Compare commits
18 Commits
4e19976cf4
...
3a1990fe9a
Author | SHA1 | Date | |
---|---|---|---|
3a1990fe9a | |||
6f1af3aef9 | |||
194bcbdb7b | |||
856dcf98c7 | |||
8b65e8cf70 | |||
806bb84fa8 | |||
c5dbaf38e1 | |||
cf30fbe2e6 | |||
36ca2d681a | |||
f7b222e499 | |||
8112fd3866 | |||
2be2790e52 | |||
959846ae46 | |||
ed5010fe9a | |||
0626b20e85 | |||
156a3b5c01 | |||
f12da6547d | |||
57c5e8051c |
@ -1,7 +1,7 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
34656463636239626332366464373337386539643933653433653362613238666330636334323465
|
61346634373262366638356239623132393734353135376535653433636137363331646432323438
|
||||||
6666373739386430643330666238366237646365623634370a363530303762373036616332313966
|
3666376430616632613366653463303431313336346166330a616166366330333038666164626663
|
||||||
31343339373532346538393164373037396135633631653133663862316161373566633938386234
|
62623562333864613537313436323136666336656533346264323730386130316566633432383531
|
||||||
6366613030386432320a313262383838663262373037643138616131343337626234306436323462
|
3338333862626664380a366638656363363663303031646366303964333361646336666134333134
|
||||||
64333262663662353836303365316433353463326664623838353339376164313235363339313238
|
37383035613166663838373632343061656537326163303831323335333464613964656531383933
|
||||||
3865613230306436346365623338366564346633343565623964
|
3833343663333130636631643865393933656332616636366263
|
||||||
|
@ -7,6 +7,7 @@ base_common_addpkg:
|
|||||||
- firefox-locale-it
|
- firefox-locale-it
|
||||||
- libreoffice-l10n-it
|
- libreoffice-l10n-it
|
||||||
- libnss-myhostname
|
- libnss-myhostname
|
||||||
|
- ubuntu-restricted-extras
|
||||||
base_common_delpkg:
|
base_common_delpkg:
|
||||||
- libnss-mdns
|
- libnss-mdns
|
||||||
- unity-webapps-common
|
- unity-webapps-common
|
||||||
|
@ -27,11 +27,6 @@
|
|||||||
- pkgs
|
- pkgs
|
||||||
- packages
|
- packages
|
||||||
|
|
||||||
#- include: audio.yml
|
|
||||||
# tags:
|
|
||||||
# - base
|
|
||||||
# - audio
|
|
||||||
|
|
||||||
- include: system.yml
|
- include: system.yml
|
||||||
tags:
|
tags:
|
||||||
- base
|
- base
|
||||||
|
@ -1,6 +1,18 @@
|
|||||||
---
|
---
|
||||||
# Management of packages
|
# Management of packages
|
||||||
|
|
||||||
|
- name: Activate LTS support by the means of HWE stack
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- linux-generic-lts-xenial
|
||||||
|
- xserver-xorg-core-lts-xenial
|
||||||
|
- xserver-xorg-lts-xenial
|
||||||
|
- xserver-xorg-video-all-lts-xenial
|
||||||
|
- xserver-xorg-input-all-lts-xenial
|
||||||
|
- libwayland-egl1-mesa-lts-xenial
|
||||||
|
state: present
|
||||||
|
install_recommends: yes
|
||||||
|
|
||||||
- name: Removing packages commonly not required
|
- name: Removing packages commonly not required
|
||||||
apt:
|
apt:
|
||||||
pkg: '{{ item }}'
|
pkg: '{{ item }}'
|
||||||
|
@ -19,6 +19,12 @@
|
|||||||
state: absent
|
state: absent
|
||||||
when: get_epo_srv_name|changed
|
when: get_epo_srv_name|changed
|
||||||
|
|
||||||
|
- name: Ensuring epoptes-client is installed
|
||||||
|
apt:
|
||||||
|
name: epoptes-client
|
||||||
|
state: present
|
||||||
|
when: get_epo_srv_name|changed
|
||||||
|
|
||||||
- name: Configuring the client
|
- name: Configuring the client
|
||||||
replace:
|
replace:
|
||||||
dest: /etc/default/epoptes-client
|
dest: /etc/default/epoptes-client
|
||||||
|
@ -1,6 +1,11 @@
|
|||||||
---
|
---
|
||||||
# Managing Epoptes installation on 'docenti' role.
|
# Managing Epoptes installation on 'docenti' role.
|
||||||
|
|
||||||
|
- name: Ensuring epoptes package has been installed
|
||||||
|
apt:
|
||||||
|
name: epoptes
|
||||||
|
state: present
|
||||||
|
|
||||||
- name: Configuring the Epoptes server
|
- name: Configuring the Epoptes server
|
||||||
lineinfile:
|
lineinfile:
|
||||||
dest: /etc/default/epoptes
|
dest: /etc/default/epoptes
|
||||||
@ -29,3 +34,19 @@
|
|||||||
- name: Starting epoptes from upstart
|
- name: Starting epoptes from upstart
|
||||||
shell: /sbin/start epoptes
|
shell: /sbin/start epoptes
|
||||||
when: epoptes_status.stdout.find("start/running") == -1
|
when: epoptes_status.stdout.find("start/running") == -1
|
||||||
|
|
||||||
|
# Disabling ufw as per issue #12
|
||||||
|
- name: Disabling ufw by override
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/init/ufw.override
|
||||||
|
line: "manual"
|
||||||
|
state: present
|
||||||
|
create: yes
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
- name: Stopping ufw
|
||||||
|
service:
|
||||||
|
name: ufw
|
||||||
|
state: stopped
|
||||||
|
@ -1,4 +1,5 @@
|
|||||||
---
|
---
|
||||||
dependencies:
|
dependencies:
|
||||||
|
- { role: base }
|
||||||
- { role: client }
|
- { role: client }
|
||||||
- { role: docenti }
|
- { role: docenti }
|
||||||
|
@ -1,9 +1,10 @@
|
|||||||
---
|
---
|
||||||
# Manages reactivation of pulseaudio as system daemon
|
# Manages reactivation of pulseaudio as system daemon
|
||||||
|
|
||||||
- name: "Changing pulseaudio upstart script"
|
- name: "Allowing pulseaudio to run at startup"
|
||||||
template:
|
replace:
|
||||||
src: pulseaudio.conf
|
regexp: '^#start on runlevel.*$'
|
||||||
|
replace: 'start on runlevel [2345]'
|
||||||
dest: /etc/init/pulseaudio.conf
|
dest: /etc/init/pulseaudio.conf
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
@ -29,9 +30,15 @@
|
|||||||
- name: Disabling pulseaudio startup on lightdm
|
- name: Disabling pulseaudio startup on lightdm
|
||||||
shell: chmod -x /usr/bin/start-pulseaudio-x11
|
shell: chmod -x /usr/bin/start-pulseaudio-x11
|
||||||
|
|
||||||
#- name: Adding pulseaudio fixing script at reboot.
|
- name: Removing old (and not-working) approach
|
||||||
# lineinfile:
|
file:
|
||||||
# line: '@reboot root curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/preseed/pulseaudio-perms.sh | bash >/dev/null 2>&1'
|
path: /etc/cron.d/pulseaudio-perms
|
||||||
# dest: /etc/cron.d/pulseaudio-perms
|
state: absent
|
||||||
# create: yes
|
|
||||||
# state: present
|
- name: Get the new script
|
||||||
|
get_url:
|
||||||
|
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh"
|
||||||
|
dest: /tmp/paperms.sh
|
||||||
|
|
||||||
|
- name: Run the script (install other support files and fixes the permissions)
|
||||||
|
shell: bash /tmp/paperms.sh
|
||||||
|
@ -26,10 +26,10 @@
|
|||||||
- domain
|
- domain
|
||||||
- gui
|
- gui
|
||||||
|
|
||||||
- include: sslproxy.yml
|
#- include: sslproxy.yml
|
||||||
tags:
|
# tags:
|
||||||
- domain
|
# - domain
|
||||||
- crt
|
# - crt
|
||||||
|
|
||||||
- include: pkgs.yml
|
- include: pkgs.yml
|
||||||
tags:
|
tags:
|
||||||
|
@ -1,16 +1,16 @@
|
|||||||
---
|
---
|
||||||
# Fixing NetworkManager issues.
|
# Fixing NetworkManager issues.
|
||||||
|
|
||||||
- name: Ensuring first NIC will never be disabled again
|
#- name: Ensuring first NIC will never be disabled again
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
line: "{{ item }}"
|
# line: "{{ item }}"
|
||||||
state: present
|
# state: present
|
||||||
dest: /etc/network/interfaces
|
# dest: /etc/network/interfaces
|
||||||
insertafter: EOF
|
# insertafter: EOF
|
||||||
with_items:
|
# with_items:
|
||||||
- " "
|
# - " "
|
||||||
- "auto eth0"
|
# - "auto eth0"
|
||||||
- "iface eth0 inet dhcp"
|
# - "iface eth0 inet dhcp"
|
||||||
|
|
||||||
# Hiding icon for any sessions
|
# Hiding icon for any sessions
|
||||||
|
|
||||||
|
@ -45,6 +45,4 @@ post-start script
|
|||||||
chown pulse:pulse-access /var/run/pulse/.pulse-cookie
|
chown pulse:pulse-access /var/run/pulse/.pulse-cookie
|
||||||
chmod 640 /var/run/pulse/.pulse-cookie
|
chmod 640 /var/run/pulse/.pulse-cookie
|
||||||
fi
|
fi
|
||||||
# Run script to fix permissions on the pulseaudio stack
|
|
||||||
/usr/bin/curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/preseed/pulseaudio-perms.sh | /bin/bash >/dev/null 2>&1 &
|
|
||||||
end script
|
end script
|
||||||
|
42
roles/prereq/files/samba-downgrade_20161124.sh
Normal file
42
roles/prereq/files/samba-downgrade_20161124.sh
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Define a fix name. This will be used to check if the fix was already
|
||||||
|
# applied.
|
||||||
|
name=samba-downgrade_20161124.sh
|
||||||
|
|
||||||
|
# If already applied, skip
|
||||||
|
if [[ -f "/var/lib/topolin.ia/fixes/${name}.done" ]]; then
|
||||||
|
echo "Already fixed with ${name}. Skipping."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Make the required modifications.
|
||||||
|
|
||||||
|
export DEBIAN_FRONTEND=noninteractive
|
||||||
|
apt-get install -q -y --force-yes \
|
||||||
|
-o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
|
||||||
|
libsmbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
python-samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
samba-common=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
samba-common-bin=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
samba-dsdb-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
samba-libs=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
samba-vfs-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
smbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
libnss-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
libpam-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
libwbclient0=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||||
|
winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1
|
||||||
|
|
||||||
|
pkglist="libsmbclient python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0"
|
||||||
|
|
||||||
|
for pkg in ${pkglist}; do
|
||||||
|
apt-mark auto ${pkg}
|
||||||
|
apt-mark hold ${pkg}
|
||||||
|
done
|
||||||
|
|
||||||
|
# Once modified the system, ensure to create a check file to skip and not run
|
||||||
|
# it again if not needed.
|
||||||
|
mkdir -p /var/lib/topolin.ia/fixes
|
||||||
|
echo "$(date --iso | tr -d '-')" > /var/lib/topolin.ia/fixes/${name}.done
|
18
roles/prereq/tasks/fixes.yml
Normal file
18
roles/prereq/tasks/fixes.yml
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
---
|
||||||
|
# Permits to apply per-site signed fixes automatically
|
||||||
|
#
|
||||||
|
# Prepare a script file, then crypt it with the Domain Administrator password:
|
||||||
|
# gpg -r info@bglug.it --symmetric --encrypt script.sh > script.sh.gpg
|
||||||
|
#
|
||||||
|
# Put the script within the server directory /var/lib/nethserver/ibay/ks/fixes
|
||||||
|
#
|
||||||
|
# List the file within domain.yml:
|
||||||
|
# apply_fixes:
|
||||||
|
# - script.sh.gpg
|
||||||
|
#
|
||||||
|
# Please see roles/prereq/files/samba-downgrade_20161124.sh as a template.
|
||||||
|
#
|
||||||
|
|
||||||
|
- name: Applying local signed fixes
|
||||||
|
shell: "/usr/bin/curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/fixes/{{ item }} | /usr/bin/gpg --passphrase {{ domainadminpasswd }} --decrypt | sudo /bin/bash"
|
||||||
|
with_items: "{{ ansible_local.domain.apply_fixes|default([]) }}"
|
@ -10,3 +10,9 @@
|
|||||||
tags:
|
tags:
|
||||||
- prereq
|
- prereq
|
||||||
- repos
|
- repos
|
||||||
|
|
||||||
|
- include: fixes.yml
|
||||||
|
tags:
|
||||||
|
- prereq
|
||||||
|
- fixes
|
||||||
|
when: ansible_local.domain.apply_fixes is defined
|
||||||
|
Loading…
x
Reference in New Issue
Block a user