Compare commits

...

No commits in common. "master" and "salerno1.ilariaalpi" have entirely different histories.

181 changed files with 3348 additions and 1497 deletions

7
.gitignore vendored
View File

@ -1,3 +1,4 @@
update-repo.sh *.swp
Vagrantfile *.box
box-provisioning/** .vagrant/*
*.patch

View File

@ -1,17 +1,55 @@
# Ansible-pull configuration playbook for domain clients # # Ansible playbooks for a SAMBA domain controller with NethServer #
## Progetto Scuola - [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG logo" /> BgLUG][bglug] - Scenario 1 ## ## Progetto Scuola [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG Logo" /> BgLUG][bglug] - Scenary 1 ##
Configurations for [Ubuntu][ubuntu] client (or better, [Edubuntu][edubuntu]) Starting from a [NethServer][] configured machine (please check out the
inside a [SAMBA][samba] 3.0 domain with [NethServer][nethserver]. [wiki][] for the installation process from [CentOS][] and other requirements),
these playbooks provision a [SAMBA][] 3.0 domain controller which can be used
with a network of Ubuntu clients.
The files in this repository has to be read and executed by `ansible-pull` Using the default settings, it will also provide an environment to boot from
(please check it out from [Ansible][ansible]) from the client, right after the network, install and configure the clients, using a local copy of Ubuntu's
first installation via PXE and using custom kickstart files. repositories.
[bglug]: http://bglug.it "BgLUG Homepage" ### Quick start ###
[ubuntu]: http://www.ubuntu.com
[edubuntu]: http://www.edubuntu.com You may use these playbooks as follows:
[nethserver]: http://www.nethserver.org
[samba]: http://www.samba.org $ vim hosts
$ vim domain.yml
$ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub"
$ ansible-playbook setup.yml
Or, more simply:
$ bash run.sh
### Use [Vagrant][] for testing purposes ###
You may use the included `Vagrantfile` to do any tests before deploying the
machine. `vagrant` and `ansible` must be installed on the host machine, then
you may run the following commands:
$ cd /path/to/server-config
$ vagrant up
Update 14/06/2015: some basic configurations to the Vagrant box are now
provisioned via Ansible, thus making it a dependency.
Update 25/06/2015: the Vagrant box now uses a *host-only* interface instead of
a *bridged* one. If you built a Vagrant box before this date, please destroy
it, recreate a new one and reprovision it with the provided playbooks.
### To Do List ###
* Implement backup
* Detail physical installation procedure for the server machine within the
Wiki.
[bglug]: http://bglug.it/ "BgLUG Homepage"
[wiki]: https://github.com/bglug-it/server-config/wiki "server-config wiki"
[ansible]: http://www.ansible.com [ansible]: http://www.ansible.com
[nethserver]: http://www.nethserver.org
[vagrant]: http://www.vagrantup.com
[samba]: https://www.samba.org
[centos]: https://www.centos.org

133
Vagrantfile vendored Normal file
View File

@ -0,0 +1,133 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
VAGRANTFILE_API_VERSION = "2"
Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
# All Vagrant configuration is done here. The most common configuration
# options are documented and commented below. For a complete reference,
# please see the online documentation at vagrantup.com.
# Every Vagrant virtual environment requires a box to build off of.
config.vm.box = "syntaxerrormmm/nethserver-6.9"
config.vm.box_url = "https://vagrant.libreschool.org/nethserver-6.9"
config.vm.define "NethServer" do |nethserver|
end
config.vm.provider :virtualbox do |vb|
vb.name = "NethServer"
end
# Disable automatic box update checking. If you disable this, then
# boxes will only be checked for updates when the user runs
# `vagrant box outdated`. This is not recommended.
# config.vm.box_check_update = false
# Create a forwarded port mapping which allows access to a specific port
# within the machine from a port on the host machine. In the example below,
# accessing "localhost:8080" will access port 80 on the guest machine.
# config.vm.network "forwarded_port", guest: 80, host: 8080
# Create a private network, which allows host-only access to the machine
# using a specific IP.
# config.vm.network "private_network", ip: "192.168.33.10"
config.vm.network "private_network", ip: "172.16.254.1", auto_config: false
# Create a public network, which generally matched to bridged network.
# Bridged networks make the machine appear as another physical device on
# your network.
# config.vm.network "public_network"
# If true, then any SSH connections made will enable agent forwarding.
# Default value: false
# config.ssh.forward_agent = true
# Share an additional folder to the guest VM. The first argument is
# the path on the host to the actual folder. The second argument is
# the path on the guest to mount the folder. And the optional third
# argument is a set of non-required options.
# config.vm.synced_folder "../data", "/vagrant_data"
# Provider-specific configuration so you can fine-tune various
# backing providers for Vagrant. These expose provider-specific options.
# Example for VirtualBox:
#
# config.vm.provider "virtualbox" do |vb|
# # Don't boot with headless mode
# vb.gui = true
#
# # Use VBoxManage to customize the VM. For example to change memory:
# #vb.customize ["modifyvm", :id, "--memory", "1024"]
# end
#
# View the documentation for the provider you're using for more
# information on available options.
# Enable provisioning with CFEngine. CFEngine Community packages are
# automatically installed. For example, configure the host as a
# policy server and optionally a policy file to run:
#
# config.vm.provision "cfengine" do |cf|
# cf.am_policy_hub = true
# # cf.run_file = "motd.cf"
# end
#
# You can also configure and bootstrap a client to an existing
# policy server:
#
# config.vm.provision "cfengine" do |cf|
# cf.policy_server_address = "10.0.2.15"
# end
# Enable provisioning with Puppet stand alone. Puppet manifests
# are contained in a directory path relative to this Vagrantfile.
# You will need to create the manifests directory and a manifest in
# the file default.pp in the manifests_path directory.
#
# config.vm.provision "puppet" do |puppet|
# puppet.manifests_path = "manifests"
# puppet.manifest_file = "default.pp"
# end
# Enable provisioning with chef solo, specifying a cookbooks path, roles
# path, and data_bags path (all relative to this Vagrantfile), and adding
# some recipes and/or roles.
#
# config.vm.provision "chef_solo" do |chef|
# chef.cookbooks_path = "../my-recipes/cookbooks"
# chef.roles_path = "../my-recipes/roles"
# chef.data_bags_path = "../my-recipes/data_bags"
# chef.add_recipe "mysql"
# chef.add_role "web"
#
# # You may also specify custom JSON attributes:
# chef.json = { mysql_password: "foo" }
# end
# Enable provisioning with chef server, specifying the chef server URL,
# and the path to the validation key (relative to this Vagrantfile).
#
# The Opscode Platform uses HTTPS. Substitute your organization for
# ORGNAME in the URL and validation key.
#
# If you have your own Chef Server, use the appropriate URL, which may be
# HTTP instead of HTTPS depending on your configuration. Also change the
# validation key to validation.pem.
#
# config.vm.provision "chef_client" do |chef|
# chef.chef_server_url = "https://api.opscode.com/organizations/ORGNAME"
# chef.validation_key_path = "ORGNAME-validator.pem"
# end
#
# If you're using the Opscode platform, your validator client is
# ORGNAME-validator, replacing ORGNAME with your organization name.
#
# If you have your own Chef Server, the default validation client name is
# chef-validator, unless you changed the configuration.
#
# chef.validation_client_name = "ORGNAME-validator"
config.vm.provision "ansible" do |ansible|
ansible.inventory_path = "provision_hosts"
ansible.playbook = "provision.yml"
end
end

View File

@ -1,5 +1,5 @@
[defaults] [defaults]
inventory=hosts
log_path=/var/log/ansible.log
host_key_checking=False host_key_checking=False
become_method=sudo inventory=hosts
roles_path=roles
pipelining=True

31
domain.yml Normal file
View File

@ -0,0 +1,31 @@
---
# Configurazione dominio
ntpserver: pdc.salerno1.ilariaalpi.edu
server: pdc
serverip: 192.168.4.1
servernetmask: 255.255.255.0
servernet: 192.168.4.0
servergw: 192.168.4.1
serverfqdn: pdc.salerno1.ilariaalpi.edu
domainshort: SALERNO1
domainfull: salerno1.ilariaalpi.edu
dhcprange_start: 192.168.4.10
dhcprange_end: 192.168.4.60
extdnsserver1: 208.67.222.222
extdnsserver2: 208.67.220.220
org_email: miic8dz008@istruzione.it
org_company: Istituto Comprensivo Ilaria Alpi
org_countrycode: IT
org_department: "Laboratorio 1 - via Salerno, 1"
org_city: Milano
org_phone: 02 88444696
org_street: Via Salerno, 1
edu_package: secondary
mirror_mode: local
#mirror_nfs_share: 192.168.255.1:/var/spool/apt-mirror/mirror
mirror_host: it.archive.ubuntu.com
#mirror_path: /ubuntu
#mirror_security_host: security.ubuntu.com
#mirror_security_path: /ubuntu
client_gitbranch: ilariaalpi
client_gitrepo: "https://git.libreschool.org/LibreSchool/client-pull-installation.git"

