Compare commits

...

18 Commits

Author SHA1 Message Date
3a1990fe9a Reverting blocking error on disable-upgrade and disabilitation of eth0 interface. 2018-11-11 20:48:00 +01:00
6f1af3aef9 Removed ssl certificate requirements. 2018-11-11 20:47:18 +01:00
194bcbdb7b Fixing audio not starting. 2018-11-11 20:47:09 +01:00
856dcf98c7 Aggiunta cartella di produzione per Liceo del Seminario Vescovile di Bergamo. 2018-11-11 20:38:40 +01:00
8b65e8cf70 Removed ssl certificate requirements. 2018-11-11 20:38:32 +01:00
806bb84fa8 Correcting domainpwd.vault. 2018-11-11 20:38:32 +01:00
c5dbaf38e1 Fixing the client side as per paperms-fix server-config branch. 2018-11-11 14:09:37 +01:00
cf30fbe2e6 Should fix issue #1. 2018-11-11 14:09:02 +01:00
36ca2d681a Should fix issue #2. 2018-11-11 14:08:57 +01:00
f7b222e499 Removing old unused stuff. 2018-11-11 14:08:43 +01:00
8112fd3866 Adding base role to domain. 2018-11-11 13:06:14 +00:00
2be2790e52 Should fix issue #1. 2018-11-11 13:06:14 +00:00
959846ae46 Should fix issue #2. 2018-11-11 13:06:14 +00:00
ed5010fe9a Removing old unused stuff. 2018-11-11 13:06:14 +00:00
0626b20e85 Adding local signed fixes. 2018-11-08 22:55:41 +01:00
156a3b5c01
Preventing breakage for epoptes package missing. Disabling ufw on docente as per issue #12. (#16) 2017-12-13 00:17:21 +01:00
f12da6547d
Ensuring epoptes-client is installed before modifying its files. (#15)
* Ensuring epoptes-client is installed before touching its files.
2017-12-12 23:51:25 +01:00
57c5e8051c Re-enabling audio fix. (#13) 2017-10-06 02:48:38 +02:00
14 changed files with 143 additions and 36 deletions

View File

@ -1,7 +1,7 @@
$ANSIBLE_VAULT;1.1;AES256 $ANSIBLE_VAULT;1.1;AES256
34656463636239626332366464373337386539643933653433653362613238666330636334323465 61346634373262366638356239623132393734353135376535653433636137363331646432323438
6666373739386430643330666238366237646365623634370a363530303762373036616332313966 3666376430616632613366653463303431313336346166330a616166366330333038666164626663
31343339373532346538393164373037396135633631653133663862316161373566633938386234 62623562333864613537313436323136666336656533346264323730386130316566633432383531
6366613030386432320a313262383838663262373037643138616131343337626234306436323462 3338333862626664380a366638656363363663303031646366303964333361646336666134333134
64333262663662353836303365316433353463326664623838353339376164313235363339313238 37383035613166663838373632343061656537326163303831323335333464613964656531383933
3865613230306436346365623338366564346633343565623964 3833343663333130636631643865393933656332616636366263

View File

@ -7,6 +7,7 @@ base_common_addpkg:
- firefox-locale-it - firefox-locale-it
- libreoffice-l10n-it - libreoffice-l10n-it
- libnss-myhostname - libnss-myhostname
- ubuntu-restricted-extras
base_common_delpkg: base_common_delpkg:
- libnss-mdns - libnss-mdns
- unity-webapps-common - unity-webapps-common

View File

@ -27,11 +27,6 @@
- pkgs - pkgs
- packages - packages
#- include: audio.yml
# tags:
# - base
# - audio
- include: system.yml - include: system.yml
tags: tags:
- base - base

View File

@ -1,6 +1,18 @@
--- ---
# Management of packages # Management of packages
- name: Activate LTS support by the means of HWE stack
apt:
name:
- linux-generic-lts-xenial
- xserver-xorg-core-lts-xenial
- xserver-xorg-lts-xenial
- xserver-xorg-video-all-lts-xenial
- xserver-xorg-input-all-lts-xenial
- libwayland-egl1-mesa-lts-xenial
state: present
install_recommends: yes
- name: Removing packages commonly not required - name: Removing packages commonly not required
apt: apt:
pkg: '{{ item }}' pkg: '{{ item }}'

View File

@ -19,6 +19,12 @@
state: absent state: absent
when: get_epo_srv_name|changed when: get_epo_srv_name|changed
- name: Ensuring epoptes-client is installed
apt:
name: epoptes-client
state: present
when: get_epo_srv_name|changed
- name: Configuring the client - name: Configuring the client
replace: replace:
dest: /etc/default/epoptes-client dest: /etc/default/epoptes-client

View File

@ -1,6 +1,11 @@
--- ---
# Managing Epoptes installation on 'docenti' role. # Managing Epoptes installation on 'docenti' role.
- name: Ensuring epoptes package has been installed
apt:
name: epoptes
state: present
- name: Configuring the Epoptes server - name: Configuring the Epoptes server
lineinfile: lineinfile:
dest: /etc/default/epoptes dest: /etc/default/epoptes
@ -29,3 +34,19 @@
- name: Starting epoptes from upstart - name: Starting epoptes from upstart
shell: /sbin/start epoptes shell: /sbin/start epoptes
when: epoptes_status.stdout.find("start/running") == -1 when: epoptes_status.stdout.find("start/running") == -1
# Disabling ufw as per issue #12
- name: Disabling ufw by override
lineinfile:
path: /etc/init/ufw.override
line: "manual"
state: present
create: yes
owner: root
group: root
mode: 0644
- name: Stopping ufw
service:
name: ufw
state: stopped

