Compare commits
No commits in common. "master" and "salerno1.ilariaalpi" have entirely different histories.
master
...
salerno1.i
7
.gitignore
vendored
7
.gitignore
vendored
@ -1,3 +1,4 @@
|
|||||||
update-repo.sh
|
*.swp
|
||||||
Vagrantfile
|
*.box
|
||||||
box-provisioning/**
|
.vagrant/*
|
||||||
|
*.patch
|
||||||
|
62
README.md
62
README.md
@ -1,17 +1,55 @@
|
|||||||
# Ansible-pull configuration playbook for domain clients #
|
# Ansible playbooks for a SAMBA domain controller with NethServer #
|
||||||
|
|
||||||
## Progetto Scuola - [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG logo" /> BgLUG][bglug] - Scenario 1 ##
|
## Progetto Scuola [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG Logo" /> BgLUG][bglug] - Scenary 1 ##
|
||||||
|
|
||||||
Configurations for [Ubuntu][ubuntu] client (or better, [Edubuntu][edubuntu])
|
Starting from a [NethServer][] configured machine (please check out the
|
||||||
inside a [SAMBA][samba] 3.0 domain with [NethServer][nethserver].
|
[wiki][] for the installation process from [CentOS][] and other requirements),
|
||||||
|
these playbooks provision a [SAMBA][] 3.0 domain controller which can be used
|
||||||
|
with a network of Ubuntu clients.
|
||||||
|
|
||||||
The files in this repository has to be read and executed by `ansible-pull`
|
Using the default settings, it will also provide an environment to boot from
|
||||||
(please check it out from [Ansible][ansible]) from the client, right after the
|
network, install and configure the clients, using a local copy of Ubuntu's
|
||||||
first installation via PXE and using custom kickstart files.
|
repositories.
|
||||||
|
|
||||||
[bglug]: http://bglug.it "BgLUG Homepage"
|
### Quick start ###
|
||||||
[ubuntu]: http://www.ubuntu.com
|
|
||||||
[edubuntu]: http://www.edubuntu.com
|
You may use these playbooks as follows:
|
||||||
[nethserver]: http://www.nethserver.org
|
|
||||||
[samba]: http://www.samba.org
|
$ vim hosts
|
||||||
|
$ vim domain.yml
|
||||||
|
$ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub"
|
||||||
|
$ ansible-playbook setup.yml
|
||||||
|
|
||||||
|
Or, more simply:
|
||||||
|
|
||||||
|
$ bash run.sh
|
||||||
|
|
||||||
|
### Use [Vagrant][] for testing purposes ###
|
||||||
|
|
||||||
|
You may use the included `Vagrantfile` to do any tests before deploying the
|
||||||
|
machine. `vagrant` and `ansible` must be installed on the host machine, then
|
||||||
|
you may run the following commands:
|
||||||
|
|
||||||
|
$ cd /path/to/server-config
|
||||||
|
$ vagrant up
|
||||||
|
|
||||||
|
Update 14/06/2015: some basic configurations to the Vagrant box are now
|
||||||
|
provisioned via Ansible, thus making it a dependency.
|
||||||
|
|
||||||
|
Update 25/06/2015: the Vagrant box now uses a *host-only* interface instead of
|
||||||
|
a *bridged* one. If you built a Vagrant box before this date, please destroy
|
||||||
|
it, recreate a new one and reprovision it with the provided playbooks.
|
||||||
|
|
||||||
|
### To Do List ###
|
||||||
|
|
||||||
|
* Implement backup
|
||||||
|
* Detail physical installation procedure for the server machine within the
|
||||||
|
Wiki.
|
||||||
|
|
||||||
|
[bglug]: http://bglug.it/ "BgLUG Homepage"
|
||||||
|
[wiki]: https://github.com/bglug-it/server-config/wiki "server-config wiki"
|
||||||
[ansible]: http://www.ansible.com
|
[ansible]: http://www.ansible.com
|
||||||
|
[nethserver]: http://www.nethserver.org
|
||||||
|
[vagrant]: http://www.vagrantup.com
|
||||||
|
[samba]: https://www.samba.org
|
||||||
|
[centos]: https://www.centos.org
|
||||||
|
133
Vagrantfile
vendored
Normal file
133
Vagrantfile
vendored
Normal file
@ -0,0 +1,133 @@
|
|||||||
|
# -*- mode: ruby -*-
|
||||||
|
# vi: set ft=ruby :
|
||||||
|
|
||||||
|
# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
|
||||||
|
VAGRANTFILE_API_VERSION = "2"
|
||||||
|
|
||||||
|
Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
|
||||||
|
# All Vagrant configuration is done here. The most common configuration
|
||||||
|
# options are documented and commented below. For a complete reference,
|
||||||
|
# please see the online documentation at vagrantup.com.
|
||||||
|
|
||||||
|
# Every Vagrant virtual environment requires a box to build off of.
|
||||||
|
config.vm.box = "syntaxerrormmm/nethserver-6.9"
|
||||||
|
config.vm.box_url = "https://vagrant.libreschool.org/nethserver-6.9"
|
||||||
|
config.vm.define "NethServer" do |nethserver|
|
||||||
|
end
|
||||||
|
config.vm.provider :virtualbox do |vb|
|
||||||
|
vb.name = "NethServer"
|
||||||
|
end
|
||||||
|
|
||||||
|
# Disable automatic box update checking. If you disable this, then
|
||||||
|
# boxes will only be checked for updates when the user runs
|
||||||
|
# `vagrant box outdated`. This is not recommended.
|
||||||
|
# config.vm.box_check_update = false
|
||||||
|
|
||||||
|
# Create a forwarded port mapping which allows access to a specific port
|
||||||
|
# within the machine from a port on the host machine. In the example below,
|
||||||
|
# accessing "localhost:8080" will access port 80 on the guest machine.
|
||||||
|
# config.vm.network "forwarded_port", guest: 80, host: 8080
|
||||||
|
|
||||||
|
# Create a private network, which allows host-only access to the machine
|
||||||
|
# using a specific IP.
|
||||||
|
# config.vm.network "private_network", ip: "192.168.33.10"
|
||||||
|
config.vm.network "private_network", ip: "172.16.254.1", auto_config: false
|
||||||
|
|
||||||
|
# Create a public network, which generally matched to bridged network.
|
||||||
|
# Bridged networks make the machine appear as another physical device on
|
||||||
|
# your network.
|
||||||
|
# config.vm.network "public_network"
|
||||||
|
|
||||||
|
# If true, then any SSH connections made will enable agent forwarding.
|
||||||
|
# Default value: false
|
||||||
|
# config.ssh.forward_agent = true
|
||||||
|
|
||||||
|
# Share an additional folder to the guest VM. The first argument is
|
||||||
|
# the path on the host to the actual folder. The second argument is
|
||||||
|
# the path on the guest to mount the folder. And the optional third
|
||||||
|
# argument is a set of non-required options.
|
||||||
|
# config.vm.synced_folder "../data", "/vagrant_data"
|
||||||
|
|
||||||
|
# Provider-specific configuration so you can fine-tune various
|
||||||
|
# backing providers for Vagrant. These expose provider-specific options.
|
||||||
|
# Example for VirtualBox:
|
||||||
|
#
|
||||||
|
# config.vm.provider "virtualbox" do |vb|
|
||||||
|
# # Don't boot with headless mode
|
||||||
|
# vb.gui = true
|
||||||
|
#
|
||||||
|
# # Use VBoxManage to customize the VM. For example to change memory:
|
||||||
|
# #vb.customize ["modifyvm", :id, "--memory", "1024"]
|
||||||
|
# end
|
||||||
|
#
|
||||||
|
# View the documentation for the provider you're using for more
|
||||||
|
# information on available options.
|
||||||
|
|
||||||
|
# Enable provisioning with CFEngine. CFEngine Community packages are
|
||||||
|
# automatically installed. For example, configure the host as a
|
||||||
|
# policy server and optionally a policy file to run:
|
||||||
|
#
|
||||||
|
# config.vm.provision "cfengine" do |cf|
|
||||||
|
# cf.am_policy_hub = true
|
||||||
|
# # cf.run_file = "motd.cf"
|
||||||
|
# end
|
||||||
|
#
|
||||||
|
# You can also configure and bootstrap a client to an existing
|
||||||
|
# policy server:
|
||||||
|
#
|
||||||
|
# config.vm.provision "cfengine" do |cf|
|
||||||
|
# cf.policy_server_address = "10.0.2.15"
|
||||||
|
# end
|
||||||
|
|
||||||
|
# Enable provisioning with Puppet stand alone. Puppet manifests
|
||||||
|
# are contained in a directory path relative to this Vagrantfile.
|
||||||
|
# You will need to create the manifests directory and a manifest in
|
||||||
|
# the file default.pp in the manifests_path directory.
|
||||||
|
#
|
||||||
|
# config.vm.provision "puppet" do |puppet|
|
||||||
|
# puppet.manifests_path = "manifests"
|
||||||
|
# puppet.manifest_file = "default.pp"
|
||||||
|
# end
|
||||||
|
|
||||||
|
# Enable provisioning with chef solo, specifying a cookbooks path, roles
|
||||||
|
# path, and data_bags path (all relative to this Vagrantfile), and adding
|
||||||
|
# some recipes and/or roles.
|
||||||
|
#
|
||||||
|
# config.vm.provision "chef_solo" do |chef|
|
||||||
|
# chef.cookbooks_path = "../my-recipes/cookbooks"
|
||||||
|
# chef.roles_path = "../my-recipes/roles"
|
||||||
|
# chef.data_bags_path = "../my-recipes/data_bags"
|
||||||
|
# chef.add_recipe "mysql"
|
||||||
|
# chef.add_role "web"
|
||||||
|
#
|
||||||
|
# # You may also specify custom JSON attributes:
|
||||||
|
# chef.json = { mysql_password: "foo" }
|
||||||
|
# end
|
||||||
|
|
||||||
|
# Enable provisioning with chef server, specifying the chef server URL,
|
||||||
|
# and the path to the validation key (relative to this Vagrantfile).
|
||||||
|
#
|
||||||
|
# The Opscode Platform uses HTTPS. Substitute your organization for
|
||||||
|
# ORGNAME in the URL and validation key.
|
||||||
|
#
|
||||||
|
# If you have your own Chef Server, use the appropriate URL, which may be
|
||||||
|
# HTTP instead of HTTPS depending on your configuration. Also change the
|
||||||
|
# validation key to validation.pem.
|
||||||
|
#
|
||||||
|
# config.vm.provision "chef_client" do |chef|
|
||||||
|
# chef.chef_server_url = "https://api.opscode.com/organizations/ORGNAME"
|
||||||
|
# chef.validation_key_path = "ORGNAME-validator.pem"
|
||||||
|
# end
|
||||||
|
#
|
||||||
|
# If you're using the Opscode platform, your validator client is
|
||||||
|
# ORGNAME-validator, replacing ORGNAME with your organization name.
|
||||||
|
#
|
||||||
|
# If you have your own Chef Server, the default validation client name is
|
||||||
|
# chef-validator, unless you changed the configuration.
|
||||||
|
#
|
||||||
|
# chef.validation_client_name = "ORGNAME-validator"
|
||||||
|
config.vm.provision "ansible" do |ansible|
|
||||||
|
ansible.inventory_path = "provision_hosts"
|
||||||
|
ansible.playbook = "provision.yml"
|
||||||
|
end
|
||||||
|
end
|
@ -1,5 +1,5 @@
|
|||||||
[defaults]
|
[defaults]
|
||||||
inventory=hosts
|
|
||||||
log_path=/var/log/ansible.log
|
|
||||||
host_key_checking=False
|
host_key_checking=False
|
||||||
become_method=sudo
|
inventory=hosts
|
||||||
|
roles_path=roles
|
||||||
|
pipelining=True
|
||||||
|
31
domain.yml
Normal file
31
domain.yml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
# Configurazione dominio
|
||||||
|
ntpserver: pdc.salerno1.ilariaalpi.edu
|
||||||
|
server: pdc
|
||||||
|
serverip: 192.168.4.1
|
||||||
|
servernetmask: 255.255.255.0
|
||||||
|
servernet: 192.168.4.0
|
||||||
|
servergw: 192.168.4.1
|
||||||
|
serverfqdn: pdc.salerno1.ilariaalpi.edu
|
||||||
|
domainshort: SALERNO1
|
||||||
|
domainfull: salerno1.ilariaalpi.edu
|
||||||
|
dhcprange_start: 192.168.4.10
|
||||||
|
dhcprange_end: 192.168.4.60
|
||||||
|
extdnsserver1: 208.67.222.222
|
||||||
|
extdnsserver2: 208.67.220.220
|
||||||
|
org_email: miic8dz008@istruzione.it
|
||||||
|
org_company: Istituto Comprensivo Ilaria Alpi
|
||||||
|
org_countrycode: IT
|
||||||
|
org_department: "Laboratorio 1 - via Salerno, 1"
|
||||||
|
org_city: Milano
|
||||||
|
org_phone: 02 88444696
|
||||||
|
org_street: Via Salerno, 1
|
||||||
|
edu_package: secondary
|
||||||
|
mirror_mode: local
|
||||||
|
#mirror_nfs_share: 192.168.255.1:/var/spool/apt-mirror/mirror
|
||||||
|
mirror_host: it.archive.ubuntu.com
|
||||||
|
#mirror_path: /ubuntu
|
||||||
|
#mirror_security_host: security.ubuntu.com
|
||||||
|
#mirror_security_path: /ubuntu
|
||||||
|
client_gitbranch: ilariaalpi
|
||||||
|
client_gitrepo: "https://git.libreschool.org/LibreSchool/client-pull-installation.git"
|
@ -1,7 +0,0 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
34656463636239626332366464373337386539643933653433653362613238666330636334323465
|
|
||||||
6666373739386430643330666238366237646365623634370a363530303762373036616332313966
|
|
||||||
31343339373532346538393164373037396135633631653133663862316161373566633938386234
|
|
||||||
6366613030386432320a313262383838663262373037643138616131343337626234306436323462
|
|
||||||
64333262663662353836303365316433353463326664623838353339376164313235363339313238
|
|
||||||
3865613230306436346365623338366564346633343565623964
|
|
6
hosts
6
hosts
@ -1 +1,5 @@
|
|||||||
localhost ansible_connection=local
|
[defaults]
|
||||||
|
host_key_checking=false
|
||||||
|
|
||||||
|
[server]
|
||||||
|
172.16.99.18 ansible_ssh_user=amgmt
|
||||||
|
58
how_to_change_passwords.md
Normal file
58
how_to_change_passwords.md
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
# Default password for project #
|
||||||
|
|
||||||
|
* NS Box root user: `vagrant`
|
||||||
|
* NS Box vagrant user: `vagrant`
|
||||||
|
* Vault Password: `v4ul+Password!`
|
||||||
|
* amgmt user (server): `DoN0t4g3t!`
|
||||||
|
* bglug user (client): `s4lamanDr@`
|
||||||
|
* admin user (domain): `R0busTdom41nPa55wd!`
|
||||||
|
|
||||||
|
# How to change passwords for production deployments #
|
||||||
|
|
||||||
|
## *root* and *vagrant* users ##
|
||||||
|
|
||||||
|
These will not be required, since you will not have a virtual machine to
|
||||||
|
manage via *Vagrant*.
