Compare commits

...

No commits in common. "master" and "salerno1.ilariaalpi" have entirely different histories.

181 changed files with 3348 additions and 1497 deletions

7
.gitignore vendored
View File

@ -1,3 +1,4 @@
update-repo.sh
Vagrantfile
box-provisioning/**
*.swp
*.box
.vagrant/*
*.patch

View File

@ -1,17 +1,55 @@
# Ansible-pull configuration playbook for domain clients #
# Ansible playbooks for a SAMBA domain controller with NethServer #
## Progetto Scuola - [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG logo" /> BgLUG][bglug] - Scenario 1 ##
## Progetto Scuola [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG Logo" /> BgLUG][bglug] - Scenary 1 ##
Configurations for [Ubuntu][ubuntu] client (or better, [Edubuntu][edubuntu])
inside a [SAMBA][samba] 3.0 domain with [NethServer][nethserver].
Starting from a [NethServer][] configured machine (please check out the
[wiki][] for the installation process from [CentOS][] and other requirements),
these playbooks provision a [SAMBA][] 3.0 domain controller which can be used
with a network of Ubuntu clients.
The files in this repository has to be read and executed by `ansible-pull`
(please check it out from [Ansible][ansible]) from the client, right after the
first installation via PXE and using custom kickstart files.
Using the default settings, it will also provide an environment to boot from
network, install and configure the clients, using a local copy of Ubuntu's
repositories.
[bglug]: http://bglug.it "BgLUG Homepage"
[ubuntu]: http://www.ubuntu.com
[edubuntu]: http://www.edubuntu.com
[nethserver]: http://www.nethserver.org
[samba]: http://www.samba.org
### Quick start ###
You may use these playbooks as follows:
$ vim hosts
$ vim domain.yml
$ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub"
$ ansible-playbook setup.yml
Or, more simply:
$ bash run.sh
### Use [Vagrant][] for testing purposes ###
You may use the included `Vagrantfile` to do any tests before deploying the
machine. `vagrant` and `ansible` must be installed on the host machine, then
you may run the following commands:
$ cd /path/to/server-config
$ vagrant up
Update 14/06/2015: some basic configurations to the Vagrant box are now
provisioned via Ansible, thus making it a dependency.
Update 25/06/2015: the Vagrant box now uses a *host-only* interface instead of
a *bridged* one. If you built a Vagrant box before this date, please destroy
it, recreate a new one and reprovision it with the provided playbooks.
### To Do List ###
* Implement backup
* Detail physical installation procedure for the server machine within the
Wiki.
[bglug]: http://bglug.it/ "BgLUG Homepage"
[wiki]: https://github.com/bglug-it/server-config/wiki "server-config wiki"
[ansible]: http://www.ansible.com
[nethserver]: http://www.nethserver.org
[vagrant]: http://www.vagrantup.com
[samba]: https://www.samba.org
[centos]: https://www.centos.org

