_plugin: yes
|
||||
|
||||
tasks:
|
||||
- name: Install core packages
|
||||
become: yes
|
||||
become_method: sudo
|
||||
block:
|
||||
- name: Install native packages
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: "core_installations.yml"
|
||||
defaults_from: "{{ CORE_PKGS }}"
|
||||
tags: ['native_pkgs']
|
||||
- name: Install foreign packages
|
||||
include_role:
|
||||
name: bootstrap
|
||||
tasks_from: "core_installations@{{ FAMILY }}.yml"
|
||||
defaults_from: "{{ CORE_PKGS }}"
|
||||
handlers_from: "update@{{ family }}.yml"
|
||||
tags: ['foreign_pkgs']
|
||||
register: core_done
|
||||
tags: ['default', 'core']
|
||||
- name: Install additional packages
|
||||
become: yes
|
||||
become_method: sudo
|
||||
include_role:
|
||||
tasks_from: extra_installations.yml
|
||||
defaults_from: "custom_pkgs@{{ FAMILY }}.yml"
|
||||
register: extra_pkgs_done
|
||||
when: want_extra_pkgs
|
||||
tags: ['default', 'extra_pkgs']
|
||||
- name: Install a Porkbun API plugin for Certbot
|
||||
become: yes
|
||||
become_method: sudo
|
||||
pip:
|
||||
name: 'git+https://github.com/infinityofspace/certbot_dns_porkbun.git'
|
||||
state: present
|
||||
when: porkbun_certbot_plugin
|
||||
tags: ['default', 'with_porkbun_api']
|
||||
- name: Get ftpasswd utility for ProFTPd
|
||||
become: yes
|
||||
become_method: sudo
|
||||
get_url:
|
||||
url: http://www.castaglia.org/proftpd/contrib/ftpasswd
|
||||
dest: /usr/local/bin/ftpasswd
|
||||
mode: "0755"
|
||||
tags: ['default', 'with_ftp']
|
||||
Reference in New Issue
Block a user