|
||||||
|
|
||||||
|
## Vault password ##
|
||||||
|
|
||||||
|
Clone [`client-pull-installation`][2] then, in the working copy, launch following commands:
|
||||||
|
|
||||||
|
$ ansible-vault rekey domainpwd.vault
|
||||||
|
|
||||||
|
`ansible-vault` will ask one time the old password and two times the new one.
|
||||||
|
|
||||||
|
## *amgmt* user (server-side) ##
|
||||||
|
|
||||||
|
Clone [`server-config`][1] then, in the working copy, generate a new password hash with the follwing command:
|
||||||
|
|
||||||
|
$ mkpasswd -m sha-512
|
||||||
|
|
||||||
|
The command would ask for the password to be hashed. Please copy the result string.
|
||||||
|
|
||||||
|
Open up the file `roles/init/tasks/mgmtuser.yml`, find out `password:` and then replace previous hash with the one you have just created.
|
||||||
|
|
||||||
|
## *bglug* user (client side but preseeded) ##
|
||||||
|
|
||||||
|
The definition of password for *bglug* is inside `*.seed` files, inside [`server-config`][1]. Create a new password hash with:
|
||||||
|
|
||||||
|
$ mkpasswd -m sha-512
|
||||||
|
|
||||||
|
Copy the hash in your clipboard; clone the repository, then in the working directory:
|
||||||
|
|
||||||
|
$ find . -iname \*.seed -exec $EDITOR {} \;
|
||||||
|
|
||||||
|
Within each `*.seed` file, search for the string `user-password-crypted` string and change following hash.
|
||||||
|
|
||||||
|
## *admin* user (domain valid) ##
|
||||||
|
|
||||||
|
Password must be specified within NethServer interface for the *admin* user and must be absolutely equal to the one contained inside vault file.
|
||||||
|
|
||||||
|
Clone [`client-pull-installation`][2], create new branch and modify the password inside `domainpwd.vault`:
|
||||||
|
|
||||||
|
$ ansible-vault edit domainpwd.vault
|
||||||
|
|
||||||
|
The system would ask for the vault password. Change the plain text password with your editor.
|
||||||
|
|
||||||
|
[1]: https://github.com/bglug-it/server-config
|
||||||
|
[2]: https://github.com/bglug-it/client-pull-installation
|
7
init.yml
Normal file
7
init.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- hosts: server
|
||||||
|
vars:
|
||||||
|
- ansible_ssh_user: root
|
||||||
|
roles:
|
||||||
|
- init
|
15
local.yml
15
local.yml
@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- hosts: localhost
|
|
||||||
user: root
|
|
||||||
vars_files:
|
|
||||||
- domainpwd.vault
|
|
||||||
roles:
|
|
||||||
- prereq
|
|
||||||
- { role: networkpackagemanager, when: '(ansible_local.domain.disable_npm is not defined or ansible_local.domain.disable_npm|bool == False) and ansible_local.checksum.needs_pkg_run|bool' }
|
|
||||||
- { role: init, when: 'ansible_local.checksum.needs_repo_run | bool' }
|
|
||||||
- { role: custom, when: 'ansible_local.checksum.needs_repo_run | bool' }
|
|
||||||
- { role: remote-control, when: 'ansible_local.checksum.needs_repo_run | bool' }
|
|
||||||
- { role: domain, when: 'ansible_local.checksum.needs_repo_run | bool' }
|
|
||||||
environment:
|
|
||||||
PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
|
5
ovpn-client.yml
Normal file
5
ovpn-client.yml
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- hosts: server
|
||||||
|
roles:
|
||||||
|
- ovpn-client
|
5
provision.yml
Normal file
5
provision.yml
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
# Vagrant provisioning playbook
|
||||||
|
- hosts: vagrant
|
||||||
|
roles:
|
||||||
|
- rename-nic
|
3
provision_hosts
Normal file
3
provision_hosts
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
# Generated by Vagrant
|
||||||
|
[vagrant]
|
||||||
|
NethServer ansible_ssh_host=127.0.0.1 ansible_ssh_port=2222 ansible_ssh_user=vagrant
|
14
roles/ansible-pull/files/logrotate
Normal file
14
roles/ansible-pull/files/logrotate
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
/var/log/ansible.log {
|
||||||
|
rotate 7
|
||||||
|
daily
|
||||||
|
compress
|
||||||
|
missingok
|
||||||
|
notifempty
|
||||||
|
}
|
||||||
|
/var/log/ansible-pull.log {
|
||||||
|
rotate 7
|
||||||
|
daily
|
||||||
|
compress
|
||||||
|
missingok
|
||||||
|
notifempty
|
||||||
|
}
|
17
roles/ansible-pull/tasks/ansible-pull.yml
Normal file
17
roles/ansible-pull/tasks/ansible-pull.yml
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
- name: Creazione directory per ansible-pull
|
||||||
|
file: path=/var/lib/nethserver/ibay/ks/ansible-pull state=directory
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Template
|
||||||
|
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
|
||||||
|
with_items:
|
||||||
|
- init-ansible.sh
|
||||||
|
- ansible-pull.sh
|
||||||
|
- getvaultpass.py
|
||||||
|
- crontab
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Logrotate
|
||||||
|
copy: src=logrotate dest=/var/lib/nethserver/ibay/ks/ansible-pull/logrotate
|
||||||
|
become: yes
|
4
roles/ansible-pull/tasks/main.yml
Normal file
4
roles/ansible-pull/tasks/main.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- include: ansible-pull.yml
|
||||||
|
tags: ansible-pull
|
27
roles/ansible-pull/templates/ansible-pull.sh
Normal file
27
roles/ansible-pull/templates/ansible-pull.sh
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# waiting for dns stack to be ready
|
||||||
|
while true; do
|
||||||
|
[[ "$(dig +short {{ ansible_local.domain.serverfqdn }})" == "{{ ansible_local.domain.serverip }}" ]] && break;
|
||||||
|
done
|
||||||
|
|
||||||
|
# Aggiorna crontab e logrotate forzosamente.
|
||||||
|
echo "$(date --rfc-3339=seconds) Loading and running init-ansible.sh"
|
||||||
|
/usr/bin/curl -sSL4 http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | /bin/bash
|
||||||
|
|
||||||
|
# Script provvisorio.
|
||||||
|
# Potremmo decidere di far eseguire uno script generato da servizio
|
||||||
|
# domainhelper contenente anche l'eventuale branch da usare.
|
||||||
|
|
||||||
|
url=git://{{ ansible_local.domain.serverfqdn }}/client-pull-installation.git
|
||||||
|
repo=/var/lib/{{ ansible_local.domain.domainfull }}/config
|
||||||
|
logfile=/var/lib/ansible-pull.log
|
||||||
|
branch={{ ansible_local.domain.client_gitbranch }}
|
||||||
|
playbook=local.yml
|
||||||
|
|
||||||
|
echo "$(date --rfc-3339=seconds) Getting vault password"
|
||||||
|
vaultpassfile=$(/usr/bin/curl -sSL4 http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | /usr/bin/python)
|
||||||
|
|
||||||
|
echo "$(date --rfc-3339=seconds) Running ansible-pull"
|
||||||
|
/usr/bin/ansible-pull --accept-host-key -i localhost -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
|
||||||
|
rm -f "${vaultpassfile}"
|
1
roles/ansible-pull/templates/crontab
Normal file
1
roles/ansible-pull/templates/crontab
Normal file
@ -0,0 +1 @@
|
|||||||
|
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1
|
30
roles/ansible-pull/templates/getvaultpass.py
Normal file
30
roles/ansible-pull/templates/getvaultpass.py
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
from Crypto.Hash import MD5
|
||||||
|
from Crypto.Cipher import AES
|
||||||
|
from base64 import b64decode
|
||||||
|
from requests import get
|
||||||
|
from socket import gethostname
|
||||||
|
from tempfile import mkstemp
|
||||||
|
import time
|
||||||
|
import os
|
||||||
|
|
||||||
|
key = MD5.new(gethostname()).digest()
|
||||||
|
cipher = AES.new(key, AES.MODE_ECB)
|
||||||
|
|
||||||
|
for i in range(10):
|
||||||
|
try:
|
||||||
|
base64enc = get("http://{{ ansible_local.domain.serverfqdn }}:3000/vaultpass")
|
||||||
|
break
|
||||||
|
except:
|
||||||
|
time.sleep(1)
|
||||||
|
|
||||||
|
encrypted = b64decode(base64enc.content)
|
||||||
|
longpass = cipher.decrypt(encrypted)
|
||||||
|
|
||||||
|
fd, filename = mkstemp()
|
||||||
|
os.write(fd, longpass.strip('x'))
|
||||||
|
os.close(fd)
|
||||||
|
|
||||||
|
print(filename)
|
35
roles/ansible-pull/templates/init-ansible.sh
Normal file
35
roles/ansible-pull/templates/init-ansible.sh
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Fixing base variables.
|
||||||
|
basedir=/var/lib/{{ ansible_local.domain.domainfull }}
|
||||||
|
url=git://{{ ansible_local.domain.serverfqdn }}/client-pull-installation.git
|
||||||
|
branch={{ ansible_local.domain.client_gitbranch }}
|
||||||
|
|
||||||
|
# Creo directory dipendenti
|
||||||
|
echo "$(date --rfc-3339=seconds) Installing bin directory."
|
||||||
|
/usr/bin/install -d -o root -g users ${basedir}/bin
|
||||||
|
|
||||||
|
# Workaround issue #23 - ansible-pull won't pull out of remote the first time.
|
||||||
|
if [[ ! -f ${basedir}/config/local.yml ]]; then
|
||||||
|
/usr/bin/git clone -b ${branch} ${url} ${basedir}/config
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Installo ansible-pull.sh
|
||||||
|
echo "$(date --rfc-3339=seconds) Creating ansible-pull.sh."