View File

@ -1,7 +0,0 @@
$ANSIBLE_VAULT;1.1;AES256
34656463636239626332366464373337386539643933653433653362613238666330636334323465
6666373739386430643330666238366237646365623634370a363530303762373036616332313966
31343339373532346538393164373037396135633631653133663862316161373566633938386234
6366613030386432320a313262383838663262373037643138616131343337626234306436323462
64333262663662353836303365316433353463326664623838353339376164313235363339313238
3865613230306436346365623338366564346633343565623964

6
hosts
View File

@ -1 +1,5 @@
localhost ansible_connection=local [defaults]
host_key_checking=false
[server]
172.16.99.18 ansible_ssh_user=amgmt

View File

@ -0,0 +1,58 @@
# Default password for project #
* NS Box root user: `vagrant`
* NS Box vagrant user: `vagrant`
* Vault Password: `v4ul+Password!`
* amgmt user (server): `DoN0t4g3t!`
* bglug user (client): `s4lamanDr@`
* admin user (domain): `R0busTdom41nPa55wd!`
# How to change passwords for production deployments #
## *root* and *vagrant* users ##
These will not be required, since you will not have a virtual machine to
manage via *Vagrant*.
## Vault password ##
Clone [`client-pull-installation`][2] then, in the working copy, launch following commands:
$ ansible-vault rekey domainpwd.vault
`ansible-vault` will ask one time the old password and two times the new one.
## *amgmt* user (server-side) ##
Clone [`server-config`][1] then, in the working copy, generate a new password hash with the follwing command:
$ mkpasswd -m sha-512
The command would ask for the password to be hashed. Please copy the result string.
Open up the file `roles/init/tasks/mgmtuser.yml`, find out `password:` and then replace previous hash with the one you have just created.
## *bglug* user (client side but preseeded) ##
The definition of password for *bglug* is inside `*.seed` files, inside [`server-config`][1]. Create a new password hash with:
$ mkpasswd -m sha-512
Copy the hash in your clipboard; clone the repository, then in the working directory:
$ find . -iname \*.seed -exec $EDITOR {} \;
Within each `*.seed` file, search for the string `user-password-crypted` string and change following hash.
## *admin* user (domain valid) ##
Password must be specified within NethServer interface for the *admin* user and must be absolutely equal to the one contained inside vault file.
Clone [`client-pull-installation`][2], create new branch and modify the password inside `domainpwd.vault`:
$ ansible-vault edit domainpwd.vault
The system would ask for the vault password. Change the plain text password with your editor.
[1]: https://github.com/bglug-it/server-config
[2]: https://github.com/bglug-it/client-pull-installation

7
init.yml Normal file
View File

@ -0,0 +1,7 @@
---
- hosts: server
vars:
- ansible_ssh_user: root
roles:
- init

View File

@ -1,15 +0,0 @@
---
- hosts: localhost
user: root
vars_files:
- domainpwd.vault
roles:
- prereq
- { role: networkpackagemanager, when: '(ansible_local.domain.disable_npm is not defined or ansible_local.domain.disable_npm|bool == False) and ansible_local.checksum.needs_pkg_run|bool' }
- { role: init, when: 'ansible_local.checksum.needs_repo_run | bool' }
- { role: custom, when: 'ansible_local.checksum.needs_repo_run | bool' }
- { role: remote-control, when: 'ansible_local.checksum.needs_repo_run | bool' }
- { role: domain, when: 'ansible_local.checksum.needs_repo_run | bool' }
environment:
PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

5
ovpn-client.yml Normal file
View File

@ -0,0 +1,5 @@
---
- hosts: server
roles:
- ovpn-client

5
provision.yml Normal file
View File

@ -0,0 +1,5 @@
---
# Vagrant provisioning playbook
- hosts: vagrant
roles:
- rename-nic

3
provision_hosts Normal file
View File

@ -0,0 +1,3 @@
# Generated by Vagrant
[vagrant]
NethServer ansible_ssh_host=127.0.0.1 ansible_ssh_port=2222 ansible_ssh_user=vagrant

View File

@ -0,0 +1,14 @@
/var/log/ansible.log {
rotate 7
daily
compress
missingok
notifempty
}
/var/log/ansible-pull.log {
rotate 7
daily
compress
missingok
notifempty
}

View File

@ -0,0 +1,17 @@
---
- name: Creazione directory per ansible-pull
file: path=/var/lib/nethserver/ibay/ks/ansible-pull state=directory
become: yes
- name: Template
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
with_items:
- init-ansible.sh
- ansible-pull.sh
- getvaultpass.py
- crontab
become: yes
- name: Logrotate
copy: src=logrotate dest=/var/lib/nethserver/ibay/ks/ansible-pull/logrotate
become: yes

View File

@ -0,0 +1,4 @@
---
- include: ansible-pull.yml
tags: ansible-pull

View File

@ -0,0 +1,27 @@
#!/bin/bash
# waiting for dns stack to be ready
while true; do
[[ "$(dig +short {{ ansible_local.domain.serverfqdn }})" == "{{ ansible_local.domain.serverip }}" ]] && break;
done
# Aggiorna crontab e logrotate forzosamente.
echo "$(date --rfc-3339=seconds) Loading and running init-ansible.sh"
/usr/bin/curl -sSL4 http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | /bin/bash
# Script provvisorio.
# Potremmo decidere di far eseguire uno script generato da servizio
# domainhelper contenente anche l'eventuale branch da usare.
url=git://{{ ansible_local.domain.serverfqdn }}/client-pull-installation.git
repo=/var/lib/{{ ansible_local.domain.domainfull }}/config
logfile=/var/lib/ansible-pull.log
branch={{ ansible_local.domain.client_gitbranch }}
playbook=local.yml
echo "$(date --rfc-3339=seconds) Getting vault password"
vaultpassfile=$(/usr/bin/curl -sSL4 http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | /usr/bin/python)
echo "$(date --rfc-3339=seconds) Running ansible-pull"
/usr/bin/ansible-pull --accept-host-key -i localhost -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
rm -f "${vaultpassfile}"

View File

@ -0,0 +1 @@
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1

View File

@ -0,0 +1,30 @@
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from Crypto.Hash import MD5
from Crypto.Cipher import AES
from base64 import b64decode
from requests import get
from socket import gethostname
from tempfile import mkstemp
import time
import os
key = MD5.new(gethostname()).digest()
cipher = AES.new(key, AES.MODE_ECB)
for i in range(10):
try:
base64enc = get("http://{{ ansible_local.domain.serverfqdn }}:3000/vaultpass")
break
except:
time.sleep(1)
encrypted = b64decode(base64enc.content)
longpass = cipher.decrypt(encrypted)
fd, filename = mkstemp()
os.write(fd, longpass.strip('x'))
os.close(fd)
print(filename)

View File

@ -0,0 +1,35 @@
#!/bin/bash
# Fixing base variables.
basedir=/var/lib/{{ ansible_local.domain.domainfull }}
url=git://{{ ansible_local.domain.serverfqdn }}/client-pull-installation.git
branch={{ ansible_local.domain.client_gitbranch }}
# Creo directory dipendenti
echo "$(date --rfc-3339=seconds) Installing bin directory."
/usr/bin/install -d -o root -g users ${basedir}/bin
# Workaround issue #23 - ansible-pull won't pull out of remote the first time.
if [[ ! -f ${basedir}/config/local.yml ]]; then
/usr/bin/git clone -b ${branch} ${url} ${basedir}/config
fi
# Installo ansible-pull.sh
echo "$(date --rfc-3339=seconds) Creating ansible-pull.sh."
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O ${basedir}/bin/ansible-pull.sh
chmod a+x ${basedir}/bin/ansible-pull.sh
# Fixing permissions on the main directory
/bin/chown -R root:users ${basedir}
# Installo il cronjob per ansible-pull
echo "$(date --rfc-3339=seconds) Creating crontab"
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull
/bin/chown root:root /etc/cron.d/ansible-pull
/bin/chmod 0644 /etc/cron.d/ansible-pull
# Installo il logrotate per ansible
echo "$(date --rfc-3339=seconds) Creating logrotate"
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull
/bin/chown root:root /etc/logrotate.d/ansible-pull
/bin/chmod 0644 /etc/logrotate.d/ansible-pull