133
Vagrantfile vendored Normal file
View File

@ -0,0 +1,133 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
VAGRANTFILE_API_VERSION = "2"
Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
# All Vagrant configuration is done here. The most common configuration
# options are documented and commented below. For a complete reference,
# please see the online documentation at vagrantup.com.
# Every Vagrant virtual environment requires a box to build off of.
config.vm.box = "syntaxerrormmm/nethserver-6.9"
config.vm.box_url = "https://vagrant.libreschool.org/nethserver-6.9"
config.vm.define "NethServer" do |nethserver|
end
config.vm.provider :virtualbox do |vb|
vb.name = "NethServer"
end
# Disable automatic box update checking. If you disable this, then
# boxes will only be checked for updates when the user runs
# `vagrant box outdated`. This is not recommended.
# config.vm.box_check_update = false
# Create a forwarded port mapping which allows access to a specific port
# within the machine from a port on the host machine. In the example below,
# accessing "localhost:8080" will access port 80 on the guest machine.
# config.vm.network "forwarded_port", guest: 80, host: 8080
# Create a private network, which allows host-only access to the machine
# using a specific IP.
# config.vm.network "private_network", ip: "192.168.33.10"
config.vm.network "private_network", ip: "172.16.254.1", auto_config: false
# Create a public network, which generally matched to bridged network.
# Bridged networks make the machine appear as another physical device on
# your network.
# config.vm.network "public_network"
# If true, then any SSH connections made will enable agent forwarding.
# Default value: false
# config.ssh.forward_agent = true
# Share an additional folder to the guest VM. The first argument is
# the path on the host to the actual folder. The second argument is
# the path on the guest to mount the folder. And the optional third
# argument is a set of non-required options.
# config.vm.synced_folder "../data", "/vagrant_data"
# Provider-specific configuration so you can fine-tune various
# backing providers for Vagrant. These expose provider-specific options.
# Example for VirtualBox:
#
# config.vm.provider "virtualbox" do |vb|
# # Don't boot with headless mode
# vb.gui = true
#
# # Use VBoxManage to customize the VM. For example to change memory:
# #vb.customize ["modifyvm", :id, "--memory", "1024"]
# end
#
# View the documentation for the provider you're using for more
# information on available options.
# Enable provisioning with CFEngine. CFEngine Community packages are
# automatically installed. For example, configure the host as a
# policy server and optionally a policy file to run:
#
# config.vm.provision "cfengine" do |cf|
# cf.am_policy_hub = true
# # cf.run_file = "motd.cf"
# end
#
# You can also configure and bootstrap a client to an existing
# policy server:
#
# config.vm.provision "cfengine" do |cf|
# cf.policy_server_address = "10.0.2.15"
# end
# Enable provisioning with Puppet stand alone. Puppet manifests
# are contained in a directory path relative to this Vagrantfile.
# You will need to create the manifests directory and a manifest in
# the file default.pp in the manifests_path directory.
#
# config.vm.provision "puppet" do |puppet|
# puppet.manifests_path = "manifests"
# puppet.manifest_file = "default.pp"
# end
# Enable provisioning with chef solo, specifying a cookbooks path, roles
# path, and data_bags path (all relative to this Vagrantfile), and adding
# some recipes and/or roles.
#
# config.vm.provision "chef_solo" do |chef|
# chef.cookbooks_path = "../my-recipes/cookbooks"
# chef.roles_path = "../my-recipes/roles"
# chef.data_bags_path = "../my-recipes/data_bags"
# chef.add_recipe "mysql"
# chef.add_role "web"
#
# # You may also specify custom JSON attributes:
# chef.json = { mysql_password: "foo" }
# end
# Enable provisioning with chef server, specifying the chef server URL,
# and the path to the validation key (relative to this Vagrantfile).
#
# The Opscode Platform uses HTTPS. Substitute your organization for
# ORGNAME in the URL and validation key.
#
# If you have your own Chef Server, use the appropriate URL, which may be
# HTTP instead of HTTPS depending on your configuration. Also change the
# validation key to validation.pem.
#
# config.vm.provision "chef_client" do |chef|
# chef.chef_server_url = "https://api.opscode.com/organizations/ORGNAME"
# chef.validation_key_path = "ORGNAME-validator.pem"
# end
#
# If you're using the Opscode platform, your validator client is
# ORGNAME-validator, replacing ORGNAME with your organization name.
#
# If you have your own Chef Server, the default validation client name is
# chef-validator, unless you changed the configuration.
#
# chef.validation_client_name = "ORGNAME-validator"
config.vm.provision "ansible" do |ansible|
ansible.inventory_path = "provision_hosts"
ansible.playbook = "provision.yml"
end
end

View File

@ -1,5 +1,5 @@
[defaults]
inventory=hosts
log_path=/var/log/ansible.log
host_key_checking=False
become_method=sudo
inventory=hosts
roles_path=roles
pipelining=True