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O ${basedir}/bin/ansible-pull.sh
|
||||||
|
chmod a+x ${basedir}/bin/ansible-pull.sh
|
||||||
|
|
||||||
|
# Fixing permissions on the main directory
|
||||||
|
/bin/chown -R root:users ${basedir}
|
||||||
|
|
||||||
|
# Installo il cronjob per ansible-pull
|
||||||
|
echo "$(date --rfc-3339=seconds) Creating crontab"
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull
|
||||||
|
/bin/chown root:root /etc/cron.d/ansible-pull
|
||||||
|
/bin/chmod 0644 /etc/cron.d/ansible-pull
|
||||||
|
|
||||||
|
# Installo il logrotate per ansible
|
||||||
|
echo "$(date --rfc-3339=seconds) Creating logrotate"
|
||||||
|
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull
|
||||||
|
/bin/chown root:root /etc/logrotate.d/ansible-pull
|
||||||
|
/bin/chmod 0644 /etc/logrotate.d/ansible-pull
|
@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
base_common_addpkg:
|
|
||||||
- vim
|
|
||||||
- screen
|
|
||||||
- cifs-utils
|
|
||||||
- ubuntu-edu-secondary
|
|
||||||
- firefox-locale-it
|
|
||||||
- libreoffice-l10n-it
|
|
||||||
- libnss-myhostname
|
|
||||||
- ubuntu-restricted-extras
|
|
||||||
base_common_delpkg:
|
|
||||||
- libnss-mdns
|
|
||||||
- unity-webapps-common
|
|
||||||
- zeitgeist-core
|
|
||||||
- zeitgeist-datahub
|
|
||||||
base_client_addpkg:
|
|
||||||
- epoptes-client
|
|
||||||
base_client_delpkg:
|
|
||||||
- epoptes
|
|
||||||
base_docenti_addpkg:
|
|
||||||
- epoptes
|
|
||||||
base_docenti_delpkg:
|
|
||||||
- epoptes-client
|
|
@ -1,27 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: Checking for installation of ansible
|
|
||||||
apt:
|
|
||||||
name: ansible
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Updating ansible-pull custom scripts
|
|
||||||
get_url:
|
|
||||||
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/{{ item }}"
|
|
||||||
dest: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/{{ item }}"
|
|
||||||
force: yes
|
|
||||||
with_items:
|
|
||||||
- getvaultpass.py
|
|
||||||
- ansible-pull.sh
|
|
||||||
|
|
||||||
- name: Updating crontab for ansible-pull
|
|
||||||
get_url:
|
|
||||||
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab"
|
|
||||||
dest: /etc/cron.d/ansible-pull
|
|
||||||
force: yes
|
|
||||||
|
|
||||||
- name: Updating logrotate settings for ansible-pull
|
|
||||||
get_url:
|
|
||||||
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate"
|
|
||||||
dest: /etc/logrotate.d/ansible-pull
|
|
||||||
force: yes
|
|
@ -1,20 +0,0 @@
|
|||||||
---
|
|
||||||
# Manages the installation of the main desktop environment
|
|
||||||
|
|
||||||
- name: Checking for desktop environment
|
|
||||||
shell: 'tasksel --list-tasks | grep "^i edubuntu-desktop-gnome"'
|
|
||||||
ignore_errors: yes
|
|
||||||
register: check_edubuntu_pkg
|
|
||||||
changed_when: check_edubuntu_pkg.rc != 0
|
|
||||||
tags: edu-install
|
|
||||||
|
|
||||||
- name: Installation of the desktop environment
|
|
||||||
shell: "DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get -y install edubuntu-desktop-gnome^"
|
|
||||||
when: check_edubuntu_pkg is changed
|
|
||||||
tags: edu-install
|
|
||||||
|
|
||||||
- name: Change default desktop environment
|
|
||||||
replace:
|
|
||||||
dest: /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
|
|
||||||
regexp: "^user-session=ubuntu$"
|
|
||||||
replace: "user-session=gnome-fallback"
|
|
@ -1,33 +0,0 @@
|
|||||||
---
|
|
||||||
# System base configurations.
|
|
||||||
# At the end of system configuration, we should have a complete
|
|
||||||
# Edubuntu system
|
|
||||||
|
|
||||||
# Requires fact execpath, already set by prereq role.
|
|
||||||
|
|
||||||
- include: virtualbox-guest-addons.yml
|
|
||||||
tags:
|
|
||||||
- base
|
|
||||||
- virtualbox-addons
|
|
||||||
|
|
||||||
- include: system-update.yml
|
|
||||||
tags:
|
|
||||||
- base
|
|
||||||
- update
|
|
||||||
|
|
||||||
- include: desktop-environment.yml
|
|
||||||
tags:
|
|
||||||
- base
|
|
||||||
- de
|
|
||||||
- desktop-environment
|
|
||||||
|
|
||||||
- include: packages.yml
|
|
||||||
tags:
|
|
||||||
- base
|
|
||||||
- pkgs
|
|
||||||
- packages
|
|
||||||
|
|
||||||
- include: system.yml
|
|
||||||
tags:
|
|
||||||
- base
|
|
||||||
- edubuntu
|
|
@ -1,59 +0,0 @@
|
|||||||
---
|
|
||||||
# Management of packages
|
|
||||||
|
|
||||||
- name: Activate LTS support by the means of HWE stack
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- linux-generic-lts-xenial
|
|
||||||
- xserver-xorg-core-lts-xenial
|
|
||||||
- xserver-xorg-lts-xenial
|
|
||||||
- xserver-xorg-video-all-lts-xenial
|
|
||||||
- xserver-xorg-input-all-lts-xenial
|
|
||||||
- libwayland-egl1-mesa-lts-xenial
|
|
||||||
state: present
|
|
||||||
install_recommends: yes
|
|
||||||
|
|
||||||
- name: Removing packages commonly not required
|
|
||||||
apt:
|
|
||||||
pkg: "{{ base_common_delpkg }}"
|
|
||||||
state: absent
|
|
||||||
purge: yes
|
|
||||||
|
|
||||||
- name: Removing packages from client machines
|
|
||||||
apt:
|
|
||||||
pkg: "{{ base_client_delpkg }}"
|
|
||||||
state: absent
|
|
||||||
purge: yes
|
|
||||||
when: ansible_local.noderole.role == 'client' and base_client_delpkg|length > 0
|
|
||||||
|
|
||||||
- name: Removing packages from docenti machines
|
|
||||||
apt:
|
|
||||||
pkg: "{{ base_docenti_delpkg }}"
|
|
||||||
state: absent
|
|
||||||
purge: yes
|
|
||||||
when: ansible_local.noderole.role == 'docenti' and base_docenti_delpkg|length > 0
|
|
||||||
|
|
||||||
- name: Cleanup of unneeded packages
|
|
||||||
shell: apt-get -y autoremove
|
|
||||||
args:
|
|
||||||
warn: false
|
|
||||||
register: autoremove
|
|
||||||
changed_when: "'Rimozione' in autoremove.stdout"
|
|
||||||
|
|
||||||
- name: Installing additional common packages
|
|
||||||
apt:
|
|
||||||
pkg: "{{ base_common_addpkg }}"
|
|
||||||
state: present
|
|
||||||
tags: edu-install
|
|
||||||
|
|
||||||
- name: Installing additional packages for client role
|
|
||||||
apt:
|
|
||||||
pkg: "{{ base_client_addpkg }}"
|
|
||||||
state: present
|
|
||||||
when: ansible_local.noderole.role == 'client' and base_client_addpkg|length > 0
|
|
||||||
|
|
||||||
- name: Installing additional packages for docenti role
|
|
||||||
apt:
|
|
||||||
pkg: "{{ base_docenti_addpkg }}"
|
|
||||||
state: present
|
|
||||||
when: ansible_local.noderole.role == 'docenti' and base_docenti_addpkg|length > 0
|
|
@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
# Manage system upgrade
|
|
||||||
|
|
||||||
- name: Updating available packages
|
|
||||||
apt: update_cache=yes cache_valid_time=180
|
|
||||||
|
|
||||||
- name: Upgrading system
|
|
||||||
apt: upgrade=full
|
|
@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
# Adjusting other settings due to unattended installation
|
|
||||||
|
|
||||||
- name: Adjusting connections for NetworkManager
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/network/interfaces
|
|
||||||
regexp: "{{ item }}"
|
|
||||||
state: absent
|
|
||||||
when: ansible_product_name != "VirtualBox"
|
|
||||||
with_items:
|
|
||||||
- '^auto {{ ansible_default_ipv4.interface }}'
|
|
||||||
- '^iface {{ ansible_default_ipv4.interface }}'
|
|
@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
# Manage Virtualbox additions
|
|
||||||
|
|
||||||
- name: Adding Virtualbox Guest Additions if required
|
|
||||||
apt:
|
|
||||||
pkg: virtualbox-guest-dkms
|
|
||||||
stat: present
|
|
||||||
when: ansible_product_name == "VirtualBox"
|
|
8
roles/client-install/meta/main.yml
Normal file
8
roles/client-install/meta/main.yml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
dependencies:
|
||||||
|
- { role: ubuntu-mirror, tags: [ 'client-install' ] }
|
||||||
|
- { role: preseed, tags: [ 'client-install' ] }
|
||||||
|
- { role: ansible-pull, tags: [ 'client-install' ] }
|
||||||
|
- { role: doraemon, tags: [ 'client-install' ] }
|
||||||
|
- { role: npm, tags: [ 'client-install' ] }
|
||||||
|
- { role: git-daemon, tags: [ 'client-install' ] }
|
@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: reboot
|
|
||||||
shell: /sbin/shutdown -r now "Reboot by Ansible."
|
|
||||||
async: 0
|
|
||||||
poll: 0
|
|
@ -1,48 +0,0 @@
|
|||||||
---
|
|
||||||
# Managing epoptes on 'client' role
|
|
||||||
|
|
||||||
- name: Getting epoptes server name
|
|
||||||
get_url:
|
|
||||||
url: "http://{{ ansible_local.domain.serverfqdn }}:3000/epoptes-srv"
|
|
||||||
dest: /tmp/epoptes-srv
|
|
||||||
register: get_epo_srv_name
|
|
||||||
|
|
||||||
- name: Checking for a correct name
|
|
||||||
shell: cat /tmp/epoptes-srv
|
|
||||||
register: epo_srv_name
|
|
||||||
when: get_epo_srv_name is changed
|
|
||||||
changed_when: "'none' not in epo_srv_name.stdout"
|
|
||||||
|
|
||||||
- name: Cleanup
|
|
||||||
file:
|
|
||||||
path: /tmp/epoptes-srv
|
|
||||||
state: absent
|
|
||||||
when: get_epo_srv_name is changed
|
|
||||||
|
|
||||||
- name: Ensuring epoptes-client is installed
|
|
||||||
apt:
|
|
||||||
name: epoptes-client
|
|
||||||
state: present
|
|
||||||
when: get_epo_srv_name is changed
|
|
||||||
|
|
||||||
- name: Configuring the client
|
|
||||||
replace:
|
|
||||||
dest: /etc/default/epoptes-client
|
|
||||||
regexp: "^#SERVER=server"
|
|
||||||
replace: "SERVER={{ epo_srv_name.stdout }}"
|
|
||||||
when: epo_srv_name is changed
|
|
||||||
|
|
||||||
- name: Checking for an already existent certificate
|
|
||||||
file:
|
|
||||||
path: /etc/epoptes/server.crt
|
|
||||||
state: file
|
|
||||||
register: crt_epo_exists
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Getting the epoptes server certificate
|
|
||||||
shell: /usr/sbin/epoptes-client -c
|
|
||||||
when: crt_epo_exists is failed
|
|
||||||
# I don't notify anymore, hoping that this would be done on first run after
|
|
||||||
# preseed and it should restart because of domain join.
|
|
||||||
#notify:
|
|
||||||
# - reboot
|
|
@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
# Managing actions for role 'client'
|
|
||||||
|
|
||||||
- include: epoptes.yml
|
|
||||||
when: ansible_local.noderole.role == 'client'
|
|
||||||
tags:
|
|
||||||
- role
|
|
||||||
- client
|
|
@ -1,5 +0,0 @@
|
|||||||
APT::Periodic::Update-Package-Lists "1";
|
|
||||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
|
||||||
APT::Periodic::AutocleanInterval "7";
|
|
||||||
APT::Periodic::Unattended-Upgrade "1";
|
|
||||||
//APT::Periodic::RandomSleep "0";
|
|
@ -1,34 +0,0 @@
|
|||||||
// Automatically upgrade packages from these (origin, archive) pairs
|
|
||||||
Unattended-Upgrade::Allowed-Origins {
|
|
||||||
"${distro_id}:${distro_codename}";
|
|
||||||
"${distro_id}:${distro_codename}-security";
|
|
||||||
"${distro_id}:${distro_codename}-updates";
|
|
||||||
"${distro_id}:${distro_codename}-proposed";
|
|
||||||
"${distro_id}:${distro_codename}-backports";
|
|
||||||
"LP-PPA-app-review-board:trusty";
|
|
||||||
"LP-PPA-libreoffice-libreoffice-5-0:trusty";
|
|
||||||
"LP-PPA-ansible-ansible:trusty";
|
|
||||||
"BgLUG:trusty";
|
|
||||||
};
|
|
||||||
|
|
||||||
// List of packages to not update
|
|
||||||
Unattended-Upgrade::Package-Blacklist {
|
|
||||||
// "vim";
|
|
||||||
// "libc6";
|
|
||||||
// "libc6-dev";
|
|
||||||
// "libc6-i686";
|
|
||||||
};
|
|
||||||
|
|
||||||
// Send email to this address for problems or packages upgrades
|
|
||||||
// If empty or unset then no email is sent, make sure that you
|
|
||||||
// have a working mail setup on your system. The package 'mailx'
|
|
||||||
// must be installed or anything that provides /usr/bin/mail.