View File

@ -1,23 +0,0 @@
---
base_common_addpkg:
- vim
- screen
- cifs-utils
- ubuntu-edu-secondary
- firefox-locale-it
- libreoffice-l10n-it
- libnss-myhostname
- ubuntu-restricted-extras
base_common_delpkg:
- libnss-mdns
- unity-webapps-common
- zeitgeist-core
- zeitgeist-datahub
base_client_addpkg:
- epoptes-client
base_client_delpkg:
- epoptes
base_docenti_addpkg:
- epoptes
base_docenti_delpkg:
- epoptes-client

View File

@ -1,27 +0,0 @@
---
- name: Checking for installation of ansible
apt:
name: ansible
state: present
- name: Updating ansible-pull custom scripts
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/{{ item }}"
dest: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/{{ item }}"
force: yes
with_items:
- getvaultpass.py
- ansible-pull.sh
- name: Updating crontab for ansible-pull
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab"
dest: /etc/cron.d/ansible-pull
force: yes
- name: Updating logrotate settings for ansible-pull
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate"
dest: /etc/logrotate.d/ansible-pull
force: yes

View File

@ -1,20 +0,0 @@
---
# Manages the installation of the main desktop environment
- name: Checking for desktop environment
shell: 'tasksel --list-tasks | grep "^i edubuntu-desktop-gnome"'
ignore_errors: yes
register: check_edubuntu_pkg
changed_when: check_edubuntu_pkg.rc != 0
tags: edu-install
- name: Installation of the desktop environment
shell: "DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get -y install edubuntu-desktop-gnome^"
when: check_edubuntu_pkg is changed
tags: edu-install
- name: Change default desktop environment
replace:
dest: /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
regexp: "^user-session=ubuntu$"
replace: "user-session=gnome-fallback"

View File

@ -1,33 +0,0 @@
---
# System base configurations.
# At the end of system configuration, we should have a complete
# Edubuntu system
# Requires fact execpath, already set by prereq role.
- include: virtualbox-guest-addons.yml
tags:
- base
- virtualbox-addons
- include: system-update.yml
tags:
- base
- update
- include: desktop-environment.yml
tags:
- base
- de
- desktop-environment
- include: packages.yml
tags:
- base
- pkgs
- packages
- include: system.yml
tags:
- base
- edubuntu

View File

@ -1,59 +0,0 @@
---
# Management of packages
- name: Activate LTS support by the means of HWE stack
apt:
name:
- linux-generic-lts-xenial
- xserver-xorg-core-lts-xenial
- xserver-xorg-lts-xenial
- xserver-xorg-video-all-lts-xenial
- xserver-xorg-input-all-lts-xenial
- libwayland-egl1-mesa-lts-xenial
state: present
install_recommends: yes
- name: Removing packages commonly not required
apt:
pkg: "{{ base_common_delpkg }}"
state: absent
purge: yes
- name: Removing packages from client machines
apt:
pkg: "{{ base_client_delpkg }}"
state: absent
purge: yes
when: ansible_local.noderole.role == 'client' and base_client_delpkg|length > 0
- name: Removing packages from docenti machines
apt:
pkg: "{{ base_docenti_delpkg }}"
state: absent
purge: yes
when: ansible_local.noderole.role == 'docenti' and base_docenti_delpkg|length > 0
- name: Cleanup of unneeded packages
shell: apt-get -y autoremove
args:
warn: false
register: autoremove
changed_when: "'Rimozione' in autoremove.stdout"
- name: Installing additional common packages
apt:
pkg: "{{ base_common_addpkg }}"
state: present
tags: edu-install
- name: Installing additional packages for client role
apt:
pkg: "{{ base_client_addpkg }}"
state: present
when: ansible_local.noderole.role == 'client' and base_client_addpkg|length > 0
- name: Installing additional packages for docenti role
apt:
pkg: "{{ base_docenti_addpkg }}"
state: present
when: ansible_local.noderole.role == 'docenti' and base_docenti_addpkg|length > 0

View File

@ -1,8 +0,0 @@
---
# Manage system upgrade
- name: Updating available packages
apt: update_cache=yes cache_valid_time=180
- name: Upgrading system
apt: upgrade=full

View File

@ -1,12 +0,0 @@
---
# Adjusting other settings due to unattended installation
- name: Adjusting connections for NetworkManager
lineinfile:
dest: /etc/network/interfaces
regexp: "{{ item }}"
state: absent
when: ansible_product_name != "VirtualBox"
with_items:
- '^auto {{ ansible_default_ipv4.interface }}'
- '^iface {{ ansible_default_ipv4.interface }}'

View File

@ -1,8 +0,0 @@
---
# Manage Virtualbox additions
- name: Adding Virtualbox Guest Additions if required
apt:
pkg: virtualbox-guest-dkms
stat: present
when: ansible_product_name == "VirtualBox"

View File

@ -0,0 +1,8 @@
---
dependencies:
- { role: ubuntu-mirror, tags: [ 'client-install' ] }
- { role: preseed, tags: [ 'client-install' ] }
- { role: ansible-pull, tags: [ 'client-install' ] }
- { role: doraemon, tags: [ 'client-install' ] }
- { role: npm, tags: [ 'client-install' ] }
- { role: git-daemon, tags: [ 'client-install' ] }

View File

@ -1,6 +0,0 @@
---
- name: reboot
shell: /sbin/shutdown -r now "Reboot by Ansible."
async: 0
poll: 0

View File

@ -1,48 +0,0 @@
---
# Managing epoptes on 'client' role
- name: Getting epoptes server name
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}:3000/epoptes-srv"
dest: /tmp/epoptes-srv
register: get_epo_srv_name
- name: Checking for a correct name
shell: cat /tmp/epoptes-srv
register: epo_srv_name
when: get_epo_srv_name is changed
changed_when: "'none' not in epo_srv_name.stdout"
- name: Cleanup
file:
path: /tmp/epoptes-srv
state: absent
when: get_epo_srv_name is changed
- name: Ensuring epoptes-client is installed
apt:
name: epoptes-client
state: present
when: get_epo_srv_name is changed
- name: Configuring the client
replace:
dest: /etc/default/epoptes-client
regexp: "^#SERVER=server"
replace: "SERVER={{ epo_srv_name.stdout }}"
when: epo_srv_name is changed
- name: Checking for an already existent certificate
file:
path: /etc/epoptes/server.crt
state: file
register: crt_epo_exists
ignore_errors: yes
- name: Getting the epoptes server certificate
shell: /usr/sbin/epoptes-client -c
when: crt_epo_exists is failed
# I don't notify anymore, hoping that this would be done on first run after
# preseed and it should restart because of domain join.
#notify:
# - reboot

View File

@ -1,8 +0,0 @@
---
# Managing actions for role 'client'
- include: epoptes.yml
when: ansible_local.noderole.role == 'client'
tags:
- role
- client

View File

@ -1,5 +0,0 @@
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
//APT::Periodic::RandomSleep "0";

View File

@ -1,34 +0,0 @@
// Automatically upgrade packages from these (origin, archive) pairs
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
"${distro_id}:${distro_codename}-security";
"${distro_id}:${distro_codename}-updates";
"${distro_id}:${distro_codename}-proposed";
"${distro_id}:${distro_codename}-backports";
"LP-PPA-app-review-board:trusty";
"LP-PPA-libreoffice-libreoffice-5-0:trusty";
"LP-PPA-ansible-ansible:trusty";
"BgLUG:trusty";
};
// List of packages to not update
Unattended-Upgrade::Package-Blacklist {
// "vim";
// "libc6";
// "libc6-dev";
// "libc6-i686";
};
// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. The package 'mailx'
// must be installed or anything that provides /usr/bin/mail.
//Unattended-Upgrade::Mail "root@localhost";
// Do automatic removal of new unused dependencies after the upgrade
// (equivalent to apt-get autoremove)
Unattended-Upgrade::Remove-Unused-Dependencies "true";
// Automatically reboot *WITHOUT CONFIRMATION* if a
// the file /var/run/reboot-required is found after the upgrade
Unattended-Upgrade::Automatic-Reboot "false";