31
domain.yml Normal file
View File

@ -0,0 +1,31 @@
---
# Configurazione dominio
ntpserver: pdc.salerno1.ilariaalpi.edu
server: pdc
serverip: 192.168.4.1
servernetmask: 255.255.255.0
servernet: 192.168.4.0
servergw: 192.168.4.1
serverfqdn: pdc.salerno1.ilariaalpi.edu
domainshort: SALERNO1
domainfull: salerno1.ilariaalpi.edu
dhcprange_start: 192.168.4.10
dhcprange_end: 192.168.4.60
extdnsserver1: 208.67.222.222
extdnsserver2: 208.67.220.220
org_email: miic8dz008@istruzione.it
org_company: Istituto Comprensivo Ilaria Alpi
org_countrycode: IT
org_department: "Laboratorio 1 - via Salerno, 1"
org_city: Milano
org_phone: 02 88444696
org_street: Via Salerno, 1
edu_package: secondary
mirror_mode: local
#mirror_nfs_share: 192.168.255.1:/var/spool/apt-mirror/mirror
mirror_host: it.archive.ubuntu.com
#mirror_path: /ubuntu
#mirror_security_host: security.ubuntu.com
#mirror_security_path: /ubuntu
client_gitbranch: ilariaalpi
client_gitrepo: "https://git.libreschool.org/LibreSchool/client-pull-installation.git"

View File

@ -1,7 +0,0 @@
$ANSIBLE_VAULT;1.1;AES256
34656463636239626332366464373337386539643933653433653362613238666330636334323465
6666373739386430643330666238366237646365623634370a363530303762373036616332313966
31343339373532346538393164373037396135633631653133663862316161373566633938386234
6366613030386432320a313262383838663262373037643138616131343337626234306436323462
64333262663662353836303365316433353463326664623838353339376164313235363339313238
3865613230306436346365623338366564346633343565623964

6
hosts
View File

@ -1 +1,5 @@
localhost ansible_connection=local
[defaults]
host_key_checking=false
[server]
172.16.99.18 ansible_ssh_user=amgmt

View File

@ -0,0 +1,58 @@
# Default password for project #
* NS Box root user: `vagrant`
* NS Box vagrant user: `vagrant`
* Vault Password: `v4ul+Password!`
* amgmt user (server): `DoN0t4g3t!`
* bglug user (client): `s4lamanDr@`
* admin user (domain): `R0busTdom41nPa55wd!`
# How to change passwords for production deployments #
## *root* and *vagrant* users ##
These will not be required, since you will not have a virtual machine to
manage via *Vagrant*.
## Vault password ##
Clone [`client-pull-installation`][2] then, in the working copy, launch following commands:
$ ansible-vault rekey domainpwd.vault
`ansible-vault` will ask one time the old password and two times the new one.
## *amgmt* user (server-side) ##
Clone [`server-config`][1] then, in the working copy, generate a new password hash with the follwing command:
$ mkpasswd -m sha-512
The command would ask for the password to be hashed. Please copy the result string.
Open up the file `roles/init/tasks/mgmtuser.yml`, find out `password:` and then replace previous hash with the one you have just created.
## *bglug* user (client side but preseeded) ##
The definition of password for *bglug* is inside `*.seed` files, inside [`server-config`][1]. Create a new password hash with:
$ mkpasswd -m sha-512
Copy the hash in your clipboard; clone the repository, then in the working directory:
$ find . -iname \*.seed -exec $EDITOR {} \;
Within each `*.seed` file, search for the string `user-password-crypted` string and change following hash.
## *admin* user (domain valid) ##
Password must be specified within NethServer interface for the *admin* user and must be absolutely equal to the one contained inside vault file.
Clone [`client-pull-installation`][2], create new branch and modify the password inside `domainpwd.vault`:
$ ansible-vault edit domainpwd.vault
The system would ask for the vault password. Change the plain text password with your editor.
[1]: https://github.com/bglug-it/server-config
[2]: https://github.com/bglug-it/client-pull-installation