|
|
||||||
//Unattended-Upgrade::Mail "root@localhost";
|
|
||||||
|
|
||||||
// Do automatic removal of new unused dependencies after the upgrade
|
|
||||||
// (equivalent to apt-get autoremove)
|
|
||||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
||||||
|
|
||||||
// Automatically reboot *WITHOUT CONFIRMATION* if a
|
|
||||||
// the file /var/run/reboot-required is found after the upgrade
|
|
||||||
Unattended-Upgrade::Automatic-Reboot "false";
|
|
@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: Installing plymouth theme
|
|
||||||
apt:
|
|
||||||
name: plymouth-theme-edubuntu-bglug
|
|
||||||
state: latest
|
|
||||||
force: yes
|
|
||||||
|
|
||||||
- name: Installing lightdm wallpaper
|
|
||||||
apt:
|
|
||||||
name: bglug-artwork
|
|
||||||
state: latest
|
|
||||||
force: yes
|
|
@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
# BgLUG customization
|
|
||||||
|
|
||||||
- include: unattended-upgrades.yml
|
|
||||||
tags:
|
|
||||||
- custom
|
|
||||||
- unattended-upgrades
|
|
||||||
|
|
||||||
- include: custom.yml
|
|
||||||
tags:
|
|
||||||
- custom
|
|
||||||
- bglug
|
|
@ -1,18 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: Ensure needed packages are installed
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- unattended-upgrades
|
|
||||||
- update-notifier-common
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Configuring unattended upgrades from file
|
|
||||||
copy:
|
|
||||||
src: 50-unattended-upgrades
|
|
||||||
dest: /etc/apt/apt.conf.d/50-unattended-upgrades
|
|
||||||
|
|
||||||
- name: Activating automatic updates
|
|
||||||
copy:
|
|
||||||
src: 20-auto-upgrades
|
|
||||||
dest: /etc/apt/apt.conf.d/20-auto-upgrades
|
|
29
roles/developuser/tasks/developuser.yml
Normal file
29
roles/developuser/tasks/developuser.yml
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
---
|
||||||
|
- name: Preparazione pacchetti per compilazione RPM
|
||||||
|
yum: pkg="{{ item }}" state=present
|
||||||
|
with_items:
|
||||||
|
- '@Development tools'
|
||||||
|
- rpmdevtools
|
||||||
|
- yum-utils
|
||||||
|
- rpmlint
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Aggiungo utente per compilazione pacchetti RPM
|
||||||
|
user:
|
||||||
|
name: makepkg
|
||||||
|
password: $6$rounds=100000$neTGJ5N7Nu5ogCTX$VmVgS9HRZcdczjiNNdQcZzFVQI/3AFwu6MNFOKxGhBRY4VcBOo6GTxhXr0K/jYVFTygjHWsr.teM6RmBzSnz.0
|
||||||
|
shell: /bin/bash
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Copia della chiave pubblica
|
||||||
|
authorized_key:
|
||||||
|
user: makepkg
|
||||||
|
key: "{{ lookup('file', '/Users/syntaxerrormmm/.ssh/id_rsa.pub') }}"
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Creazione directory per il build di RPM
|
||||||
|
shell: rpmdev-setuptree
|
||||||
|
become: yes
|
||||||
|
become_user: makepkg
|
3
roles/developuser/tasks/main.yml
Normal file
3
roles/developuser/tasks/main.yml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
- include: developuser.yml
|
||||||
|
tags: developuser
|
@ -1,11 +0,0 @@
|
|||||||
# vim:sts=2:sw=2
|
|
||||||
author "BgLUG - Bergamo Linux Users Group <info@bglug.it>"
|
|
||||||
description "Sanely starts epoptes server daemon on ubuntu."
|
|
||||||
|
|
||||||
start on net-device-up and started winbind
|
|
||||||
stop on stopped winbind
|
|
||||||
|
|
||||||
exec /usr/bin/twistd -n \
|
|
||||||
--logfile "/var/log/epoptes.log" --pidfile "/var/run/epoptes.pid" \
|
|
||||||
epoptes
|
|
||||||
respawn
|
|
@ -1,52 +0,0 @@
|
|||||||
---
|
|
||||||
# Managing Epoptes installation on 'docenti' role.
|
|
||||||
|
|
||||||
- name: Ensuring epoptes package has been installed
|
|
||||||
apt:
|
|
||||||
name: epoptes
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Configuring the Epoptes server
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/default/epoptes
|
|
||||||
line: 'SOCKET_GROUP="{{ ansible_local.domain.domainshort }}\docenti"'
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Stopping epoptes SysV daemon
|
|
||||||
shell: /etc/init.d/epoptes stop
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Disabling sysv start
|
|
||||||
shell: /usr/sbin/update-rc.d -f epoptes remove
|
|
||||||
|
|
||||||
- name: Installing upstart service
|
|
||||||
copy:
|
|
||||||
src: epoptes.conf
|
|
||||||
dest: /etc/init/epoptes.conf
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
- name: Verify epoptes status
|
|
||||||
shell: /sbin/status epoptes
|
|
||||||
register: epoptes_status
|
|
||||||
|
|
||||||
- name: Starting epoptes from upstart
|
|
||||||
shell: /sbin/start epoptes
|
|
||||||
when: epoptes_status.stdout.find("start/running") == -1
|
|
||||||
|
|
||||||
# Disabling ufw as per issue #12
|
|
||||||
- name: Disabling ufw by override
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/init/ufw.override
|
|
||||||
line: "manual"
|
|
||||||
state: present
|
|
||||||
create: yes
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
- name: Stopping ufw
|
|
||||||
service:
|
|
||||||
name: ufw
|
|
||||||
state: stopped
|
|
@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
# Managing actions for role 'docenti'
|
|
||||||
|
|
||||||
- include: epoptes.yml
|
|
||||||
when: ansible_local.noderole.role == 'docenti'
|
|
||||||
tags:
|
|
||||||
- role
|
|
||||||
- docenti
|
|
@ -1,2 +0,0 @@
|
|||||||
[com.canonical.indicator.session]
|
|
||||||
user-show-menu=false
|
|
@ -1,25 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
apt-get -y --force-yes install \
|
|
||||||
libldb1=1:1.1.16-1 \
|
|
||||||
libsmbclient=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
python-ldb=1:1.1.16-1 \
|
|
||||||
python-samba=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
samba=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
samba-common=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
samba-common-bin=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
samba-dsdb-modules=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
samba-libs=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
samba-vfs-modules=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
smbclient=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
libnss-winbind=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
libpam-winbind=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
libwbclient0=2:4.1.6+dfsg-1ubuntu2 \
|
|
||||||
winbind=2:4.1.6+dfsg-1ubuntu2
|
|
||||||
|
|
||||||
pkglist="libldb1 libsmbclient python-ldb python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0"
|
|
||||||
|
|
||||||
for pkg in ${pkglist}; do
|
|
||||||
apt-mark auto ${pkg}
|
|
||||||
apt-mark hold ${pkg}
|
|
||||||
done
|
|
@ -1,2 +0,0 @@
|
|||||||
[org.freedesktop.ibus.general]
|
|
||||||
use-system-keyboard-layout=true
|
|
@ -1,2 +0,0 @@
|
|||||||
[org.gnome.nautilus.desktop]
|
|
||||||
volumes-visible=true
|
|
@ -1,2 +0,0 @@
|
|||||||
[Configuration]
|
|
||||||
AdminIdentities=unix-group:sudo;unix-group:admin;unix-group:domopers
|
|
@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: reboot
|
|
||||||
shell: /sbin/shutdown -r now "Reboot by Ansible."
|
|
||||||
async: 0
|
|
||||||
poll: 0
|
|
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
dependencies:
|
|
||||||
- { role: base }
|
|
||||||
- { role: client }
|
|
||||||
- { role: docenti }
|
|
@ -1,45 +0,0 @@
|
|||||||
---
|
|
||||||
# Manages reactivation of pulseaudio as system daemon
|
|
||||||
|
|
||||||
- name: "Changing pulseaudio upstart script"
|
|
||||||
template:
|
|
||||||
src: pulseaudio.conf
|
|
||||||
dest: /etc/init/pulseaudio.conf
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
- name: "Checking if pulseaudio is started"
|
|
||||||
shell: /sbin/status pulseaudio
|
|
||||||
register: pulseaudio_status
|
|
||||||
|
|
||||||
- name: Starting pulseaudio service
|
|
||||||
shell: /usr/sbin/service pulseaudio start
|
|
||||||
when: pulseaudio_status.stdout.find("start/running") == -1
|
|
||||||
|
|
||||||
- name: "Configuring client options"
|
|
||||||
lineinfile:
|
|
||||||
line: '{{ item }}'
|
|
||||||
dest: /etc/pulse/client.conf
|
|
||||||
state: present
|
|
||||||
with_items:
|
|
||||||
- 'default-server = /var/run/pulse/native'
|
|
||||||
- 'autospawn = no'
|
|
||||||
|
|
||||||
- name: Disabling pulseaudio startup on lightdm
|
|
||||||
shell: chmod -x /usr/bin/start-pulseaudio-x11
|
|
||||||
args:
|
|
||||||
warn: false
|
|
||||||
|
|
||||||
- name: Removing old (and not-working) approach
|
|
||||||
file:
|
|
||||||
path: /etc/cron.d/pulseaudio-perms
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
- name: Get the new script
|
|
||||||
get_url:
|
|
||||||
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh"
|
|
||||||
dest: /tmp/paperms.sh
|
|
||||||
|
|
||||||
- name: Run the script (install other support files and fixes the permissions)
|
|
||||||
shell: bash /tmp/paperms.sh
|
|
@ -1,11 +0,0 @@
|
|||||||
---
|
|
||||||
# Final tasks.
|
|
||||||
|
|
||||||
- name: Ensuring APT stack is healthy
|
|
||||||
shell: dpkg --configure -a && apt-get install -f
|
|
||||||
|
|
||||||
# Correctly managing ansible-pull runs.
|
|
||||||
- name: Updating local version for repo
|
|
||||||
shell: 'rm -f {{ ansible_local.checksum.repover_file }} && echo "{{ ansible_local.checksum.repover }}" > {{ ansible_local.checksum.repover_file }}'
|
|
||||||
args:
|
|
||||||
warn: false
|
|
@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Removing upgrade-notification from /etc
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/update-manager/release-upgrades
|
|
||||||
line: "Prompt=never"
|
|
||||||
regexp: '^Prompt='
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Removing notifications for system upgrade
|
|
||||||
shell: >
|
|
||||||
test -f /usr/share/upstart/sessions/update-notifier-release.conf && mv /usr/share/upstart/sessions/update-notifier-release.conf /usr/share/upstart/sessions/update-notifier-release.conf.disabled
|
|
||||||
ignore_errors: yes
|
|
@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
# Domain join tasks
|
|
||||||
|
|
||||||
- name: Checking domain join
|
|
||||||
shell: wbinfo -t
|
|
||||||
register: check_domain
|
|
||||||
changed_when: check_domain.rc != 0
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Joining domain
|
|
||||||
shell: 'net rpc join -U admin%{{ domainadminpasswd }}'
|
|
||||||
when: check_domain is changed
|
|
||||||
register: domainjoin
|
|
||||||
notify:
|
|
||||||
- reboot
|
|
@ -1,27 +0,0 @@
|
|||||||
---
|
|
||||||
# Glib2 settings for a better user experience
|
|
||||||
|
|
||||||
- name: Disabling user listings in Metacity menu
|
|
||||||
copy:
|
|
||||||
src: com.canonical.indicator.session.gschema.override
|
|
||||||
dest: /usr/share/glib-2.0/schemas/com.canonical.indicator.session.gschema.override
|
|
||||||
backup: yes
|
|
||||||
register: cfg_glib_users
|
|
||||||
|
|
||||||
- name: Visualizing mounted drives on desktop
|
|
||||||
copy:
|
|
||||||
src: org.gnome.nautilus.desktop.gschema.override
|
|
||||||
dest: /usr/share/glib-2.0/schemas/org.gnome.nautilus.desktop.gschema.override
|
|
||||||
backup: yes
|
|
||||||
register: cfg_glib_mounted
|
|
||||||
|
|
||||||
- name: Fixing keyboard layout
|
|
||||||
copy:
|
|
||||||
src: org.freedesktop.ibus.general.gschema.override
|
|
||||||
dest: /usr/share/glib-2.0/schemas/org.freedesktop.ibus.general.schema.override
|
|
||||||
backup: yes
|
|
||||||
register: cfg_keyb_layout
|
|
||||||
|
|
||||||
- name: Recompiling glib2 schemas
|
|
||||||
shell: glib-compile-schemas --strict /usr/share/glib-2.0/schemas/
|
|
||||||
when: cfg_glib_users is changed or cfg_glib_mounted is changed or cfg_keyb_layout is changed
|
|
@ -1,14 +0,0 @@
|
|||||||
---
|
|
||||||
# Adjusting Graphical User Interface
|
|
||||||
|
|
||||||
- include: lightdm.yml
|
|
||||||
tags: lightdm
|
|
||||||
|
|
||||||
- include: glib2.yml
|
|
||||||
tags: glib2
|
|
||||||
|
|
||||||
- include: policykit-1.yml
|
|
||||||
tags: policykit
|
|
||||||
|
|
||||||
- include: disable-upgrade-notifications.yml
|
|
||||||
tags: disable-upgrade-notifications
|
|
@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
# Adjusting lightdm settings
|
|
||||||
|
|
||||||
- name: Adjusting lightdm settings
|
|
||||||
lineinfile:
|
|
||||||
dest: /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
|
|
||||||
regexp: "{{ item }}"
|
|
||||||
line: "{{ item }}"
|
|
||||||
with_items:
|
|
||||||
- "allow-guest=false"
|
|
||||||
- "greeter-hide-users=true"
|
|
||||||
- "greeter-show-manual-login=true"
|
|
@ -1,63 +0,0 @@
|
|||||||
---
|
|
||||||
# Domain configurations
|
|
||||||
|
|
||||||
- include: networkmanager.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- networkmanager
|
|
||||||
|
|
||||||
- include: ntp.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- ntp
|
|
||||||
|
|
||||||
- include: nss.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- nss
|
|
||||||
|
|
||||||
- include: audio.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- audio
|
|
||||||
|
|
||||||
- include: gui-changes.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- gui
|
|
||||||
|
|
||||||
- include: sslproxy.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- crt
|
|
||||||
|
|
||||||
- include: pkgs.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- pkgs
|
|
||||||
|
|
||||||
- include: pam_base.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- pam
|
|
||||||
|
|
||||||
- include: pam_mount.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- pam
|
|
||||||
- pam_mount
|
|
||||||
|
|
||||||
- include: smb_config.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- smb
|
|
||||||
|
|
||||||
- include: domain_join.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- join
|
|
||||||
|
|
||||||
- include: cleanup.yml
|
|
||||||
tags:
|
|
||||||
- domain
|
|
||||||
- cleanup
|
|
@ -1,21 +0,0 @@
|
|||||||
---
|
|
||||||
# Since students are disabling deliberately the network interface from
|
|
||||||
# NetworkManager, we insert the default interface in /etc/network/interfaces
|
|
||||||
# so they are not available to NM
|
|
||||||
|
|
||||||
- name: Ensuring first NIC will never be disabled again
|
|
||||||
lineinfile:
|
|
||||||
line: "{{ item }}"
|
|
||||||
state: present
|
|
||||||
dest: /etc/network/interfaces
|
|
||||||
insertafter: EOF
|
|
||||||
with_items:
|
|
||||||
- " "
|
|
||||||
- "auto {{ ansible_default_ipv4.interface }}"
|
|
||||||
- "iface {{ ansible_default_ipv4.interface }} inet dhcp"
|
|
||||||
|
|
||||||
# Hiding NetworkManager icon from any sessions
|
|
||||||
|
|
||||||
- name: Disabling NetworkManager from popping up in sessions
|
|
||||||
shell: mv /etc/xdg/autostart/nm-applet.desktop /etc/xdg/autostart/nm-applet.desktop.disabled
|
|
||||||
ignore_errors: yes
|
|
@ -1,11 +0,0 @@
|
|||||||
---
|
|
||||||
# configuring NSS
|
|
||||||
|
|
||||||
- name: Configuring NSS
|
|
||||||
template:
|
|
||||||
src: nsswitch.conf
|
|
||||||
dest: /etc/nsswitch.conf
|
|
||||||
backup: yes
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
@ -1,29 +0,0 @@
|
|||||||
---
|
|
||||||
# Configuring NTP for domain clients
|
|
||||||
|
|
||||||
- name: Installing NTP
|
|
||||||
apt:
|
|
||||||
name: ntp
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Configuring NTP
|
|
||||||
template:
|
|
||||||
src: ntp.conf
|
|
||||||
dest: /etc/ntp.conf
|
|
||||||
backup: yes
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
register: cfg_ntp
|
|
||||||
|
|
||||||
- name: Configuring AppArmor for NTP
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/apparmor.d/usr.sbin.ntpd
|
|
||||||
regexp: "/run/samba/winbindd/pipe"
|
|
||||||
line: ' /run/samba/winbindd/pipe crw,'
|
|
||||||
insertafter: 'samba/ntp_signd/socket'
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Restarting NTP service
|
|
||||||
shell: service ntp restart
|
|
||||||
when: cfg_ntp is changed
|
|
@ -1,52 +0,0 @@
|
|||||||
---
|
|
||||||
# base configuration for PAM Module
|
|
||||||
|
|
||||||
- name: Installing winbind bindings for PAM
|
|
||||||
apt:
|
|
||||||
name: libpam-winbind
|
|
||||||
state: present
|
|
||||||
|
|
||||||
# Leaving them here commented, as they may be needed in the future
|
|
||||||
# for improvements on login times.
|
|
||||||
|
|
||||||
# common-auth
|
|
||||||
|
|
||||||
#- name: 'common-auth: modifica pam_unix'
|
|
||||||
# replace:
|
|
||||||
# dest: /etc/pam.d/common-auth
|
|
||||||
# regexp: '^.*pam_unix\.so.*nullok_secure$'
|
|
||||||
# replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass'
|
|
||||||
#
|
|
||||||
#- name: 'common-auth: rimuovo config auto pam_winbind'
|
|
||||||
# lineinfile:
|
|
||||||
# dest: /etc/pam.d/common-auth
|
|
||||||
# regexp: 'pam_winbind\.so krb5'
|
|
||||||
# state: absent
|
|
||||||
#
|
|
||||||
#- name: 'common-auth: aggiunta pam_winbind'
|
|
||||||
# lineinfile:
|
|
||||||
# dest: /etc/pam.d/common-auth
|
|
||||||
# regexp: '^auth.*pam_winbind\.so$'
|
|
||||||
# insertbefore: '^auth.*pam_unix\.so'
|
|
||||||
# line: 'auth [success=2 default=ignore] pam_winbind.so'
|
|
||||||
# state: present
|
|
||||||
|
|
||||||
## common-password
|
|
||||||
#
|
|
||||||
#- name: 'common-password: configurazione pam_unix'
|
|
||||||
# replace:
|
|
||||||
# dest: /etc/pam.d/common-password
|
|
||||||
# regexp: '^(password.*pam_unix\.so.*sha512)$'
|
|
||||||
# replace: '\1 min=4 max=20'
|
|
||||||
# backup: yes
|
|
||||||
#
|
|
||||||
## common-session
|
|
||||||
#
|
|
||||||
#- name: 'common-session: configurazione pam_mkhomedir'
|
|
||||||
# lineinfile:
|
|
||||||
# dest: /etc/pam.d/common-session
|
|
||||||
# regexp: '^session.*pam_mkhomedir\.so.*$'
|
|
||||||
# insertafter: '^session\s*required.*pam_permit.so'
|
|
||||||
# line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
|
|
||||||
# state: present
|
|
||||||
# backup: yes
|
|
@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
# PAM_mount configuration
|
|
||||||
|
|
||||||
- name: Installing pam_mount
|
|
||||||
apt:
|
|
||||||
name: libpam-mount
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Configuring pam_mount
|
|
||||||
template:
|
|
||||||
src: pam_mount.conf.xml
|
|
||||||
dest: /etc/security/pam_mount.conf.xml
|
|
||||||
backup: yes
|
|
@ -1,35 +0,0 @@
|
|||||||
---
|
|
||||||
# Packages needed for domain join
|
|
||||||
|
|
||||||
# Badlock wrong resolution: downgrading SAMBA
|
|
||||||
|
|
||||||
- name: Copying scripts for fixing SAMBA
|
|
||||||
copy:
|
|
||||||
src: "{{ item }}"
|
|
||||||
dest: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/{{ item }}"
|
|
||||||
owner: root
|
|
||||||
mode: 0755
|
|
||||||
with_items:
|
|
||||||
- downgrade_samba.sh
|
|
||||||
|
|
||||||
- name: Verifying SAMBA version on client
|
|
||||||
shell: dpkg -l | grep libsmbclient
|
|
||||||
register: check_samba_version
|
|
||||||
ignore_errors: yes
|
|
||||||
changed_when: "'2:4.1.6+dfsg-1ubuntu2' not in check_samba_version.stdout"
|
|
||||||
|
|
||||||
#- name: Downgrading SAMBA if not the right version
|
|
||||||
# shell: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/downgrade_samba.sh"
|
|
||||||
# when: check_samba_version is changed
|
|
||||||
#
|
|
||||||
#- name: Checking again for the correct SAMBA version
|
|
||||||
# shell: dpkg -l | grep libsmbclient
|
|
||||||
# register: recheck_samba_version
|
|
||||||
# changed_when: "'2:4.1.6+dfsg-1ubuntu2' in check_samba_version.stdout"
|
|
||||||
|
|
||||||
- name: Installing domain packages
|
|
||||||
apt:
|
|
||||||
pkg:
|
|
||||||
- winbind
|
|
||||||
- samba
|
|
||||||
state: present
|
|
@ -1,10 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: Configuring sudo to accept users other than local admin
|
|
||||||
copy:
|
|
||||||
src: polkit-1.txt
|
|
||||||
dest: /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
backup: yes
|
|
@ -1,40 +0,0 @@
|
|||||||
---
|
|
||||||
# SAMBA configuration for domain
|
|
||||||
|
|
||||||
- name: Configuring SAMBA
|
|
||||||
template:
|
|
||||||
src: smb.conf
|
|
||||||
dest: /etc/samba/smb.conf
|
|
||||||
validate: 'testparm -s %s'
|
|
||||||
backup: yes
|
|
||||||
register: cfg_samba
|
|
||||||
|
|
||||||
- name: Configuring AppArmor home directories
|
|
||||||
replace:
|
|
||||||
dest: /etc/apparmor.d/tunables/home
|
|
||||||
regexp: '^@\{HOMEDIRS\}=/home/$'
|
|
||||||
replace: '@{HOMEDIRS}=/home/ /home/{{ ansible_local.domain.domainshort }}/'
|
|
||||||
|
|
||||||
- name: SAMBA restart
|
|
||||||
shell: /sbin/restart smbd
|
|
||||||
when: cfg_samba is changed
|
|
||||||
|
|
||||||
- name: Winbind restart
|
|
||||||
shell: /sbin/restart winbind
|
|
||||||
when: cfg_samba is changed
|
|
||||||
|
|
||||||
- name: Creating home base
|
|
||||||
file:
|
|
||||||
path: '/home/{{ ansible_local.domain.domainshort }}'
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
state: directory
|
|
||||||
|
|
||||||
- name: Permitting SAMBA domopers to run sudo
|
|
||||||
template:
|
|
||||||
src: sudoers.d
|
|
||||||
dest: /etc/sudoers.d/domain
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0440
|
|
||||||
validate: "/usr/sbin/visudo -cf %s"
|
|
@ -1,26 +0,0 @@
|
|||||||
---
|
|
||||||
# Adjusting system for domain proxy certificate
|
|
||||||
|
|
||||||
- name: Creating needed directories
|
|
||||||
file:
|
|
||||||
path: '{{ item }}'
|
|
||||||
mode: 0755
|
|
||||||
state: directory
|
|
||||||
with_items:
|
|
||||||
- '/usr/lib/firefox/browser/defaults/profile'
|
|
||||||
- '/usr/local/share/ca-certificates/{{ ansible_local.domain.domainfull }}'
|
|
||||||
|
|
||||||
- name: Getting SSL transparent proxy certificate
|
|
||||||
get_url:
|
|
||||||
url: 'http://{{ ansible_local.domain.serverfqdn }}/proxy.crt'
|
|
||||||
dest: '/usr/local/share/ca-certificates/{{ ansible_local.domain.domainfull }}/ca.crt'
|
|
||||||
register: proxycrt_dwnl
|
|
||||||
|
|
||||||
- name: Adding certificates to the ones used by the system
|
|
||||||
shell: update-ca-certificates
|
|
||||||
when: proxycrt_dwnl is changed
|
|
||||||
|
|
||||||
- name: Firefox settings to include certificate
|
|
||||||
get_url:
|
|
||||||
url: 'http://{{ ansible_local.domain.serverfqdn }}/ks/server-ca/cert8.db'
|
|
||||||
dest: /usr/lib/firefox/browser/defaults/profile/cert8.db
|
|
@ -1,11 +0,0 @@
|
|||||||
# {{ ansible_managed }}
|
|
||||||
passwd: compat winbind
|
|
||||||
group: compat winbind
|
|
||||||
shadow: compat winbind
|
|
||||||
hosts: files myhostname dns wins
|
|
||||||
networks: files
|
|
||||||
protocols: db files
|
|
||||||
services: db files
|
|
||||||
ethers: db files
|
|
||||||
rpc: db files
|
|
||||||
netgroup: nis
|
|
@ -1,58 +0,0 @@
|
|||||||
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
|
|
||||||
|
|
||||||
driftfile /var/lib/ntp/ntp.drift
|
|
||||||
|
|
||||||
|
|
||||||
# Enable this if you want statistics to be logged.
|
|
||||||
#statsdir /var/log/ntpstats/
|
|
||||||
|
|
||||||
statistics loopstats peerstats clockstats
|
|
||||||
filegen loopstats file loopstats type day enable
|
|
||||||
filegen peerstats file peerstats type day enable
|
|
||||||
filegen clockstats file clockstats type day enable
|
|
||||||
|
|
||||||
# Specify one or more NTP servers.
|
|
||||||
|
|
||||||
# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
|
|
||||||
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
|
|
||||||
# more information.
|
|
||||||
#server 0.ubuntu.pool.ntp.org
|
|
||||||
#server 1.ubuntu.pool.ntp.org
|
|
||||||
#server 2.ubuntu.pool.ntp.org
|
|
||||||
#server 3.ubuntu.pool.ntp.org
|
|
||||||
|
|
||||||
# Use Ubuntu's ntp server as a fallback.
|
|
||||||
#server ntp.ubuntu.com
|
|
||||||
|
|
||||||
# {{ ansible_managed }}
|
|
||||||
server {{ ansible_local.domain.ntpserver }} prefer
|
|
||||||
|
|
||||||
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
|
|
||||||
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
|
|
||||||
# might also be helpful.
|
|
||||||
#
|
|
||||||
# Note that "restrict" applies to both servers and clients, so a configuration
|
|
||||||
# that might be intended to block requests from certain clients could also end
|
|
||||||
# up blocking replies from your own upstream servers.
|
|
||||||
|
|
||||||
# By default, exchange time with everybody, but don't allow configuration.
|
|
||||||
restrict -4 default kod notrap nomodify nopeer noquery
|
|
||||||
restrict -6 default kod notrap nomodify nopeer noquery
|
|
||||||
|
|
||||||
# Local users may interrogate the ntp server more closely.
|
|
||||||
restrict 127.0.0.1
|
|
||||||
restrict ::1
|
|
||||||
|
|
||||||
# Clients from this (example!) subnet have unlimited access, but only if
|
|
||||||
# cryptographically authenticated.
|
|
||||||
#restrict 192.168.123.0 mask 255.255.255.0 notrust
|
|
||||||
|
|
||||||
|
|
||||||
# If you want to provide time to your local subnet, change the next line.
|
|
||||||
# (Again, the address is an example only.)
|
|
||||||
#broadcast 192.168.123.255
|
|
||||||
|
|
||||||
# If you want to listen to time broadcasts on your local subnet, de-comment the
|
|
||||||
# next lines. Please do this only if you trust everybody on the network!
|
|
||||||
#disable auth
|
|
||||||
#broadcastclient
|
|
@ -1,47 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="utf-8" ?>
|
|
||||||
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
|
|
||||||
<!--
|
|
||||||
See pam_mount.conf(5) for a description.