View File

@ -1,4 +1,5 @@
--- ---
dependencies: dependencies:
- { role: base }
- { role: client } - { role: client }
- { role: docenti } - { role: docenti }

View File

@ -1,9 +1,10 @@
--- ---
# Manages reactivation of pulseaudio as system daemon # Manages reactivation of pulseaudio as system daemon
- name: "Changing pulseaudio upstart script" - name: "Allowing pulseaudio to run at startup"
template: replace:
src: pulseaudio.conf regexp: '^#start on runlevel.*$'
replace: 'start on runlevel [2345]'
dest: /etc/init/pulseaudio.conf dest: /etc/init/pulseaudio.conf
owner: root owner: root
group: root group: root
@ -29,9 +30,15 @@
- name: Disabling pulseaudio startup on lightdm - name: Disabling pulseaudio startup on lightdm
shell: chmod -x /usr/bin/start-pulseaudio-x11 shell: chmod -x /usr/bin/start-pulseaudio-x11
#- name: Adding pulseaudio fixing script at reboot. - name: Removing old (and not-working) approach
# lineinfile: file:
# line: '@reboot root curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/preseed/pulseaudio-perms.sh | bash >/dev/null 2>&1' path: /etc/cron.d/pulseaudio-perms
# dest: /etc/cron.d/pulseaudio-perms state: absent
# create: yes
# state: present - name: Get the new script
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh"
dest: /tmp/paperms.sh
- name: Run the script (install other support files and fixes the permissions)
shell: bash /tmp/paperms.sh

View File

@ -26,10 +26,10 @@
- domain - domain
- gui - gui
- include: sslproxy.yml #- include: sslproxy.yml
tags: # tags:
- domain # - domain
- crt # - crt
- include: pkgs.yml - include: pkgs.yml
tags: tags:

View File

@ -1,16 +1,16 @@
--- ---
# Fixing NetworkManager issues. # Fixing NetworkManager issues.
- name: Ensuring first NIC will never be disabled again #- name: Ensuring first NIC will never be disabled again
lineinfile: # lineinfile:
line: "{{ item }}" # line: "{{ item }}"
state: present # state: present
dest: /etc/network/interfaces # dest: /etc/network/interfaces
insertafter: EOF # insertafter: EOF
with_items: # with_items:
- " " # - " "
- "auto eth0" # - "auto eth0"
- "iface eth0 inet dhcp" # - "iface eth0 inet dhcp"
# Hiding icon for any sessions # Hiding icon for any sessions

View File

@ -45,6 +45,4 @@ post-start script
chown pulse:pulse-access /var/run/pulse/.pulse-cookie chown pulse:pulse-access /var/run/pulse/.pulse-cookie
chmod 640 /var/run/pulse/.pulse-cookie chmod 640 /var/run/pulse/.pulse-cookie
fi fi
# Run script to fix permissions on the pulseaudio stack
/usr/bin/curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/preseed/pulseaudio-perms.sh | /bin/bash >/dev/null 2>&1 &
end script end script

View File

@ -0,0 +1,42 @@
#!/bin/bash
# Define a fix name. This will be used to check if the fix was already
# applied.
name=samba-downgrade_20161124.sh
# If already applied, skip
if [[ -f "/var/lib/topolin.ia/fixes/${name}.done" ]]; then
echo "Already fixed with ${name}. Skipping."
exit 0
fi
# Make the required modifications.
export DEBIAN_FRONTEND=noninteractive
apt-get install -q -y --force-yes \
-o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
libsmbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
python-samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
samba-common=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
samba-common-bin=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
samba-dsdb-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
samba-libs=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
samba-vfs-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
smbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
libnss-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
libpam-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
libwbclient0=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1
pkglist="libsmbclient python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0"
for pkg in ${pkglist}; do
apt-mark auto ${pkg}
apt-mark hold ${pkg}
done
# Once modified the system, ensure to create a check file to skip and not run
# it again if not needed.
mkdir -p /var/lib/topolin.ia/fixes
echo "$(date --iso | tr -d '-')" > /var/lib/topolin.ia/fixes/${name}.done

View File

@ -0,0 +1,18 @@
---
# Permits to apply per-site signed fixes automatically
#
# Prepare a script file, then crypt it with the Domain Administrator password:
# gpg -r info@bglug.it --symmetric --encrypt script.sh > script.sh.gpg
#
# Put the script within the server directory /var/lib/nethserver/ibay/ks/fixes
#
# List the file within domain.yml:
# apply_fixes:
# - script.sh.gpg
#
# Please see roles/prereq/files/samba-downgrade_20161124.sh as a template.
#
- name: Applying local signed fixes
shell: "/usr/bin/curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/fixes/{{ item }} | /usr/bin/gpg --passphrase {{ domainadminpasswd }} --decrypt | sudo /bin/bash"
with_items: "{{ ansible_local.domain.apply_fixes|default([]) }}"

View File

@ -10,3 +10,9 @@
tags: tags:
- prereq - prereq
- repos - repos
- include: fixes.yml
tags:
- prereq
- fixes
when: ansible_local.domain.apply_fixes is defined