7
init.yml Normal file
View File

@ -0,0 +1,7 @@
---
- hosts: server
vars:
- ansible_ssh_user: root
roles:
- init

View File

@ -1,15 +0,0 @@
---
- hosts: localhost
user: root
vars_files:
- domainpwd.vault
roles:
- prereq
- { role: networkpackagemanager, when: '(ansible_local.domain.disable_npm is not defined or ansible_local.domain.disable_npm|bool == False) and ansible_local.checksum.needs_pkg_run|bool' }
- { role: init, when: 'ansible_local.checksum.needs_repo_run | bool' }
- { role: custom, when: 'ansible_local.checksum.needs_repo_run | bool' }
- { role: remote-control, when: 'ansible_local.checksum.needs_repo_run | bool' }
- { role: domain, when: 'ansible_local.checksum.needs_repo_run | bool' }
environment:
PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

5
ovpn-client.yml Normal file
View File

@ -0,0 +1,5 @@
---
- hosts: server
roles:
- ovpn-client

5
provision.yml Normal file
View File

@ -0,0 +1,5 @@
---
# Vagrant provisioning playbook
- hosts: vagrant
roles:
- rename-nic

3
provision_hosts Normal file
View File

@ -0,0 +1,3 @@
# Generated by Vagrant
[vagrant]
NethServer ansible_ssh_host=127.0.0.1 ansible_ssh_port=2222 ansible_ssh_user=vagrant

View File

@ -0,0 +1,14 @@
/var/log/ansible.log {
rotate 7
daily
compress
missingok
notifempty
}
/var/log/ansible-pull.log {
rotate 7
daily
compress
missingok
notifempty
}

View File

@ -0,0 +1,17 @@
---
- name: Creazione directory per ansible-pull
file: path=/var/lib/nethserver/ibay/ks/ansible-pull state=directory
become: yes
- name: Template
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
with_items:
- init-ansible.sh
- ansible-pull.sh
- getvaultpass.py
- crontab
become: yes
- name: Logrotate
copy: src=logrotate dest=/var/lib/nethserver/ibay/ks/ansible-pull/logrotate
become: yes

View File

@ -0,0 +1,4 @@
---
- include: ansible-pull.yml
tags: ansible-pull

View File

@ -0,0 +1,27 @@
#!/bin/bash
# waiting for dns stack to be ready
while true; do
[[ "$(dig +short {{ ansible_local.domain.serverfqdn }})" == "{{ ansible_local.domain.serverip }}" ]] && break;
done
# Aggiorna crontab e logrotate forzosamente.
echo "$(date --rfc-3339=seconds) Loading and running init-ansible.sh"
/usr/bin/curl -sSL4 http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | /bin/bash
# Script provvisorio.
# Potremmo decidere di far eseguire uno script generato da servizio
# domainhelper contenente anche l'eventuale branch da usare.
url=git://{{ ansible_local.domain.serverfqdn }}/client-pull-installation.git
repo=/var/lib/{{ ansible_local.domain.domainfull }}/config
logfile=/var/lib/ansible-pull.log
branch={{ ansible_local.domain.client_gitbranch }}
playbook=local.yml
echo "$(date --rfc-3339=seconds) Getting vault password"
vaultpassfile=$(/usr/bin/curl -sSL4 http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | /usr/bin/python)
echo "$(date --rfc-3339=seconds) Running ansible-pull"
/usr/bin/ansible-pull --accept-host-key -i localhost -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
rm -f "${vaultpassfile}"

View File

@ -0,0 +1 @@
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1

View File

@ -0,0 +1,30 @@
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from Crypto.Hash import MD5
from Crypto.Cipher import AES
from base64 import b64decode
from requests import get
from socket import gethostname
from tempfile import mkstemp
import time
import os
key = MD5.new(gethostname()).digest()
cipher = AES.new(key, AES.MODE_ECB)
for i in range(10):
try:
base64enc = get("http://{{ ansible_local.domain.serverfqdn }}:3000/vaultpass")
break
except:
time.sleep(1)
encrypted = b64decode(base64enc.content)
longpass = cipher.decrypt(encrypted)
fd, filename = mkstemp()
os.write(fd, longpass.strip('x'))
os.close(fd)
print(filename)