View File

@ -1,13 +0,0 @@
---
- name: Installing plymouth theme
apt:
name: plymouth-theme-edubuntu-bglug
state: latest
force: yes
- name: Installing lightdm wallpaper
apt:
name: bglug-artwork
state: latest
force: yes

View File

@ -1,12 +0,0 @@
---
# BgLUG customization
- include: unattended-upgrades.yml
tags:
- custom
- unattended-upgrades
- include: custom.yml
tags:
- custom
- bglug

View File

@ -1,18 +0,0 @@
---
- name: Ensure needed packages are installed
apt:
name:
- unattended-upgrades
- update-notifier-common
state: present
- name: Configuring unattended upgrades from file
copy:
src: 50-unattended-upgrades
dest: /etc/apt/apt.conf.d/50-unattended-upgrades
- name: Activating automatic updates
copy:
src: 20-auto-upgrades
dest: /etc/apt/apt.conf.d/20-auto-upgrades

View File

@ -0,0 +1,29 @@
---
- name: Preparazione pacchetti per compilazione RPM
yum: pkg="{{ item }}" state=present
with_items:
- '@Development tools'
- rpmdevtools
- yum-utils
- rpmlint
become: yes
- name: Aggiungo utente per compilazione pacchetti RPM
user:
name: makepkg
password: $6$rounds=100000$neTGJ5N7Nu5ogCTX$VmVgS9HRZcdczjiNNdQcZzFVQI/3AFwu6MNFOKxGhBRY4VcBOo6GTxhXr0K/jYVFTygjHWsr.teM6RmBzSnz.0
shell: /bin/bash
state: present
become: yes
- name: Copia della chiave pubblica
authorized_key:
user: makepkg
key: "{{ lookup('file', '/Users/syntaxerrormmm/.ssh/id_rsa.pub') }}"
state: present
become: yes
- name: Creazione directory per il build di RPM
shell: rpmdev-setuptree
become: yes
become_user: makepkg

View File

@ -0,0 +1,3 @@
---
- include: developuser.yml
tags: developuser

View File

@ -1,11 +0,0 @@
# vim:sts=2:sw=2
author "BgLUG - Bergamo Linux Users Group <info@bglug.it>"
description "Sanely starts epoptes server daemon on ubuntu."
start on net-device-up and started winbind
stop on stopped winbind
exec /usr/bin/twistd -n \
--logfile "/var/log/epoptes.log" --pidfile "/var/run/epoptes.pid" \
epoptes
respawn

View File

@ -1,52 +0,0 @@
---
# Managing Epoptes installation on 'docenti' role.
- name: Ensuring epoptes package has been installed
apt:
name: epoptes
state: present
- name: Configuring the Epoptes server
lineinfile:
dest: /etc/default/epoptes
line: 'SOCKET_GROUP="{{ ansible_local.domain.domainshort }}\docenti"'
state: present
- name: Stopping epoptes SysV daemon
shell: /etc/init.d/epoptes stop
ignore_errors: yes
- name: Disabling sysv start
shell: /usr/sbin/update-rc.d -f epoptes remove
- name: Installing upstart service
copy:
src: epoptes.conf
dest: /etc/init/epoptes.conf
owner: root
group: root
mode: 0644
- name: Verify epoptes status
shell: /sbin/status epoptes
register: epoptes_status
- name: Starting epoptes from upstart
shell: /sbin/start epoptes
when: epoptes_status.stdout.find("start/running") == -1
# Disabling ufw as per issue #12
- name: Disabling ufw by override
lineinfile:
path: /etc/init/ufw.override
line: "manual"
state: present
create: yes
owner: root
group: root
mode: 0644
- name: Stopping ufw
service:
name: ufw
state: stopped

View File

@ -1,8 +0,0 @@
---
# Managing actions for role 'docenti'
- include: epoptes.yml
when: ansible_local.noderole.role == 'docenti'
tags:
- role
- docenti

View File

@ -1,2 +0,0 @@
[com.canonical.indicator.session]
user-show-menu=false

View File

@ -1,25 +0,0 @@
#!/bin/bash
apt-get -y --force-yes install \
libldb1=1:1.1.16-1 \
libsmbclient=2:4.1.6+dfsg-1ubuntu2 \
python-ldb=1:1.1.16-1 \
python-samba=2:4.1.6+dfsg-1ubuntu2 \
samba=2:4.1.6+dfsg-1ubuntu2 \
samba-common=2:4.1.6+dfsg-1ubuntu2 \
samba-common-bin=2:4.1.6+dfsg-1ubuntu2 \
samba-dsdb-modules=2:4.1.6+dfsg-1ubuntu2 \
samba-libs=2:4.1.6+dfsg-1ubuntu2 \
samba-vfs-modules=2:4.1.6+dfsg-1ubuntu2 \
smbclient=2:4.1.6+dfsg-1ubuntu2 \
libnss-winbind=2:4.1.6+dfsg-1ubuntu2 \
libpam-winbind=2:4.1.6+dfsg-1ubuntu2 \
libwbclient0=2:4.1.6+dfsg-1ubuntu2 \
winbind=2:4.1.6+dfsg-1ubuntu2
pkglist="libldb1 libsmbclient python-ldb python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0"
for pkg in ${pkglist}; do
apt-mark auto ${pkg}
apt-mark hold ${pkg}
done

View File

@ -1,2 +0,0 @@
[org.freedesktop.ibus.general]
use-system-keyboard-layout=true

View File

@ -1,2 +0,0 @@
[org.gnome.nautilus.desktop]
volumes-visible=true

View File

@ -1,2 +0,0 @@
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin;unix-group:domopers

View File

@ -1,6 +0,0 @@
---
- name: reboot
shell: /sbin/shutdown -r now "Reboot by Ansible."
async: 0
poll: 0

View File

@ -1,5 +0,0 @@
---
dependencies:
- { role: base }
- { role: client }
- { role: docenti }

View File

@ -1,45 +0,0 @@
---
# Manages reactivation of pulseaudio as system daemon
- name: "Changing pulseaudio upstart script"
template:
src: pulseaudio.conf
dest: /etc/init/pulseaudio.conf
owner: root
group: root
mode: 0644
- name: "Checking if pulseaudio is started"
shell: /sbin/status pulseaudio
register: pulseaudio_status
- name: Starting pulseaudio service
shell: /usr/sbin/service pulseaudio start
when: pulseaudio_status.stdout.find("start/running") == -1
- name: "Configuring client options"
lineinfile:
line: '{{ item }}'
dest: /etc/pulse/client.conf
state: present
with_items:
- 'default-server = /var/run/pulse/native'
- 'autospawn = no'
- name: Disabling pulseaudio startup on lightdm
shell: chmod -x /usr/bin/start-pulseaudio-x11
args:
warn: false
- name: Removing old (and not-working) approach
file:
path: /etc/cron.d/pulseaudio-perms
state: absent
- name: Get the new script
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh"
dest: /tmp/paperms.sh
- name: Run the script (install other support files and fixes the permissions)
shell: bash /tmp/paperms.sh

View File

@ -1,11 +0,0 @@
---
# Final tasks.
- name: Ensuring APT stack is healthy
shell: dpkg --configure -a && apt-get install -f
# Correctly managing ansible-pull runs.
- name: Updating local version for repo
shell: 'rm -f {{ ansible_local.checksum.repover_file }} && echo "{{ ansible_local.checksum.repover }}" > {{ ansible_local.checksum.repover_file }}'
args:
warn: false

View File

@ -1,12 +0,0 @@
---
- name: Removing upgrade-notification from /etc
lineinfile:
dest: /etc/update-manager/release-upgrades
line: "Prompt=never"
regexp: '^Prompt='
state: present
- name: Removing notifications for system upgrade
shell: >
test -f /usr/share/upstart/sessions/update-notifier-release.conf && mv /usr/share/upstart/sessions/update-notifier-release.conf /usr/share/upstart/sessions/update-notifier-release.conf.disabled
ignore_errors: yes

View File

@ -1,15 +0,0 @@
---
# Domain join tasks
- name: Checking domain join
shell: wbinfo -t
register: check_domain
changed_when: check_domain.rc != 0
ignore_errors: yes
- name: Joining domain
shell: 'net rpc join -U admin%{{ domainadminpasswd }}'
when: check_domain is changed
register: domainjoin
notify:
- reboot