|
|
||||||
-->
|
|
||||||
|
|
||||||
<pam_mount>
|
|
||||||
<!--
|
|
||||||
debug should come before everything else, since this file is still
|
|
||||||
processed in a single pass from top-to-bottom
|
|
||||||
-->
|
|
||||||
<debug enable="0" />
|
|
||||||
|
|
||||||
<!-- Volume definitions -->
|
|
||||||
<volume user="*" sgrp="domain users" fstype="cifs"
|
|
||||||
server="{{ ansible_local.domain.server }}" path="%(USER)" mountpoint="~"
|
|
||||||
options="setuids,acl,user_xattr,iocharset=utf8,file_mode=0644,dir_mode=0755,cache=none" />
|
|
||||||
<volume user="*" sgrp="domain users" fstype="cifs"
|
|
||||||
server="{{ ansible_local.domain.server }}" path="shared" mountpoint="~/Condiviso"
|
|
||||||
options="setuids,acl,user_xattr,iocharset=utf8,file_mode=0664,dir_mode=0775,cache=strict" />
|
|
||||||
|
|
||||||
<!-- pam_mount parameters: General tunables -->
|
|
||||||
<!--
|
|
||||||
<luserconf name=".pam_mount.conf.xml" />
|
|
||||||
-->
|
|
||||||
|
|
||||||
<!--
|
|
||||||
Note that commenting out mntoptions will give you the defaults.
|
|
||||||
You will need to explicitly initialize it with the empty string
|
|
||||||
to reset the defaults to nothing.
|
|
||||||
-->
|
|
||||||
<!--
|
|
||||||
<mntoptions allow="loop,encryption,fsck,nonempty,allow_root,allow_other" />
|
|
||||||
<mntoptions deny="suid,dev" />
|
|
||||||
<mntoptions allow="*" />
|
|
||||||
<mntoptions deny="*" />
|
|
||||||
<mntoptions require="nosuid,nodev,exec" />
|
|
||||||
-->
|
|
||||||
|
|
||||||
<logout wait="10" hup="0" term="0" kill="0" />
|
|
||||||
|
|
||||||
<!-- pam_mount parameters: Volume-related -->
|
|
||||||
<mkmountpoint enable="1" remove="false" />
|
|
||||||
</pam_mount>
|
|
||||||
<!--
|
|
||||||
{{ ansible_managed }}
|
|
||||||
-->
|
|
@ -1,48 +0,0 @@
|
|||||||
# System PulseAudio service
|
|
||||||
|
|
||||||
description "System PulseAudio sound server"
|
|
||||||
author "Pali Rohár <pali.rohar@gmail.com>"
|
|
||||||
|
|
||||||
# uncomment the 'start on' to start pulseaudio in system mode
|
|
||||||
# (enables the pulseaudio init script - requires that users be in the
|
|
||||||
# pulse-access group)
|
|
||||||
# System mode is not the recommended way to run PulseAudio as it has some
|
|
||||||
# limitations (such as no shared memory access) and could potentially allow
|
|
||||||
# users to disconnect or redirect each others' audio streams. The
|
|
||||||
# recommended way to run PulseAudio is as a per-session daemon. For GNOME/KDE/
|
|
||||||
# Xfce sessions in Ubuntu Lucid/10.04, /etc/xdg/autostart/pulseaudio.desktop
|
|
||||||
# handles this function of automatically starting PulseAudio on login, and for
|
|
||||||
# it to work correctly your user must *not* have "autospawn = no" set in
|
|
||||||
# ~/.pulse/client.conf (or in /etc/pulse/client.conf). By default, autospawn
|
|
||||||
# is enabled. For other sessions, you can simply start PulseAudio with
|
|
||||||
# "pulseaudio --daemonize".
|
|
||||||
|
|
||||||
start on (started winbind)
|
|
||||||
stop on runlevel [016]
|
|
||||||
|
|
||||||
expect daemon
|
|
||||||
respawn
|
|
||||||
|
|
||||||
# Prevent users from dynamically loading modules into the PulseAudio sound
|
|
||||||
# server. Dynamic module loading enhances the flexibility of the PulseAudio
|
|
||||||
# system, but may pose a security risk.
|
|
||||||
# 0 = no, 1 = yes
|
|
||||||
env DISALLOW_MODULE_LOADING=1
|
|
||||||
|
|
||||||
# extra arguments to pass to the daemon
|
|
||||||
env PULSEAUDIO_ARGS=
|
|
||||||
|
|
||||||
pre-start exec install -d -m755 -o pulse -g pulse /run/pulse
|
|
||||||
|
|
||||||
exec /usr/bin/pulseaudio --system --daemonize --high-priority --log-target=syslog --disallow-exit --disallow-module-loading=$DISALLOW_MODULE_LOADING $PULSEAUDIO_ARGS
|
|
||||||
|
|
||||||
post-start script
|
|
||||||
if [ -e /var/run/pulse/.esd_auth ]; then
|
|
||||||
chown pulse:pulse-access /var/run/pulse/.esd_auth
|
|
||||||
chmod 640 /var/run/pulse/.esd_auth
|
|
||||||
fi
|
|
||||||
if [ -e /var/run/pulse/.pulse-cookie ]; then
|
|
||||||
chown pulse:pulse-access /var/run/pulse/.pulse-cookie
|
|
||||||
chmod 640 /var/run/pulse/.pulse-cookie
|
|
||||||
fi
|
|
||||||
end script
|
|
@ -1,16 +0,0 @@
|
|||||||
# {{ ansible_managed }}
|
|
||||||
[global]
|
|
||||||
security = domain
|
|
||||||
netbios name = {{ ansible_hostname }}
|
|
||||||
password server = {{ ansible_local.domain.serverfqdn }}
|
|
||||||
workgroup = {{ ansible_local.domain.domainshort }}
|
|
||||||
idmap uid = 10000000-19999999
|
|
||||||
idmap gid = 10000000-19999999
|
|
||||||
winbind enum users = yes
|
|
||||||
winbind enum groups = yes
|
|
||||||
winbind use default domain = yes
|
|
||||||
winbind expand groups = 1
|
|
||||||
template shell = /bin/bash
|
|
||||||
template homedir = /home/%D/%U
|
|
||||||
domain master = no
|
|
||||||
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u
|
|
@ -1,6 +0,0 @@
|
|||||||
# {{ ansible_managed }}
|
|
||||||
# Autorizzazione per gli utenti di dominio
|
|
||||||
%domain\ admins ALL=(ALL:ALL) NOPASSWD:ALL
|
|
||||||
%{{ ansible_local.domain.domainshort }}\\domain\ admins ALL=(ALL:ALL) NOPASSWD:ALL
|
|
||||||
%domopers ALL=(ALL:ALL) ALL
|
|
||||||
%{{ ansible_local.domain.domainshort }}\\domopers ALL=(ALL:ALL) ALL
|
|
3
roles/doraemon/defaults/main.yml
Normal file
3
roles/doraemon/defaults/main.yml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
doraemon_pkg: doraemon
|
||||||
|
doraemon_version: 1.2.0-1
|
15
roles/doraemon/tasks/doraemon.yml
Normal file
15
roles/doraemon/tasks/doraemon.yml
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
# Installa e configura il servizio per rinominare il client
|
||||||
|
# Grazie per il servizio a Enrico Bacis
|
||||||
|
|
||||||
|
# Considerando di aver creato il repo, viene comunque installata l'ultima versione disponibile
|
||||||
|
|
||||||
|
- name: Installazione doraemon
|
||||||
|
yum:
|
||||||
|
pkg: "{{ doraemon_pkg }}"
|
||||||
|
state: latest
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Verifico avvio di doraemon
|
||||||
|
service: name=doraemon state=restarted
|
||||||
|
become: yes
|
3
roles/doraemon/tasks/main.yml
Normal file
3
roles/doraemon/tasks/main.yml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
- include: doraemon.yml
|
||||||
|
tags: doraemon
|
3
roles/git-daemon/defaults/main.yml
Normal file
3
roles/git-daemon/defaults/main.yml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
client_gitrepo: "https://github.com/bglug-it/client-pull-installation.git"
|
||||||
|
client_gitbranch: master
|
1
roles/git-daemon/files/git-daemon-crontab
Normal file
1
roles/git-daemon/files/git-daemon-crontab
Normal file
@ -0,0 +1 @@
|
|||||||
|
@daily git-daemon pushd /var/lib/git-daemon/repositories/client-pull-installation.git; git fetch -p origin; popd
|
64
roles/git-daemon/files/git-daemon-init
Normal file
64
roles/git-daemon/files/git-daemon-init
Normal file
@ -0,0 +1,64 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
#
|
||||||
|
# Startup/shutdown script for Git Daemon
|
||||||
|
# chkconfig: 345 56 10
|
||||||
|
#
|
||||||
|
# description: Startup/shutdown script for Git Daemon
|
||||||
|
#
|
||||||
|
# Taken from: https://gist.github.com/esoupy/3823712
|
||||||
|
. /etc/init.d/functions
|
||||||
|
|
||||||
|
DAEMON=/usr/libexec/git-core/git-daemon
|
||||||
|
USER=git-daemon
|
||||||
|
GROUP=git
|
||||||
|
BASE_PATH=/var/lib/git-daemon/repositories
|
||||||
|
ARGS="--user=$USER --group=$GROUP --detach --base-path=$BASE_PATH"
|
||||||
|
prog=git-daemon
|
||||||
|
|
||||||
|
start () {
|
||||||
|
echo -n $"Starting $prog: "
|
||||||
|
|
||||||
|
# start daemon
|
||||||
|
daemon $DAEMON $ARGS
|
||||||
|
RETVAL=$?
|
||||||
|
echo
|
||||||
|
[ $RETVAL = 0 ] && touch /var/lock/git-daemon
|
||||||
|
return $RETVAL
|
||||||
|
}
|
||||||
|
|
||||||
|
stop () {
|
||||||
|
# stop daemon
|
||||||
|
|
||||||
|
echo -n $"Stopping $prog: "
|
||||||
|
killproc $DAEMON
|
||||||
|
RETVAL=$?