View File

@ -0,0 +1,35 @@
#!/bin/bash
# Fixing base variables.
basedir=/var/lib/{{ ansible_local.domain.domainfull }}
url=git://{{ ansible_local.domain.serverfqdn }}/client-pull-installation.git
branch={{ ansible_local.domain.client_gitbranch }}
# Creo directory dipendenti
echo "$(date --rfc-3339=seconds) Installing bin directory."
/usr/bin/install -d -o root -g users ${basedir}/bin
# Workaround issue #23 - ansible-pull won't pull out of remote the first time.
if [[ ! -f ${basedir}/config/local.yml ]]; then
/usr/bin/git clone -b ${branch} ${url} ${basedir}/config
fi
# Installo ansible-pull.sh
echo "$(date --rfc-3339=seconds) Creating ansible-pull.sh."
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O ${basedir}/bin/ansible-pull.sh
chmod a+x ${basedir}/bin/ansible-pull.sh
# Fixing permissions on the main directory
/bin/chown -R root:users ${basedir}
# Installo il cronjob per ansible-pull
echo "$(date --rfc-3339=seconds) Creating crontab"
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull
/bin/chown root:root /etc/cron.d/ansible-pull
/bin/chmod 0644 /etc/cron.d/ansible-pull
# Installo il logrotate per ansible
echo "$(date --rfc-3339=seconds) Creating logrotate"
/usr/bin/wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull
/bin/chown root:root /etc/logrotate.d/ansible-pull
/bin/chmod 0644 /etc/logrotate.d/ansible-pull

View File

@ -1,23 +0,0 @@
---
base_common_addpkg:
- vim
- screen
- cifs-utils
- ubuntu-edu-secondary
- firefox-locale-it
- libreoffice-l10n-it
- libnss-myhostname
- ubuntu-restricted-extras
base_common_delpkg:
- libnss-mdns
- unity-webapps-common
- zeitgeist-core
- zeitgeist-datahub
base_client_addpkg:
- epoptes-client
base_client_delpkg:
- epoptes
base_docenti_addpkg:
- epoptes
base_docenti_delpkg:
- epoptes-client

View File

@ -1,27 +0,0 @@
---
- name: Checking for installation of ansible
apt:
name: ansible
state: present
- name: Updating ansible-pull custom scripts
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/{{ item }}"
dest: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/{{ item }}"
force: yes
with_items:
- getvaultpass.py
- ansible-pull.sh
- name: Updating crontab for ansible-pull
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab"
dest: /etc/cron.d/ansible-pull
force: yes
- name: Updating logrotate settings for ansible-pull
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate"
dest: /etc/logrotate.d/ansible-pull
force: yes

View File

@ -1,20 +0,0 @@
---
# Manages the installation of the main desktop environment
- name: Checking for desktop environment
shell: 'tasksel --list-tasks | grep "^i edubuntu-desktop-gnome"'
ignore_errors: yes
register: check_edubuntu_pkg
changed_when: check_edubuntu_pkg.rc != 0
tags: edu-install
- name: Installation of the desktop environment
shell: "DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get -y install edubuntu-desktop-gnome^"
when: check_edubuntu_pkg is changed
tags: edu-install
- name: Change default desktop environment
replace:
dest: /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
regexp: "^user-session=ubuntu$"
replace: "user-session=gnome-fallback"

View File

@ -1,33 +0,0 @@
---
# System base configurations.
# At the end of system configuration, we should have a complete
# Edubuntu system
# Requires fact execpath, already set by prereq role.
- include: virtualbox-guest-addons.yml
tags:
- base
- virtualbox-addons
- include: system-update.yml
tags:
- base
- update
- include: desktop-environment.yml
tags:
- base
- de
- desktop-environment
- include: packages.yml
tags:
- base
- pkgs
- packages
- include: system.yml
tags:
- base
- edubuntu