View File

@ -1,27 +0,0 @@
---
# Glib2 settings for a better user experience
- name: Disabling user listings in Metacity menu
copy:
src: com.canonical.indicator.session.gschema.override
dest: /usr/share/glib-2.0/schemas/com.canonical.indicator.session.gschema.override
backup: yes
register: cfg_glib_users
- name: Visualizing mounted drives on desktop
copy:
src: org.gnome.nautilus.desktop.gschema.override
dest: /usr/share/glib-2.0/schemas/org.gnome.nautilus.desktop.gschema.override
backup: yes
register: cfg_glib_mounted
- name: Fixing keyboard layout
copy:
src: org.freedesktop.ibus.general.gschema.override
dest: /usr/share/glib-2.0/schemas/org.freedesktop.ibus.general.schema.override
backup: yes
register: cfg_keyb_layout
- name: Recompiling glib2 schemas
shell: glib-compile-schemas --strict /usr/share/glib-2.0/schemas/
when: cfg_glib_users is changed or cfg_glib_mounted is changed or cfg_keyb_layout is changed

View File

@ -1,14 +0,0 @@
---
# Adjusting Graphical User Interface
- include: lightdm.yml
tags: lightdm
- include: glib2.yml
tags: glib2
- include: policykit-1.yml
tags: policykit
- include: disable-upgrade-notifications.yml
tags: disable-upgrade-notifications

View File

@ -1,12 +0,0 @@
---
# Adjusting lightdm settings
- name: Adjusting lightdm settings
lineinfile:
dest: /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
regexp: "{{ item }}"
line: "{{ item }}"
with_items:
- "allow-guest=false"
- "greeter-hide-users=true"
- "greeter-show-manual-login=true"

View File

@ -1,63 +0,0 @@
---
# Domain configurations
- include: networkmanager.yml
tags:
- domain
- networkmanager
- include: ntp.yml
tags:
- domain
- ntp
- include: nss.yml
tags:
- domain
- nss
- include: audio.yml
tags:
- domain
- audio
- include: gui-changes.yml
tags:
- domain
- gui
- include: sslproxy.yml
tags:
- domain
- crt
- include: pkgs.yml
tags:
- domain
- pkgs
- include: pam_base.yml
tags:
- domain
- pam
- include: pam_mount.yml
tags:
- domain
- pam
- pam_mount
- include: smb_config.yml
tags:
- domain
- smb
- include: domain_join.yml
tags:
- domain
- join
- include: cleanup.yml
tags:
- domain
- cleanup

View File

@ -1,21 +0,0 @@
---
# Since students are disabling deliberately the network interface from
# NetworkManager, we insert the default interface in /etc/network/interfaces
# so they are not available to NM
- name: Ensuring first NIC will never be disabled again
lineinfile:
line: "{{ item }}"
state: present
dest: /etc/network/interfaces
insertafter: EOF
with_items:
- " "
- "auto {{ ansible_default_ipv4.interface }}"
- "iface {{ ansible_default_ipv4.interface }} inet dhcp"
# Hiding NetworkManager icon from any sessions
- name: Disabling NetworkManager from popping up in sessions
shell: mv /etc/xdg/autostart/nm-applet.desktop /etc/xdg/autostart/nm-applet.desktop.disabled
ignore_errors: yes

View File

@ -1,11 +0,0 @@
---
# configuring NSS
- name: Configuring NSS
template:
src: nsswitch.conf
dest: /etc/nsswitch.conf
backup: yes
owner: root
group: root
mode: 0644

View File

@ -1,29 +0,0 @@
---
# Configuring NTP for domain clients
- name: Installing NTP
apt:
name: ntp
state: present
- name: Configuring NTP
template:
src: ntp.conf
dest: /etc/ntp.conf
backup: yes
owner: root
group: root
mode: 0644
register: cfg_ntp
- name: Configuring AppArmor for NTP
lineinfile:
dest: /etc/apparmor.d/usr.sbin.ntpd
regexp: "/run/samba/winbindd/pipe"
line: ' /run/samba/winbindd/pipe crw,'
insertafter: 'samba/ntp_signd/socket'
state: present
- name: Restarting NTP service
shell: service ntp restart
when: cfg_ntp is changed

View File

@ -1,52 +0,0 @@
---
# base configuration for PAM Module
- name: Installing winbind bindings for PAM
apt:
name: libpam-winbind
state: present
# Leaving them here commented, as they may be needed in the future
# for improvements on login times.
# common-auth
#- name: 'common-auth: modifica pam_unix'
# replace:
# dest: /etc/pam.d/common-auth
# regexp: '^.*pam_unix\.so.*nullok_secure$'
# replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass'
#
#- name: 'common-auth: rimuovo config auto pam_winbind'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: 'pam_winbind\.so krb5'
# state: absent
#
#- name: 'common-auth: aggiunta pam_winbind'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: '^auth.*pam_winbind\.so$'
# insertbefore: '^auth.*pam_unix\.so'
# line: 'auth [success=2 default=ignore] pam_winbind.so'
# state: present
## common-password
#
#- name: 'common-password: configurazione pam_unix'
# replace:
# dest: /etc/pam.d/common-password
# regexp: '^(password.*pam_unix\.so.*sha512)$'
# replace: '\1 min=4 max=20'
# backup: yes
#
## common-session
#
#- name: 'common-session: configurazione pam_mkhomedir'
# lineinfile:
# dest: /etc/pam.d/common-session
# regexp: '^session.*pam_mkhomedir\.so.*$'
# insertafter: '^session\s*required.*pam_permit.so'
# line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
# state: present
# backup: yes

View File

@ -1,13 +0,0 @@
---
# PAM_mount configuration
- name: Installing pam_mount
apt:
name: libpam-mount
state: present
- name: Configuring pam_mount
template:
src: pam_mount.conf.xml
dest: /etc/security/pam_mount.conf.xml
backup: yes

View File

@ -1,35 +0,0 @@
---
# Packages needed for domain join
# Badlock wrong resolution: downgrading SAMBA
- name: Copying scripts for fixing SAMBA
copy:
src: "{{ item }}"
dest: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/{{ item }}"
owner: root
mode: 0755
with_items:
- downgrade_samba.sh
- name: Verifying SAMBA version on client
shell: dpkg -l | grep libsmbclient
register: check_samba_version
ignore_errors: yes
changed_when: "'2:4.1.6+dfsg-1ubuntu2' not in check_samba_version.stdout"
#- name: Downgrading SAMBA if not the right version
# shell: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/downgrade_samba.sh"
# when: check_samba_version is changed
#
#- name: Checking again for the correct SAMBA version
# shell: dpkg -l | grep libsmbclient
# register: recheck_samba_version
# changed_when: "'2:4.1.6+dfsg-1ubuntu2' in check_samba_version.stdout"
- name: Installing domain packages
apt:
pkg:
- winbind
- samba
state: present

View File

@ -1,10 +0,0 @@
---
- name: Configuring sudo to accept users other than local admin
copy:
src: polkit-1.txt
dest: /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf
owner: root
group: root
mode: 0644
backup: yes

View File

@ -1,40 +0,0 @@
---
# SAMBA configuration for domain
- name: Configuring SAMBA
template:
src: smb.conf
dest: /etc/samba/smb.conf
validate: 'testparm -s %s'
backup: yes
register: cfg_samba
- name: Configuring AppArmor home directories
replace:
dest: /etc/apparmor.d/tunables/home
regexp: '^@\{HOMEDIRS\}=/home/$'
replace: '@{HOMEDIRS}=/home/ /home/{{ ansible_local.domain.domainshort }}/'
- name: SAMBA restart
shell: /sbin/restart smbd
when: cfg_samba is changed
- name: Winbind restart
shell: /sbin/restart winbind
when: cfg_samba is changed
- name: Creating home base
file:
path: '/home/{{ ansible_local.domain.domainshort }}'
owner: root
group: root
state: directory
- name: Permitting SAMBA domopers to run sudo
template:
src: sudoers.d
dest: /etc/sudoers.d/domain
owner: root
group: root
mode: 0440
validate: "/usr/sbin/visudo -cf %s"