|
||||||
|
echo
|
||||||
|
[ $RETVAL = 0 ] && rm -f /var/lock/git-daemon
|
||||||
|
}
|
||||||
|
|
||||||
|
restart() {
|
||||||
|
stop
|
||||||
|
start
|
||||||
|
}
|
||||||
|
|
||||||
|
case $1 in
|
||||||
|
start)
|
||||||
|
start
|
||||||
|
;;
|
||||||
|
stop)
|
||||||
|
stop
|
||||||
|
;;
|
||||||
|
restart)
|
||||||
|
restart
|
||||||
|
;;
|
||||||
|
status)
|
||||||
|
status $DAEMON
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo $"Usage: $prog {start|stop|restart|status}"
|
||||||
|
exit 3
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
exit $RETVAL
|
140
roles/git-daemon/tasks/git-daemon.yml
Normal file
140
roles/git-daemon/tasks/git-daemon.yml
Normal file
@ -0,0 +1,140 @@
|
|||||||
|
---
|
||||||
|
# Configura e lancia il servizio git-daemon per servire i repository locali
|
||||||
|
|
||||||
|
- name: Installo git-daemon
|
||||||
|
yum: pkg=git-daemon state=present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Creazione gruppo git
|
||||||
|
group:
|
||||||
|
name: git
|
||||||
|
system: yes
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Creazione utente git-daemon
|
||||||
|
user:
|
||||||
|
name: git-daemon
|
||||||
|
system: yes
|
||||||
|
group: git
|
||||||
|
home: /var/lib/git-daemon
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Creo directory repositories
|
||||||
|
file:
|
||||||
|
path: /var/lib/git-daemon/repositories
|
||||||
|
state: directory
|
||||||
|
become: yes
|
||||||
|
become_user: git-daemon
|
||||||
|
|
||||||
|
- name: Verifica presenza repo
|
||||||
|
shell: test -d /var/lib/git-daemon/repositories/client-pull-installation.git
|
||||||
|
register: chk_clientpullinstall_repo
|
||||||
|
changed_when: chk_clientpullinstall_repo.rc != 0
|
||||||
|
ignore_errors: yes
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- git-daemon-update
|
||||||
|
|
||||||
|
- name: Aggiorno il repo se già esistente
|
||||||
|
shell: pushd /var/lib/git-daemon/repositories/client-pull-installation.git; git fetch -p origin; popd
|
||||||
|
become: yes
|
||||||
|
become_user: git-daemon
|
||||||
|
when: chk_clientpullinstall_repo|success
|
||||||
|
tags:
|
||||||
|
- git-daemon-update
|
||||||
|
|
||||||
|
# E' in forma di shell perché non c'è modo di passare ad ansible
|
||||||
|
# il parametro --mirror
|
||||||
|
- name: Clono il repository client-pull-installation
|
||||||
|
shell: git clone --mirror {{ client_gitrepo }} /var/lib/git-daemon/repositories/client-pull-installation.git
|
||||||
|
become: yes
|
||||||
|
become_user: git-daemon
|
||||||
|
when: chk_clientpullinstall_repo|changed
|
||||||
|
|
||||||
|
- name: Rendo il repository esportabile
|
||||||
|
file:
|
||||||
|
path: /var/lib/git-daemon/repositories/client-pull-installation.git/git-daemon-export-ok
|
||||||
|
state: touch
|
||||||
|
become: yes
|
||||||
|
become_user: git-daemon
|
||||||
|
tags:
|
||||||
|
- git-daemon-update
|
||||||
|
|
||||||
|
- name: Installo task di cron per aggiornamento repo
|
||||||
|
copy:
|
||||||
|
src: git-daemon-crontab
|
||||||
|
dest: /etc/cron.d/git-daemon
|
||||||
|
mode: 0644
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Installo l'init
|
||||||
|
copy:
|
||||||
|
src: git-daemon-init
|
||||||
|
dest: /etc/init.d/git-daemon
|
||||||
|
mode: 0755
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Configuro l'avvio di git-daemon
|
||||||
|
shell: /sbin/chkconfig --add git-daemon
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Verifica aggiunta servizio
|
||||||
|
shell: /sbin/e-smith/db configuration show git-daemon
|
||||||
|
become: yes
|
||||||
|
register: chk_gitdaemon_srv
|
||||||
|
changed_when: chk_gitdaemon_srv.rc != 0
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: Aggiungo servizio a gestione NethServer
|
||||||
|
shell: /sbin/e-smith/db configuration set git-daemon service status enabled TCPPort 9418 access private
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
||||||
|
|
||||||
|
- name: Creazione directory defaults per NethServer
|
||||||
|
file:
|
||||||
|
path: /etc/e-smith/db/configuration/defaults/git-daemon
|
||||||
|
recurse: yes
|
||||||
|
state: directory
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
||||||
|
|
||||||
|
- name: Creazione tipo default per NethServer
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/e-smith/db/configuration/defaults/git-daemon/type
|
||||||
|
regexp: "^service"
|
||||||
|
line: "service"
|
||||||
|
create: yes
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
||||||
|
|
||||||
|
- name: Creazione stato default per NethServer
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/e-smith/db/configuration/defaults/git-daemon/status
|
||||||
|
regexp: "^enabled"
|
||||||
|
line: "enabled"
|
||||||
|
create: yes
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
||||||
|
|
||||||
|
- name: Aggiunta servizio
|
||||||
|
shell: /sbin/e-smith/signal-event runlevel-adjust
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
||||||
|
|
||||||
|
- name: Aggiunta servizio di rete e cambio firewall
|
||||||
|
shell: /sbin/e-smith/signal-event firewall-adjust
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
||||||
|
|
||||||
|
- name: Avvio servizio
|
||||||
|
shell: service git-daemon start
|
||||||
|
become: yes
|
||||||
|
when: chk_gitdaemon_srv|changed
|
9
roles/git-daemon/tasks/initvars.yml
Normal file
9
roles/git-daemon/tasks/initvars.yml
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Overriding default gitrepo if defined in domain.yml
|
||||||
|
set_fact: client_gitrepo="{{ ansible_local.domain.client_gitrepo }}"
|
||||||
|
when: "ansible_local.domain.client_gitrepo is defined"
|
||||||
|
|
||||||
|
- name: Overriding default gitbranch if defined in domain.yml
|
||||||
|
set_fact: client_gitbranch="{{ ansible_local.domain.client_gitbranch }}"
|
||||||
|
when: "ansible_local.domain.client_gitbranch is defined"
|
7
roles/git-daemon/tasks/main.yml
Normal file
7
roles/git-daemon/tasks/main.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- include: initvars.yml
|
||||||
|
tags: git-daemon
|
||||||
|
|
||||||
|
- include: git-daemon.yml
|
||||||
|
tags: git-daemon
|
4
roles/init/defaults/main.yml
Normal file
4
roles/init/defaults/main.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_ssh_user: root
|
||||||
|
admin_sshkey: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
|
22
roles/init/tasks/domaininfo.yml
Normal file
22
roles/init/tasks/domaininfo.yml
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
---
|
||||||
|
# Copia le configurazioni per il dominio in locale sul server.
|
||||||
|
- name: Copia le configurazioni di dominio.
|
||||||
|
copy: src=../../../domain.yml dest=/etc/domain.yml force=yes
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Creo la cartella per le configurazioni di Ansible
|
||||||
|
file: path=/etc/ansible/facts.d state=directory owner=root mode=0755
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Installo PyYAML, necessario per i facts
|
||||||
|
yum:
|
||||||
|
name: PyYAML
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Utilizzo un piccolo wrapper per passare come fatti informazioni di dominio
|
||||||
|
copy: src=domain.fact dest=/etc/ansible/facts.d/domain.fact mode=0755 owner=root
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Rileggo i fatti per essere sicuri che vengano utilizzati
|
||||||
|
setup: filter=ansible_local
|
@ -1,42 +0,0 @@
|
|||||||
---
|
|
||||||
# Initialization task (for simpler ansible management)
|
|
||||||
|
|
||||||
- name: Setting up sudoers for root
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/sudoers.d/root
|
|
||||||
regexp: "^root.*NOPASSWD"
|
|
||||||
line: "root ALL=(ALL:ALL) NOPASSWD:ALL"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0440
|
|
||||||
create: yes
|
|
||||||
state: present
|
|
||||||
validate: '/usr/sbin/visudo -c -f %s'
|
|
||||||
|
|
||||||
- name: Creating Ansible Management User
|
|
||||||
user:
|
|
||||||
name: amgmt
|
|
||||||
comment: "Ansible Management User"
|
|
||||||
group: users
|
|
||||||
password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
|
|
||||||
shell: /bin/bash
|
|
||||||
state: present
|
|
||||||
generate_ssh_key: yes
|
|
||||||
|
|
||||||
- name: Setting up sudoers for Ansible Management User
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/sudoers.d/amgmt
|
|
||||||
regexp: "^amgmt.*NOPASSWD"
|
|
||||||
line: "amgmt ALL=(ALL:ALL) NOPASSWD:ALL"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0440
|
|
||||||
create: yes
|
|
||||||
state: present
|
|
||||||
validate: '/usr/sbin/visudo -c -f %s'
|
|
||||||
|
|
||||||
- name: Authorizing Ansible Management User's key from server
|
|
||||||
authorized_key:
|
|
||||||
user: amgmt
|
|
||||||
key: "{{ lookup('pipe', 'curl -sSL http://' + ansible_local.domain.serverfqdn + ':3000/mgmtkey') }}"
|
|
||||||
state: present
|
|
@ -1,5 +1,11 @@
|
|||||||
---
|
---
|
||||||
|
# Task basilari per la prima configurazione
|
||||||
|
- include: selinux-binding.yml
|
||||||
|
when: ansible_os_family == "RedHat"
|
||||||
|
|
||||||
- include: init.yml
|
- include: yum-utils.yml
|
||||||
tags:
|
|
||||||
- init
|
- include: mgmtuser.yml
|
||||||
|
|
||||||
|
- include: domaininfo.yml
|
||||||
|
tags: domaininfo
|
||||||
|
23
roles/init/tasks/mgmtuser.yml
Normal file
23
roles/init/tasks/mgmtuser.yml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- name: Creazione account di gestione Ansible
|
||||||
|
user:
|
||||||
|
name: amgmt
|
||||||
|
comment: "Ansible Management User"
|
||||||
|
group: wheel
|
||||||
|
state: present
|
||||||
|
password: $6$mVKMBMbAxeql$eqSe8tu2qKjtwmpiFy07b6nv2g4F80N.U9EzOmQTrNZwKZ61n6NLrSEQHQo1FOlQghOiB8as6Z35oTUUKN8y2.
|
||||||
|
|
||||||
|
- name: Concessione diritti all'utente di gestione Ansible
|
||||||
|
template:
|
||||||
|
src: sudoers.d
|
||||||
|
dest: /etc/sudoers.d/amgmt
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0440
|
||||||
|
validate: "/usr/sbin/visudo -cf %s"
|
||||||
|
|
||||||
|
- name: Installazione chiave privata PC locale
|
||||||
|
authorized_key:
|
||||||
|
user: amgmt
|
||||||
|
key: "{{ lookup('file', admin_sshkey) }}"
|
||||||
|
state: present
|
4
roles/init/tasks/selinux-binding.yml
Normal file
4
roles/init/tasks/selinux-binding.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
# Preconfigurazione selinux per host
|
||||||
|
- name: Binding Python per selinux
|
||||||
|
yum: name=libselinux-python state=present
|
5
roles/init/tasks/yum-utils.yml
Normal file
5
roles/init/tasks/yum-utils.yml
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
- name: Installing yum-utils to enable repositories
|
||||||
|
yum:
|
||||||
|
name: yum-utils
|
||||||
|
state: present
|
3
roles/init/templates/sudoers.d
Normal file
3
roles/init/templates/sudoers.d
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
# {{ ansible_managed }}
|
||||||
|
# Autorizzazione di gestione per l'utente di ansible
|
||||||
|
amgmt ALL=(ALL:ALL) NOPASSWD:ALL
|
6
roles/nethcfg/defaults/main.yml
Normal file
6
roles/nethcfg/defaults/main.yml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
extnic: wan0
|
||||||
|
intnic: lan0
|
||||||
|
force_regen_ca: false
|
||||||
|
force_ibay_shared: false
|
||||||
|
development: false
|
86
roles/nethcfg/tasks/base.yml
Normal file
86
roles/nethcfg/tasks/base.yml
Normal file
@ -0,0 +1,86 @@
|
|||||||
|
---
|
||||||
|
# Base configurations to be implemented anyways.
|
||||||
|
|
||||||
|
# installing italian interface translation
|
||||||
|
|
||||||
|
- name: Making available also Italian NethGUI
|
||||||
|
yum:
|
||||||
|
pkg: nethserver-lang-it
|
||||||
|
state: present
|
||||||
|
tags: nethgui
|
||||||
|
|
||||||
|
# Trusted networks: LAN
|
||||||
|
|
||||||
|
- name: Check for LAN to be added as Trusted Network
|
||||||
|
shell: /sbin/e-smith/db networks printprop {{ ansible_local.domain.servernet }} Description
|
||||||
|
register: check_trusted
|
||||||
|
changed_when: '"Description=Local LAN" not in check_trusted.stdout'
|
||||||
|
ignore_errors: yes
|
||||||
|
tags: trustednet
|
||||||
|
|
||||||
|
- name: Configuring trusted networks
|
||||||
|
shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }}
|
||||||
|
when: check_trusted|changed
|
||||||
|
tags: trustednet
|
||||||
|
|
||||||
|
- name: Activating trusted network
|
||||||
|
shell: /sbin/e-smith/signal-event trusted-networks-modify
|
||||||
|
when: check_trusted|changed
|
||||||
|
tags: trustednet
|
||||||
|
|
||||||
|
# Preconfiguring DNS anyways
|
||||||
|
|
||||||
|
- name: Checking DNS configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop dns NameServers
|
||||||
|
register: chk_dns
|
||||||
|
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout"
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: Configuring DNS resolution
|
||||||
|
shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}
|
||||||
|
when: chk_dns|changed
|
||||||
|
tags: dns-preset
|
||||||
|
|
||||||
|
- name: Activating correct DNS resolution
|
||||||
|
shell: "/sbin/e-smith/signal-event nethserver-base-update"
|
||||||
|
when: chk_dns|changed
|
||||||
|
|
||||||
|
# Hostname and domainname
|
||||||
|
|
||||||
|
- name: Configuring hostname
|
||||||
|
shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }}
|
||||||
|
register: chg_hostname
|
||||||
|
when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'"
|
||||||
|
tags: hostname
|
||||||
|
|
||||||
|
- name: Configuring domain name
|
||||||
|
shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }}
|
||||||
|
register: chg_domainname
|
||||||
|
when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'"
|
||||||
|
tags: domainname
|
||||||
|
|
||||||
|
- name: Activating hostname/domainname changes
|
||||||
|
shell: /sbin/e-smith/signal-event hostname-modify
|
||||||
|
when: chg_hostname|changed or chg_domainname|changed
|
||||||
|
tags:
|
||||||
|
- hostname
|
||||||
|
- domainname
|
||||||
|
|
||||||
|
# Base certificate
|
||||||
|
|
||||||
|
- name: Checking CA configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop pki CommonName
|
||||||
|
ignore_errors: true
|
||||||
|
register: chk_crt
|
||||||
|
changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout"
|
||||||
|
tags: regen-ca
|
||||||
|
|
||||||
|
- name: Configuring CA
|
||||||
|
shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}"
|
||||||
|
tags: regen-ca
|
||||||
|
when: chk_crt|changed or force_regen_ca|bool
|
||||||
|
|
||||||
|
- name: Activating CA and regenerate
|
||||||
|
shell: /sbin/e-smith/signal-event certificate-update
|
||||||
|
when: chk_crt|changed or force_regen_ca|bool
|
||||||
|
tags: regen-ca
|
52
roles/nethcfg/tasks/dhcpdns.yml
Normal file
52
roles/nethcfg/tasks/dhcpdns.yml
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
---
|
||||||
|
# Installing and configuring DHCP and DNS
|
||||||
|
|
||||||
|
- name: Installing DHCP and DNS related NethServer packages.
