# All hosts are debian 10 --- # Common - hosts: daily,compute,nfs,router become: yes handlers: - import_tasks: handlers.yml tasks: # Core - name: Install common packages apt: name: - apt-listchanges - chrony - curl - dma - git - htop - iperf3 - mosh - nmap - oidentd - rsync - smartmontools - speedtest-cli - tmux - unattended-upgrades - vim force_apt_get: yes update_cache: yes - name: Disable MOTDs command: chmod -x /etc/update-motd.d/10-uname args: warn: no - name: Set MOTD copy: src: files/motd dest: /etc/motd owner: root group: root mode: '0644' # TODO Change defaults - name: Configure unattended-upgrades copy: src: files/50unattended-upgrades dest: /etc/apt/apt.conf.d/50unattended-upgrades owner: root group: root mode: '0644' - name: Enable auto-upgrades copy: src: files/20auto-upgrades dest: /etc/apt/apt.conf.d/20auto-upgrades owner: root group: root mode: '0644' - name: Disable power and reset buttons copy: src: files/logind.conf dest: /etc/systemd/logind.conf owner: root group: root mode: '0644' notify: Restart systemd-logind service - name: Set chrony ntp servers copy: src: files/chrony.conf dest: /etc/chrony/chrony.conf owner: root group: root mode: '0644' notify: Restart chrony service # Core networking - name: Configure sshd_config to listen on 37121/2222/22 and disable password auth copy: src: files/sshd_config dest: /etc/ssh/sshd_config owner: root group: root mode: '0644' notify: Restart sshd service ## Changes will take effect during next reboot ## (determined by unattended-upgrades) - name: Configure sysctl with IPv6 privacy extensions template: src: templates/local.conf.j2 dest: /etc/sysctl.d/local.conf owner: root group: root mode: '0644' - name: Configure dma copy: src: files/dma.conf dest: /etc/dma/dma.conf owner: root group: mail mode: '0640' - debug: msg: 'Manually configure /etc/dma/auth.conf' - name: Configure smartd copy: src: files/smartd.conf dest: /etc/smartd.conf owner: root group: root mode: '0644' notify: Restart and enable smartd ### Router ##- hosts: router ## become: yes ## tasks: ## - name: Install frrouting and related router packages ## - name: Configure bgp, etc??? # Media networking (Wireguard VPN, NFS) - hosts: compute,nfs become: yes handlers: - import_tasks: handlers.yml tasks: - name: Add unstable repository shell: | echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable args: creates: /etc/apt/sources.list.d/unstable.list - name: Install media networking packages apt: name: - beets - nfs-common - wireguard force_apt_get: yes update_cache: yes - debug: msg: - Manually do wireguard config https://wiki.debian.org/Wireguard - Manuall do beets config https://wiki.archlinux.org/index.php/Beets # NFS core config # ASSUMES /bigdata IS CONFIGURED (make sure dir is 755) - hosts: nfs become: yes handlers: - import_tasks: handlers.yml tasks: - name: Install zfs-zed, dma, and nfs-kernel-server apt: name: - dma - nfs-kernel-server - zfs-zed force_apt_get: yes update_cache: yes - name: Configure zfs-zed copy: src: files/zed.rc dest: /etc/zfs/zed.d/zed.rc owner: root group: root mode: '0644' notify: Restart zfs-zed - name: Install weekly bigdata scrub cron job cron: name: 'Scrub bigdata zfs pool' special_time: weekly job: 'zpool scrub bigdata' user: root - name: Install rclone apt: deb: https://github.com/rclone/rclone/releases/download/v1.49.2/rclone-v1.49.2-linux-amd64.deb force_apt_get: yes - debug: msg: Manually configure rclone remote drive - name: Export /bigdata copy: src: files/exports dest: /etc/exports owner: root group: root mode: '0644' notify: Re-export exportfs # Compute core config - hosts: compute become: yes tasks: - name: Install Docker + compute dependencies apt: name: - apt-transport-https - ca-certificates - gnupg2 - software-properties-common - sshfs force_apt_get: yes update_cache: yes - name: Mount bigdummy /bigdata via NFS mount: src: 10.200.0.202:/bigdata path: /bigdata fstype: nfs opts: soft,nodev,nosuid state: mounted # Might require running manually mounting - name: Mount vtluug /media via sshfs mount: src: pew-media@dirtycow.vtluug.org:/nfs/cistern/share/media path: /media-vtluug fstype: fuse.sshfs opts: reconnect,allow_other,ro,_netdev,IdentityFile=/home/paul/.ssh/id_rsa_fast state: mounted - name: Add Docker GPG key apt_key: url: https://download.docker.com/linux/debian/gpg - name: Add Docker APT repository apt_repository: repo: deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable - name: Install Docker CE apt: name: - docker-ce - docker-ce-cli - containerd.io force_apt_get: yes update_cache: yes - name: Add paul to docker group user: name: paul groups: docker append: yes - debug: msg: Clone docker repo to start services