View File

@ -1,26 +0,0 @@
---
# Adjusting system for domain proxy certificate
- name: Creating needed directories
file:
path: '{{ item }}'
mode: 0755
state: directory
with_items:
- '/usr/lib/firefox/browser/defaults/profile'
- '/usr/local/share/ca-certificates/{{ ansible_local.domain.domainfull }}'
- name: Getting SSL transparent proxy certificate
get_url:
url: 'http://{{ ansible_local.domain.serverfqdn }}/proxy.crt'
dest: '/usr/local/share/ca-certificates/{{ ansible_local.domain.domainfull }}/ca.crt'
register: proxycrt_dwnl
- name: Adding certificates to the ones used by the system
shell: update-ca-certificates
when: proxycrt_dwnl is changed
- name: Firefox settings to include certificate
get_url:
url: 'http://{{ ansible_local.domain.serverfqdn }}/ks/server-ca/cert8.db'
dest: /usr/lib/firefox/browser/defaults/profile/cert8.db

View File

@ -1,11 +0,0 @@
# {{ ansible_managed }}
passwd: compat winbind
group: compat winbind
shadow: compat winbind
hosts: files myhostname dns wins
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis

View File

@ -1,58 +0,0 @@
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
driftfile /var/lib/ntp/ntp.drift
# Enable this if you want statistics to be logged.
#statsdir /var/log/ntpstats/
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
# Specify one or more NTP servers.
# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
# more information.
#server 0.ubuntu.pool.ntp.org
#server 1.ubuntu.pool.ntp.org
#server 2.ubuntu.pool.ntp.org
#server 3.ubuntu.pool.ntp.org
# Use Ubuntu's ntp server as a fallback.
#server ntp.ubuntu.com
# {{ ansible_managed }}
server {{ ansible_local.domain.ntpserver }} prefer
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
# might also be helpful.
#
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.
# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1
restrict ::1
# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust
# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)
#broadcast 192.168.123.255
# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines. Please do this only if you trust everybody on the network!
#disable auth
#broadcastclient

View File

@ -1,47 +0,0 @@
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
See pam_mount.conf(5) for a description.
-->
<pam_mount>
<!--
debug should come before everything else, since this file is still
processed in a single pass from top-to-bottom
-->
<debug enable="0" />
<!-- Volume definitions -->
<volume user="*" sgrp="domain users" fstype="cifs"
server="{{ ansible_local.domain.server }}" path="%(USER)" mountpoint="~"
options="setuids,acl,user_xattr,iocharset=utf8,file_mode=0644,dir_mode=0755,cache=none" />
<volume user="*" sgrp="domain users" fstype="cifs"
server="{{ ansible_local.domain.server }}" path="shared" mountpoint="~/Condiviso"
options="setuids,acl,user_xattr,iocharset=utf8,file_mode=0664,dir_mode=0775,cache=strict" />
<!-- pam_mount parameters: General tunables -->
<!--
<luserconf name=".pam_mount.conf.xml" />
-->
<!--
Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing.
-->
<!--
<mntoptions allow="loop,encryption,fsck,nonempty,allow_root,allow_other" />
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
<mntoptions require="nosuid,nodev,exec" />
-->
<logout wait="10" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="false" />
</pam_mount>
<!--
{{ ansible_managed }}
-->

View File

@ -1,48 +0,0 @@
# System PulseAudio service
description "System PulseAudio sound server"
author "Pali Rohár <pali.rohar@gmail.com>"
# uncomment the 'start on' to start pulseaudio in system mode
# (enables the pulseaudio init script - requires that users be in the
# pulse-access group)
# System mode is not the recommended way to run PulseAudio as it has some
# limitations (such as no shared memory access) and could potentially allow
# users to disconnect or redirect each others' audio streams. The
# recommended way to run PulseAudio is as a per-session daemon. For GNOME/KDE/
# Xfce sessions in Ubuntu Lucid/10.04, /etc/xdg/autostart/pulseaudio.desktop
# handles this function of automatically starting PulseAudio on login, and for
# it to work correctly your user must *not* have "autospawn = no" set in
# ~/.pulse/client.conf (or in /etc/pulse/client.conf). By default, autospawn
# is enabled. For other sessions, you can simply start PulseAudio with
# "pulseaudio --daemonize".
start on (started winbind)
stop on runlevel [016]
expect daemon
respawn
# Prevent users from dynamically loading modules into the PulseAudio sound
# server. Dynamic module loading enhances the flexibility of the PulseAudio
# system, but may pose a security risk.
# 0 = no, 1 = yes
env DISALLOW_MODULE_LOADING=1
# extra arguments to pass to the daemon
env PULSEAUDIO_ARGS=
pre-start exec install -d -m755 -o pulse -g pulse /run/pulse
exec /usr/bin/pulseaudio --system --daemonize --high-priority --log-target=syslog --disallow-exit --disallow-module-loading=$DISALLOW_MODULE_LOADING $PULSEAUDIO_ARGS
post-start script
if [ -e /var/run/pulse/.esd_auth ]; then
chown pulse:pulse-access /var/run/pulse/.esd_auth
chmod 640 /var/run/pulse/.esd_auth
fi
if [ -e /var/run/pulse/.pulse-cookie ]; then
chown pulse:pulse-access /var/run/pulse/.pulse-cookie
chmod 640 /var/run/pulse/.pulse-cookie
fi
end script

View File

@ -1,16 +0,0 @@
# {{ ansible_managed }}
[global]
security = domain
netbios name = {{ ansible_hostname }}
password server = {{ ansible_local.domain.serverfqdn }}
workgroup = {{ ansible_local.domain.domainshort }}
idmap uid = 10000000-19999999
idmap gid = 10000000-19999999
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind expand groups = 1
template shell = /bin/bash
template homedir = /home/%D/%U
domain master = no
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u

View File

@ -1,6 +0,0 @@
# {{ ansible_managed }}
# Autorizzazione per gli utenti di dominio
%domain\ admins ALL=(ALL:ALL) NOPASSWD:ALL
%{{ ansible_local.domain.domainshort }}\\domain\ admins ALL=(ALL:ALL) NOPASSWD:ALL
%domopers ALL=(ALL:ALL) ALL
%{{ ansible_local.domain.domainshort }}\\domopers ALL=(ALL:ALL) ALL

View File

@ -0,0 +1,3 @@
---
doraemon_pkg: doraemon
doraemon_version: 1.2.0-1

View File

@ -0,0 +1,15 @@
---
# Installa e configura il servizio per rinominare il client
# Grazie per il servizio a Enrico Bacis
# Considerando di aver creato il repo, viene comunque installata l'ultima versione disponibile
- name: Installazione doraemon
yum:
pkg: "{{ doraemon_pkg }}"
state: latest
become: yes
- name: Verifico avvio di doraemon
service: name=doraemon state=restarted
become: yes

View File

@ -0,0 +1,3 @@
---
- include: doraemon.yml
tags: doraemon

View File

@ -0,0 +1,3 @@
---
client_gitrepo: "https://github.com/bglug-it/client-pull-installation.git"
client_gitbranch: master

View File

@ -0,0 +1 @@
@daily git-daemon pushd /var/lib/git-daemon/repositories/client-pull-installation.git; git fetch -p origin; popd

View File

@ -0,0 +1,64 @@
#!/bin/sh
#
# Startup/shutdown script for Git Daemon
# chkconfig: 345 56 10
#
# description: Startup/shutdown script for Git Daemon
#
# Taken from: https://gist.github.com/esoupy/3823712
. /etc/init.d/functions
DAEMON=/usr/libexec/git-core/git-daemon
USER=git-daemon
GROUP=git
BASE_PATH=/var/lib/git-daemon/repositories
ARGS="--user=$USER --group=$GROUP --detach --base-path=$BASE_PATH"
prog=git-daemon
start () {
echo -n $"Starting $prog: "
# start daemon
daemon $DAEMON $ARGS
RETVAL=$?
echo
[ $RETVAL = 0 ] && touch /var/lock/git-daemon
return $RETVAL
}
stop () {
# stop daemon
echo -n $"Stopping $prog: "
killproc $DAEMON
RETVAL=$?
echo
[ $RETVAL = 0 ] && rm -f /var/lock/git-daemon
}
restart() {
stop
start
}
case $1 in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
status)
status $DAEMON
RETVAL=$?
;;
*)
echo $"Usage: $prog {start|stop|restart|status}"
exit 3
;;
esac
exit $RETVAL