|
||||||
|
yum:
|
||||||
|
name: nethserver-dnsmasq
|
||||||
|
state: present
|
||||||
|
|
||||||
|
# DHCP
|
||||||
|
|
||||||
|
- name: Checking DHCP configuration
|
||||||
|
shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart
|
||||||
|
ignore_errors: true
|
||||||
|
register: chk_dhcp
|
||||||
|
|
||||||
|
- name: Configuring DHCP
|
||||||
|
shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled
|
||||||
|
when: chk_dhcp|failed
|
||||||
|
|
||||||
|
- name: Activating DHCP
|
||||||
|
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
|
||||||
|
when: chk_dhcp|failed
|
||||||
|
|
||||||
|
# DNS
|
||||||
|
# Already preconfigured before (roles/nethcfg/tasks/base.yml)
|
||||||
|
# reforcing the resolver addresses to the ones configured
|
||||||
|
|
||||||
|
- name: Checking DNS configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop dns NameServers
|
||||||
|
register: chk_dns
|
||||||
|
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout"
|
||||||
|
tags: force-resolvers
|
||||||
|
|
||||||
|
- name: Configuring DNS resolution
|
||||||
|
shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}
|
||||||
|
when: chk_dns|changed
|
||||||
|
tags: force-resolvers
|
||||||
|
|
||||||
|
- name: Activating correct DNS resolution
|
||||||
|
shell: "/sbin/e-smith/signal-event nethserver-{{ item }}-update"
|
||||||
|
with_items:
|
||||||
|
- base
|
||||||
|
- dnsmasq
|
||||||
|
when: chk_dns|changed
|
||||||
|
tags: force-resolvers
|
||||||
|
|
||||||
|
# Avahi
|
||||||
|
|
||||||
|
- name: Installing avahi-daemon
|
||||||
|
yum:
|
||||||
|
name: nethserver-avahi
|
||||||
|
state: present
|
42
roles/nethcfg/tasks/directory.yml
Normal file
42
roles/nethcfg/tasks/directory.yml
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
---
|
||||||
|
# Organization
|
||||||
|
|
||||||
|
- name: Installing required packages
|
||||||
|
yum:
|
||||||
|
pkg: nethserver-directory
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Check organization configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop OrganizationContact City
|
||||||
|
register: check_org
|
||||||
|
changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout"
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
# Password policy
|
||||||
|
|
||||||
|
- name: Check for password policy
|
||||||
|
shell: /sbin/e-smith/db configuration printprop passwordstrength Users
|
||||||
|
register: chk_passstr
|
||||||
|
changed_when: "'Users=none' not in chk_passstr.stdout"
|
||||||
|
ignore_errors: true
|
||||||
|
tags: password-policy
|
||||||
|
|
||||||
|
- name: Configuring password policy
|
||||||
|
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
|
||||||
|
when: chk_passstr|changed
|
||||||
|
tags: password-policy
|
||||||
|
|
||||||
|
- name: Activating password policy
|
||||||
|
shell: /sbin/e-smith/signal-event password-policy-update
|
||||||
|
when: chk_passstr|changed
|
||||||
|
tags: password-policy
|
||||||
|
|
||||||
|
# Organization configuration
|
||||||
|
|
||||||
|
- name: Configuring organization
|
||||||
|
shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}"
|
||||||
|
when: check_org|changed
|
||||||
|
|
||||||
|
- name: Activating organization configuration
|
||||||
|
shell: /sbin/e-smith/signal-event organization-save
|
||||||
|
when: check_org|changed
|
47
roles/nethcfg/tasks/domain_groups.yml
Normal file
47
roles/nethcfg/tasks/domain_groups.yml
Normal file
@ -0,0 +1,47 @@
|
|||||||
|
---
|
||||||
|
# Domain groups
|
||||||
|
|
||||||
|
# Domain Users
|
||||||
|
|
||||||
|
- name: domusers - Checking for group
|
||||||
|
shell: /sbin/e-smith/db accounts show domusers
|
||||||
|
register: check_domusers
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: domusers - Creating new group
|
||||||
|
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
|
||||||
|
when: check_domusers|failed
|
||||||
|
|
||||||
|
- name: domusers - Activating group
|
||||||
|
shell: /sbin/e-smith/signal-event group-create domusers
|
||||||
|
when: check_domusers|failed
|
||||||
|
|
||||||
|
# Domain Operators
|
||||||
|
|
||||||
|
- name: domopers - Checking for group
|
||||||
|
shell: /sbin/e-smith/db accounts show domopers
|
||||||
|
register: check_domopers
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: domopers - Creating new group
|
||||||
|
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
|
||||||
|
when: check_domopers|failed
|
||||||
|
|
||||||
|
- name: domopers - Activating group
|
||||||
|
shell: /sbin/e-smith/signal-event group-create domopers
|
||||||
|
when: check_domopers|failed
|
||||||
|
|
||||||
|
# Docenti
|
||||||
|
|
||||||
|
- name: docenti - Checking for group
|
||||||
|
shell: /sbin/e-smith/db accounts show docenti
|
||||||
|
register: check_docenti
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: docenti - Creating new group
|
||||||
|
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
|
||||||
|
when: check_docenti|failed
|
||||||
|
|
||||||
|
- name: docenti - Activating group
|
||||||
|
shell: /sbin/e-smith/signal-event group-create docenti
|
||||||
|
when: check_docenti|failed
|
57
roles/nethcfg/tasks/main.yml
Normal file
57
roles/nethcfg/tasks/main.yml
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
# Configuring NethServer as requested
|
||||||
|
|
||||||
|
# Network interfaces
|
||||||
|
- include: network.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- network
|
||||||
|
|
||||||
|
# Configuring base parameters
|
||||||
|
- include: base.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- base
|
||||||
|
|
||||||
|
- include: ntp.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- ntp
|
||||||
|
|
||||||
|
# Directory and organization
|
||||||
|
- include: directory.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- directory
|
||||||
|
|
||||||
|
# DHCP and DNS
|
||||||
|
- include: dhcpdns.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- dhcpdns
|
||||||
|
|
||||||
|
# Other small services
|
||||||
|
- include: otherservices.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- otherservices
|
||||||
|
|
||||||
|
# Proxy and web filter
|
||||||
|
- include: proxy.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- proxy
|
||||||
|
- webfilter
|
||||||
|
|
||||||
|
# SAMBA and ibays
|
||||||
|
- include: samba.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- samba
|
||||||
|
- ibay
|
||||||
|
|
||||||
|
# Domain groups
|
||||||
|
- include: domain_groups.yml
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- domaingroups
|
11
roles/nethcfg/tasks/network.yml
Normal file
11
roles/nethcfg/tasks/network.yml
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
# Reconfiguring network interfaces
|
||||||
|
|
||||||
|
- name: Configuring external NIC
|
||||||
|
shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp
|
||||||
|
|
||||||
|
- name: Configuring internal NIC
|
||||||
|
shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }}
|
||||||
|
|
||||||
|
- name: Activating changes to NICs
|
||||||
|
shell: /sbin/e-smith/signal-event interface-update
|
24
roles/nethcfg/tasks/ntp.yml
Normal file
24
roles/nethcfg/tasks/ntp.yml
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
---
|
||||||
|
# Network time protocol
|
||||||
|
|
||||||
|
- name: Installing NTP related packages.
|
||||||
|
yum:
|
||||||
|
name: nethserver-ntp
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Checking for NTP Configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop ntpd NTPServer
|
||||||
|
become: yes
|
||||||
|
register: chk_ntp
|
||||||
|
changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout"
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: Configuring NTP
|
||||||
|
shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled
|
||||||
|
become: yes
|
||||||
|
when: chk_ntp|changed
|
||||||
|
|
||||||
|
- name: Activating NTP
|
||||||
|
shell: /sbin/e-smith/signal-event nethserver-ntp-update
|
||||||
|
become: yes
|
||||||
|
when: chk_ntp|changed
|
15
roles/nethcfg/tasks/otherservices.yml
Normal file
15
roles/nethcfg/tasks/otherservices.yml
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
# Installation and configuration of small services
|
||||||
|
|
||||||
|
- name: Installing other small services
|
||||||
|
yum:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
with_items:
|
||||||
|
- nethserver-cups
|
||||||
|
- nethserver-collectd
|
||||||
|
- nethserver-collectd-web
|
||||||
|
- nethserver-firewall-base
|
||||||
|
- nethserver-firewall-base-ui
|
||||||
|
- nethserver-backup-config
|
||||||
|
- nethserver-backup-data
|
79
roles/nethcfg/tasks/proxy.yml
Normal file
79
roles/nethcfg/tasks/proxy.yml
Normal file
@ -0,0 +1,79 @@
|
|||||||
|
---
|
||||||
|
# Proxy and webfiltering configurations
|
||||||
|
|
||||||
|
- name: Installing proxy-related packages
|
||||||
|
yum:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
with_items:
|
||||||
|
- nethserver-squid
|
||||||
|
- nethserver-squidclamav
|
||||||
|
- nethserver-squidguard
|
||||||
|
|
||||||
|
# Squid
|
||||||
|
|
||||||
|
- name: Checking squid configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop squid DiskCacheSize
|
||||||
|
ignore_errors: yes
|
||||||
|
register: chk_squid
|
||||||
|
changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout"
|
||||||
|
|
||||||
|
- name: Configuring Squid
|
||||||
|
shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000
|
||||||
|
when: chk_squid|changed
|
||||||
|
|
||||||
|
- name: Activating Squid configuration
|
||||||
|
shell: /sbin/e-smith/signal-event nethserver-squid-update
|
||||||
|
when: chk_squid|changed
|
||||||
|
|
||||||
|
# Squid-clamav
|
||||||
|
|
||||||
|
- name: Checking squidclamav configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop squidclamav status
|
||||||
|
ignore_errors: true
|
||||||
|
register: chk_squidclamav
|
||||||
|
changed_when: "'status=enabled' not in chk_squidclamav.stdout"
|
||||||
|
|
||||||
|
- name: Configuring squidclamav
|
||||||
|
shell: /sbin/e-smith/db configuration setprop squidclamav status enabled
|
||||||
|
when: chk_squidclamav|changed
|
||||||
|
|
||||||
|
- name: Activating squidclamav
|
||||||
|
shell: /sbin/e-smith/signal-event nethserver-squidclamav-update
|
||||||
|
when: chk_squidclamav|changed
|
||||||
|
|
||||||
|
# SquidGuard
|
||||||
|
|
||||||
|
- name: Verifying squidguard configuration
|
||||||
|
shell: /sbin/e-smith/db configuration printprop squidguard status
|
||||||
|
register: check_squidguard
|
||||||
|
ignore_errors: true
|
||||||
|
changed_when: '"status=enabled" not in check_squidguard.stdout'
|
||||||
|
|
||||||
|
- name: Configuring squidguard
|
||||||
|
shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled
|
||||||
|
when: check_squidguard|changed
|
||||||
|
|
||||||
|
- name: Activating squidguard configuration
|
||||||
|
shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}"
|
||||||
|
with_items:
|
||||||
|
- save
|
||||||
|
- update
|
||||||
|
- downloadlists
|
||||||
|
when: check_squidguard|changed
|
||||||
|
|
||||||
|
# Content filtering settings
|
||||||
|
|
||||||
|
- name: Verifying content filtering
|
||||||
|
shell: /sbin/e-smith/db contentfilter printprop default Categories
|
||||||
|
register: check_cf
|
||||||
|
changed_when: "'sex' not in check_cf.stdout"
|
||||||
|
|
||||||
|
- name: Configuring content filtering
|
||||||
|
shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez
|
||||||
|
register: cf_cat
|
||||||
|
when: check_cf|changed
|
||||||
|
|
||||||
|
- name: Activating content filtering as a whole
|
||||||
|
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
|
||||||
|
when: check_cf|changed
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user