View File

@ -1,59 +0,0 @@
---
# Management of packages
- name: Activate LTS support by the means of HWE stack
apt:
name:
- linux-generic-lts-xenial
- xserver-xorg-core-lts-xenial
- xserver-xorg-lts-xenial
- xserver-xorg-video-all-lts-xenial
- xserver-xorg-input-all-lts-xenial
- libwayland-egl1-mesa-lts-xenial
state: present
install_recommends: yes
- name: Removing packages commonly not required
apt:
pkg: "{{ base_common_delpkg }}"
state: absent
purge: yes
- name: Removing packages from client machines
apt:
pkg: "{{ base_client_delpkg }}"
state: absent
purge: yes
when: ansible_local.noderole.role == 'client' and base_client_delpkg|length > 0
- name: Removing packages from docenti machines
apt:
pkg: "{{ base_docenti_delpkg }}"
state: absent
purge: yes
when: ansible_local.noderole.role == 'docenti' and base_docenti_delpkg|length > 0
- name: Cleanup of unneeded packages
shell: apt-get -y autoremove
args:
warn: false
register: autoremove
changed_when: "'Rimozione' in autoremove.stdout"
- name: Installing additional common packages
apt:
pkg: "{{ base_common_addpkg }}"
state: present
tags: edu-install
- name: Installing additional packages for client role
apt:
pkg: "{{ base_client_addpkg }}"
state: present
when: ansible_local.noderole.role == 'client' and base_client_addpkg|length > 0
- name: Installing additional packages for docenti role
apt:
pkg: "{{ base_docenti_addpkg }}"
state: present
when: ansible_local.noderole.role == 'docenti' and base_docenti_addpkg|length > 0

View File

@ -1,8 +0,0 @@
---
# Manage system upgrade
- name: Updating available packages
apt: update_cache=yes cache_valid_time=180
- name: Upgrading system
apt: upgrade=full

View File

@ -1,12 +0,0 @@
---
# Adjusting other settings due to unattended installation
- name: Adjusting connections for NetworkManager
lineinfile:
dest: /etc/network/interfaces
regexp: "{{ item }}"
state: absent
when: ansible_product_name != "VirtualBox"
with_items:
- '^auto {{ ansible_default_ipv4.interface }}'
- '^iface {{ ansible_default_ipv4.interface }}'

View File

@ -1,8 +0,0 @@
---
# Manage Virtualbox additions
- name: Adding Virtualbox Guest Additions if required
apt:
pkg: virtualbox-guest-dkms
stat: present
when: ansible_product_name == "VirtualBox"

View File

@ -0,0 +1,8 @@
---
dependencies:
- { role: ubuntu-mirror, tags: [ 'client-install' ] }
- { role: preseed, tags: [ 'client-install' ] }
- { role: ansible-pull, tags: [ 'client-install' ] }
- { role: doraemon, tags: [ 'client-install' ] }
- { role: npm, tags: [ 'client-install' ] }
- { role: git-daemon, tags: [ 'client-install' ] }

View File

@ -1,6 +0,0 @@
---
- name: reboot
shell: /sbin/shutdown -r now "Reboot by Ansible."
async: 0
poll: 0

