scripts/ansible/main.yml

260 lines
6.2 KiB
YAML

# All hosts are debian 10
---
# Common
- hosts: daily,compute,nfs,router
become: yes
handlers:
- import_tasks: handlers.yml
tasks:
# Core
- name: Install common packages
apt:
name:
- apt-listchanges
- chrony
- curl
- dma
- git
- htop
- iperf3
- mosh
- nmap
- oidentd
- rsync
- smartmontools
- speedtest-cli
- tmux
- unattended-upgrades
- vim
force_apt_get: yes
update_cache: yes
- name: Disable MOTDs
command: chmod -x /etc/update-motd.d/10-uname
args:
warn: no
- name: Set MOTD
copy:
src: files/motd
dest: /etc/motd
owner: root
group: root
mode: '0644'
# TODO Change defaults
- name: Configure unattended-upgrades
copy:
src: files/50unattended-upgrades
dest: /etc/apt/apt.conf.d/50unattended-upgrades
owner: root
group: root
mode: '0644'
- name: Enable auto-upgrades
copy:
src: files/20auto-upgrades
dest: /etc/apt/apt.conf.d/20auto-upgrades
owner: root
group: root
mode: '0644'
- name: Disable power and reset buttons
copy:
src: files/logind.conf
dest: /etc/systemd/logind.conf
owner: root
group: root
mode: '0644'
notify: Restart systemd-logind service
- name: Set chrony ntp servers
copy:
src: files/chrony.conf
dest: /etc/chrony/chrony.conf
owner: root
group: root
mode: '0644'
notify: Restart chrony service
# Core networking
- name: Configure sshd_config to listen on 37121/2222/22 and disable password auth
copy:
src: files/sshd_config
dest: /etc/ssh/sshd_config
owner: root
group: root
mode: '0644'
notify: Restart sshd service
## Changes will take effect during next reboot
## (determined by unattended-upgrades)
- name: Configure sysctl with IPv6 privacy extensions
template:
src: templates/local.conf.j2
dest: /etc/sysctl.d/local.conf
owner: root
group: root
mode: '0644'
- name: Configure dma
copy:
src: files/dma.conf
dest: /etc/dma/dma.conf
owner: root
group: mail
mode: '0640'
- debug:
msg: 'Manually configure /etc/dma/auth.conf'
- name: Configure smartd
copy:
src: files/smartd.conf
dest: /etc/smartd.conf
owner: root
group: root
mode: '0644'
notify: Restart and enable smartd
### Router
##- hosts: router
## become: yes
## tasks:
## - name: Install frrouting and related router packages
## - name: Configure bgp, etc???
# Media networking (Wireguard VPN, NFS)
- hosts: compute,nfs
become: yes
handlers:
- import_tasks: handlers.yml
tasks:
- name: Add unstable repository
shell: |
echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable
args:
creates: /etc/apt/sources.list.d/unstable.list
- name: Install media networking packages
apt:
name:
- beets
- nfs-common
- wireguard
force_apt_get: yes
update_cache: yes
- debug:
msg:
- Manually do wireguard config https://wiki.debian.org/Wireguard
- Manuall do beets config https://wiki.archlinux.org/index.php/Beets
# NFS core config
# ASSUMES /bigdata IS CONFIGURED (make sure dir is 755)
- hosts: nfs
become: yes
handlers:
- import_tasks: handlers.yml
tasks:
- name: Install zfs-zed, dma, and nfs-kernel-server
apt:
name:
- dma
- nfs-kernel-server
- zfs-zed
force_apt_get: yes
update_cache: yes
- name: Configure zfs-zed
copy:
src: files/zed.rc
dest: /etc/zfs/zed.d/zed.rc
owner: root
group: root
mode: '0644'
notify: Restart zfs-zed
- name: Install weekly bigdata scrub cron job
cron:
name: 'Scrub bigdata zfs pool'
special_time: weekly
job: 'zpool scrub bigdata'
user: root
- name: Install rclone
apt:
deb: https://github.com/rclone/rclone/releases/download/v1.49.2/rclone-v1.49.2-linux-amd64.deb
force_apt_get: yes
- debug:
msg: Manually configure rclone remote drive
- name: Export /bigdata
copy:
src: files/exports
dest: /etc/exports
owner: root
group: root
mode: '0644'
notify: Re-export exportfs
# Compute core config
- hosts: compute
become: yes
tasks:
- name: Install Docker + compute dependencies
apt:
name:
- apt-transport-https
- ca-certificates
- gnupg2
- software-properties-common
- sshfs
force_apt_get: yes
update_cache: yes
- name: Mount bigdummy /bigdata via NFS
mount:
src: 10.200.0.202:/bigdata
path: /bigdata
fstype: nfs
opts: soft,nodev,nosuid
state: mounted
# Might require running manually mounting
- name: Mount vtluug /media via sshfs
mount:
src: pew-media@dirtycow.vtluug.org:/nfs/cistern/share/media
path: /media-vtluug
fstype: fuse.sshfs
opts: reconnect,allow_other,ro,_netdev,IdentityFile=/home/paul/.ssh/id_rsa_fast
state: mounted
- name: Add Docker GPG key
apt_key:
url: https://download.docker.com/linux/debian/gpg
- name: Add Docker APT repository
apt_repository:
repo: deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable
- name: Install Docker CE
apt:
name:
- docker-ce
- docker-ce-cli
- containerd.io
force_apt_get: yes
update_cache: yes
- name: Add paul to docker group
user:
name: paul
groups: docker
append: yes
- debug:
msg: Clone docker repo to start services