View File

@ -0,0 +1,140 @@
---
# Configura e lancia il servizio git-daemon per servire i repository locali
- name: Installo git-daemon
yum: pkg=git-daemon state=present
become: yes
- name: Creazione gruppo git
group:
name: git
system: yes
state: present
become: yes
- name: Creazione utente git-daemon
user:
name: git-daemon
system: yes
group: git
home: /var/lib/git-daemon
state: present
become: yes
- name: Creo directory repositories
file:
path: /var/lib/git-daemon/repositories
state: directory
become: yes
become_user: git-daemon
- name: Verifica presenza repo
shell: test -d /var/lib/git-daemon/repositories/client-pull-installation.git
register: chk_clientpullinstall_repo
changed_when: chk_clientpullinstall_repo.rc != 0
ignore_errors: yes
become: yes
tags:
- git-daemon-update
- name: Aggiorno il repo se già esistente
shell: pushd /var/lib/git-daemon/repositories/client-pull-installation.git; git fetch -p origin; popd
become: yes
become_user: git-daemon
when: chk_clientpullinstall_repo|success
tags:
- git-daemon-update
# E' in forma di shell perché non c'è modo di passare ad ansible
# il parametro --mirror
- name: Clono il repository client-pull-installation
shell: git clone --mirror {{ client_gitrepo }} /var/lib/git-daemon/repositories/client-pull-installation.git
become: yes
become_user: git-daemon
when: chk_clientpullinstall_repo|changed
- name: Rendo il repository esportabile
file:
path: /var/lib/git-daemon/repositories/client-pull-installation.git/git-daemon-export-ok
state: touch
become: yes
become_user: git-daemon
tags:
- git-daemon-update
- name: Installo task di cron per aggiornamento repo
copy:
src: git-daemon-crontab
dest: /etc/cron.d/git-daemon
mode: 0644
owner: root
group: root
become: yes
- name: Installo l'init
copy:
src: git-daemon-init
dest: /etc/init.d/git-daemon
mode: 0755
owner: root
group: root
become: yes
- name: Configuro l'avvio di git-daemon
shell: /sbin/chkconfig --add git-daemon
become: yes
- name: Verifica aggiunta servizio
shell: /sbin/e-smith/db configuration show git-daemon
become: yes
register: chk_gitdaemon_srv
changed_when: chk_gitdaemon_srv.rc != 0
ignore_errors: yes
- name: Aggiungo servizio a gestione NethServer
shell: /sbin/e-smith/db configuration set git-daemon service status enabled TCPPort 9418 access private
become: yes
when: chk_gitdaemon_srv|changed
- name: Creazione directory defaults per NethServer
file:
path: /etc/e-smith/db/configuration/defaults/git-daemon
recurse: yes
state: directory
become: yes
when: chk_gitdaemon_srv|changed
- name: Creazione tipo default per NethServer
lineinfile:
dest: /etc/e-smith/db/configuration/defaults/git-daemon/type
regexp: "^service"
line: "service"
create: yes
state: present
become: yes
when: chk_gitdaemon_srv|changed
- name: Creazione stato default per NethServer
lineinfile:
dest: /etc/e-smith/db/configuration/defaults/git-daemon/status
regexp: "^enabled"
line: "enabled"
create: yes
state: present
become: yes
when: chk_gitdaemon_srv|changed
- name: Aggiunta servizio
shell: /sbin/e-smith/signal-event runlevel-adjust
become: yes
when: chk_gitdaemon_srv|changed
- name: Aggiunta servizio di rete e cambio firewall
shell: /sbin/e-smith/signal-event firewall-adjust
become: yes
when: chk_gitdaemon_srv|changed
- name: Avvio servizio
shell: service git-daemon start
become: yes
when: chk_gitdaemon_srv|changed

View File

@ -0,0 +1,9 @@
---
- name: Overriding default gitrepo if defined in domain.yml
set_fact: client_gitrepo="{{ ansible_local.domain.client_gitrepo }}"
when: "ansible_local.domain.client_gitrepo is defined"
- name: Overriding default gitbranch if defined in domain.yml
set_fact: client_gitbranch="{{ ansible_local.domain.client_gitbranch }}"
when: "ansible_local.domain.client_gitbranch is defined"

View File

@ -0,0 +1,7 @@
---
- include: initvars.yml
tags: git-daemon
- include: git-daemon.yml
tags: git-daemon

View File

@ -0,0 +1,4 @@
---
ansible_ssh_user: root
admin_sshkey: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"

View File

@ -0,0 +1,22 @@
---
# Copia le configurazioni per il dominio in locale sul server.
- name: Copia le configurazioni di dominio.
copy: src=../../../domain.yml dest=/etc/domain.yml force=yes
become: yes
- name: Creo la cartella per le configurazioni di Ansible
file: path=/etc/ansible/facts.d state=directory owner=root mode=0755
become: yes
- name: Installo PyYAML, necessario per i facts
yum:
name: PyYAML
state: present
become: yes
- name: Utilizzo un piccolo wrapper per passare come fatti informazioni di dominio
copy: src=domain.fact dest=/etc/ansible/facts.d/domain.fact mode=0755 owner=root
become: yes
- name: Rileggo i fatti per essere sicuri che vengano utilizzati
setup: filter=ansible_local

View File

@ -1,42 +0,0 @@
---
# Initialization task (for simpler ansible management)
- name: Setting up sudoers for root
lineinfile:
dest: /etc/sudoers.d/root
regexp: "^root.*NOPASSWD"
line: "root ALL=(ALL:ALL) NOPASSWD:ALL"
owner: root
group: root
mode: 0440
create: yes
state: present
validate: '/usr/sbin/visudo -c -f %s'
- name: Creating Ansible Management User
user:
name: amgmt
comment: "Ansible Management User"
group: users
password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
shell: /bin/bash
state: present
generate_ssh_key: yes
- name: Setting up sudoers for Ansible Management User
lineinfile:
dest: /etc/sudoers.d/amgmt
regexp: "^amgmt.*NOPASSWD"
line: "amgmt ALL=(ALL:ALL) NOPASSWD:ALL"
owner: root
group: root
mode: 0440
create: yes
state: present
validate: '/usr/sbin/visudo -c -f %s'
- name: Authorizing Ansible Management User's key from server
authorized_key:
user: amgmt
key: "{{ lookup('pipe', 'curl -sSL http://' + ansible_local.domain.serverfqdn + ':3000/mgmtkey') }}"
state: present

View File

@ -1,5 +1,11 @@
--- ---
# Task basilari per la prima configurazione
- include: selinux-binding.yml
when: ansible_os_family == "RedHat"
- include: init.yml - include: yum-utils.yml
tags:
- init - include: mgmtuser.yml
- include: domaininfo.yml
tags: domaininfo

View File

@ -0,0 +1,23 @@
---
- name: Creazione account di gestione Ansible
user:
name: amgmt
comment: "Ansible Management User"
group: wheel
state: present
password: $6$mVKMBMbAxeql$eqSe8tu2qKjtwmpiFy07b6nv2g4F80N.U9EzOmQTrNZwKZ61n6NLrSEQHQo1FOlQghOiB8as6Z35oTUUKN8y2.
- name: Concessione diritti all'utente di gestione Ansible
template:
src: sudoers.d
dest: /etc/sudoers.d/amgmt
owner: root
group: root
mode: 0440
validate: "/usr/sbin/visudo -cf %s"
- name: Installazione chiave privata PC locale
authorized_key:
user: amgmt
key: "{{ lookup('file', admin_sshkey) }}"
state: present

View File

@ -0,0 +1,4 @@
---
# Preconfigurazione selinux per host
- name: Binding Python per selinux
yum: name=libselinux-python state=present

View File

@ -0,0 +1,5 @@
---
- name: Installing yum-utils to enable repositories
yum:
name: yum-utils
state: present

View File

@ -0,0 +1,3 @@
# {{ ansible_managed }}
# Autorizzazione di gestione per l'utente di ansible
amgmt ALL=(ALL:ALL) NOPASSWD:ALL

View File

@ -0,0 +1,6 @@
---
extnic: wan0
intnic: lan0
force_regen_ca: false
force_ibay_shared: false
development: false

View File

@ -0,0 +1,86 @@
---
# Base configurations to be implemented anyways.
# installing italian interface translation
- name: Making available also Italian NethGUI
yum:
pkg: nethserver-lang-it
state: present
tags: nethgui
# Trusted networks: LAN
- name: Check for LAN to be added as Trusted Network
shell: /sbin/e-smith/db networks printprop {{ ansible_local.domain.servernet }} Description
register: check_trusted
changed_when: '"Description=Local LAN" not in check_trusted.stdout'
ignore_errors: yes
tags: trustednet
- name: Configuring trusted networks
shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }}
when: check_trusted|changed
tags: trustednet
- name: Activating trusted network
shell: /sbin/e-smith/signal-event trusted-networks-modify
when: check_trusted|changed
tags: trustednet
# Preconfiguring DNS anyways
- name: Checking DNS configuration
shell: /sbin/e-smith/db configuration printprop dns NameServers
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout"
ignore_errors: yes
- name: Configuring DNS resolution
shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}
when: chk_dns|changed
tags: dns-preset
- name: Activating correct DNS resolution
shell: "/sbin/e-smith/signal-event nethserver-base-update"
when: chk_dns|changed
# Hostname and domainname
- name: Configuring hostname
shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }}
register: chg_hostname
when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'"
tags: hostname
- name: Configuring domain name
shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }}
register: chg_domainname
when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'"
tags: domainname
- name: Activating hostname/domainname changes
shell: /sbin/e-smith/signal-event hostname-modify
when: chg_hostname|changed or chg_domainname|changed
tags:
- hostname
- domainname
# Base certificate
- name: Checking CA configuration
shell: /sbin/e-smith/db configuration printprop pki CommonName
ignore_errors: true
register: chk_crt
changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout"
tags: regen-ca
- name: Configuring CA
shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}"
tags: regen-ca
when: chk_crt|changed or force_regen_ca|bool
- name: Activating CA and regenerate
shell: /sbin/e-smith/signal-event certificate-update
when: chk_crt|changed or force_regen_ca|bool
tags: regen-ca

View File

@ -0,0 +1,52 @@
---
# Installing and configuring DHCP and DNS
- name: Installing DHCP and DNS related NethServer packages.
yum:
name: nethserver-dnsmasq
state: present
# DHCP
- name: Checking DHCP configuration
shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart
ignore_errors: true
register: chk_dhcp
- name: Configuring DHCP
shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled
when: chk_dhcp|failed
- name: Activating DHCP
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_dhcp|failed
# DNS
# Already preconfigured before (roles/nethcfg/tasks/base.yml)
# reforcing the resolver addresses to the ones configured
- name: Checking DNS configuration
shell: /sbin/e-smith/db configuration printprop dns NameServers
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout"
tags: force-resolvers
- name: Configuring DNS resolution
shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}
when: chk_dns|changed
tags: force-resolvers
- name: Activating correct DNS resolution
shell: "/sbin/e-smith/signal-event nethserver-{{ item }}-update"
with_items:
- base
- dnsmasq
when: chk_dns|changed
tags: force-resolvers
# Avahi
- name: Installing avahi-daemon
yum:
name: nethserver-avahi
state: present

View File

@ -0,0 +1,42 @@
---
# Organization
- name: Installing required packages
yum:
pkg: nethserver-directory
state: present
- name: Check organization configuration
shell: /sbin/e-smith/db configuration printprop OrganizationContact City
register: check_org
changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout"
ignore_errors: yes
# Password policy
- name: Check for password policy
shell: /sbin/e-smith/db configuration printprop passwordstrength Users
register: chk_passstr
changed_when: "'Users=none' not in chk_passstr.stdout"
ignore_errors: true
tags: password-policy
- name: Configuring password policy
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
when: chk_passstr|changed
tags: password-policy
- name: Activating password policy
shell: /sbin/e-smith/signal-event password-policy-update
when: chk_passstr|changed
tags: password-policy
# Organization configuration
- name: Configuring organization
shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}"
when: check_org|changed
- name: Activating organization configuration
shell: /sbin/e-smith/signal-event organization-save
when: check_org|changed

View File

@ -0,0 +1,47 @@
---
# Domain groups
# Domain Users
- name: domusers - Checking for group
shell: /sbin/e-smith/db accounts show domusers
register: check_domusers
ignore_errors: true
- name: domusers - Creating new group
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
when: check_domusers|failed
- name: domusers - Activating group
shell: /sbin/e-smith/signal-event group-create domusers
when: check_domusers|failed
# Domain Operators
- name: domopers - Checking for group
shell: /sbin/e-smith/db accounts show domopers
register: check_domopers
ignore_errors: true
- name: domopers - Creating new group
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
when: check_domopers|failed
- name: domopers - Activating group
shell: /sbin/e-smith/signal-event group-create domopers
when: check_domopers|failed
# Docenti
- name: docenti - Checking for group
shell: /sbin/e-smith/db accounts show docenti
register: check_docenti
ignore_errors: true
- name: docenti - Creating new group
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
when: check_docenti|failed
- name: docenti - Activating group
shell: /sbin/e-smith/signal-event group-create docenti
when: check_docenti|failed

View File

@ -0,0 +1,57 @@
---
# Configuring NethServer as requested
# Network interfaces
- include: network.yml
become: yes
tags:
- network
# Configuring base parameters
- include: base.yml
become: yes
tags:
- base
- include: ntp.yml
become: yes
tags:
- ntp
# Directory and organization
- include: directory.yml
become: yes
tags:
- directory
# DHCP and DNS
- include: dhcpdns.yml
become: yes
tags:
- dhcpdns
# Other small services
- include: otherservices.yml
become: yes
tags:
- otherservices
# Proxy and web filter
- include: proxy.yml
become: yes
tags:
- proxy
- webfilter
# SAMBA and ibays
- include: samba.yml
become: yes
tags:
- samba
- ibay
# Domain groups
- include: domain_groups.yml
become: yes
tags:
- domaingroups

View File

@ -0,0 +1,11 @@
---
# Reconfiguring network interfaces
- name: Configuring external NIC
shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp
- name: Configuring internal NIC
shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }}
- name: Activating changes to NICs
shell: /sbin/e-smith/signal-event interface-update

View File

@ -0,0 +1,24 @@
---
# Network time protocol
- name: Installing NTP related packages.
yum:
name: nethserver-ntp
state: present
- name: Checking for NTP Configuration
shell: /sbin/e-smith/db configuration printprop ntpd NTPServer
become: yes
register: chk_ntp
changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout"
ignore_errors: true
- name: Configuring NTP
shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled
become: yes
when: chk_ntp|changed
- name: Activating NTP
shell: /sbin/e-smith/signal-event nethserver-ntp-update
become: yes
when: chk_ntp|changed

View File

@ -0,0 +1,15 @@
---
# Installation and configuration of small services
- name: Installing other small services
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-cups
- nethserver-collectd
- nethserver-collectd-web
- nethserver-firewall-base
- nethserver-firewall-base-ui
- nethserver-backup-config
- nethserver-backup-data

View File

@ -0,0 +1,79 @@
---
# Proxy and webfiltering configurations
- name: Installing proxy-related packages
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-squid
- nethserver-squidclamav
- nethserver-squidguard
# Squid
- name: Checking squid configuration
shell: /sbin/e-smith/db configuration printprop squid DiskCacheSize
ignore_errors: yes
register: chk_squid
changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout"
- name: Configuring Squid
shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000
when: chk_squid|changed
- name: Activating Squid configuration
shell: /sbin/e-smith/signal-event nethserver-squid-update
when: chk_squid|changed
# Squid-clamav
- name: Checking squidclamav configuration
shell: /sbin/e-smith/db configuration printprop squidclamav status
ignore_errors: true
register: chk_squidclamav
changed_when: "'status=enabled' not in chk_squidclamav.stdout"
- name: Configuring squidclamav
shell: /sbin/e-smith/db configuration setprop squidclamav status enabled
when: chk_squidclamav|changed
- name: Activating squidclamav
shell: /sbin/e-smith/signal-event nethserver-squidclamav-update
when: chk_squidclamav|changed
# SquidGuard
- name: Verifying squidguard configuration
shell: /sbin/e-smith/db configuration printprop squidguard status
register: check_squidguard
ignore_errors: true
changed_when: '"status=enabled" not in check_squidguard.stdout'
- name: Configuring squidguard
shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled
when: check_squidguard|changed
- name: Activating squidguard configuration
shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}"
with_items:
- save
- update
- downloadlists
when: check_squidguard|changed
# Content filtering settings
- name: Verifying content filtering
shell: /sbin/e-smith/db contentfilter printprop default Categories
register: check_cf
changed_when: "'sex' not in check_cf.stdout"
- name: Configuring content filtering
shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez
register: cf_cat
when: check_cf|changed
- name: Activating content filtering as a whole
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
when: check_cf|changed

Some files were not shown because too many files have changed in this diff Show More