View File

@ -1,48 +0,0 @@
---
# Managing epoptes on 'client' role
- name: Getting epoptes server name
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}:3000/epoptes-srv"
dest: /tmp/epoptes-srv
register: get_epo_srv_name
- name: Checking for a correct name
shell: cat /tmp/epoptes-srv
register: epo_srv_name
when: get_epo_srv_name is changed
changed_when: "'none' not in epo_srv_name.stdout"
- name: Cleanup
file:
path: /tmp/epoptes-srv
state: absent
when: get_epo_srv_name is changed
- name: Ensuring epoptes-client is installed
apt:
name: epoptes-client
state: present
when: get_epo_srv_name is changed
- name: Configuring the client
replace:
dest: /etc/default/epoptes-client
regexp: "^#SERVER=server"
replace: "SERVER={{ epo_srv_name.stdout }}"
when: epo_srv_name is changed
- name: Checking for an already existent certificate
file:
path: /etc/epoptes/server.crt
state: file
register: crt_epo_exists
ignore_errors: yes
- name: Getting the epoptes server certificate
shell: /usr/sbin/epoptes-client -c
when: crt_epo_exists is failed
# I don't notify anymore, hoping that this would be done on first run after
# preseed and it should restart because of domain join.
#notify:
# - reboot

View File

@ -1,8 +0,0 @@
---
# Managing actions for role 'client'
- include: epoptes.yml
when: ansible_local.noderole.role == 'client'
tags:
- role
- client

View File

@ -1,5 +0,0 @@
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
//APT::Periodic::RandomSleep "0";

View File

@ -1,34 +0,0 @@
// Automatically upgrade packages from these (origin, archive) pairs
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
"${distro_id}:${distro_codename}-security";
"${distro_id}:${distro_codename}-updates";
"${distro_id}:${distro_codename}-proposed";
"${distro_id}:${distro_codename}-backports";
"LP-PPA-app-review-board:trusty";
"LP-PPA-libreoffice-libreoffice-5-0:trusty";
"LP-PPA-ansible-ansible:trusty";
"BgLUG:trusty";
};
// List of packages to not update
Unattended-Upgrade::Package-Blacklist {
// "vim";
// "libc6";
// "libc6-dev";
// "libc6-i686";
};
// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. The package 'mailx'
// must be installed or anything that provides /usr/bin/mail.
//Unattended-Upgrade::Mail "root@localhost";
// Do automatic removal of new unused dependencies after the upgrade
// (equivalent to apt-get autoremove)
Unattended-Upgrade::Remove-Unused-Dependencies "true";
// Automatically reboot *WITHOUT CONFIRMATION* if a
// the file /var/run/reboot-required is found after the upgrade
Unattended-Upgrade::Automatic-Reboot "false";

View File

@ -1,13 +0,0 @@
---
- name: Installing plymouth theme
apt:
name: plymouth-theme-edubuntu-bglug
state: latest
force: yes
- name: Installing lightdm wallpaper
apt:
name: bglug-artwork
state: latest
force: yes

View File

@ -1,12 +0,0 @@
---
# BgLUG customization
- include: unattended-upgrades.yml
tags:
- custom
- unattended-upgrades
- include: custom.yml
tags:
- custom
- bglug

View File

@ -1,18 +0,0 @@
---
- name: Ensure needed packages are installed
apt:
name:
- unattended-upgrades
- update-notifier-common
state: present
- name: Configuring unattended upgrades from file
copy:
src: 50-unattended-upgrades
dest: /etc/apt/apt.conf.d/50-unattended-upgrades
- name: Activating automatic updates
copy:
src: 20-auto-upgrades
dest: /etc/apt/apt.conf.d/20-auto-upgrades

View File

@ -0,0 +1,29 @@
---
- name: Preparazione pacchetti per compilazione RPM
yum: pkg="{{ item }}" state=present
with_items:
- '@Development tools'
- rpmdevtools
- yum-utils
- rpmlint
become: yes
- name: Aggiungo utente per compilazione pacchetti RPM
user:
name: makepkg
password: $6$rounds=100000$neTGJ5N7Nu5ogCTX$VmVgS9HRZcdczjiNNdQcZzFVQI/3AFwu6MNFOKxGhBRY4VcBOo6GTxhXr0K/jYVFTygjHWsr.teM6RmBzSnz.0
shell: /bin/bash
state: present
become: yes
- name: Copia della chiave pubblica
authorized_key:
user: makepkg
key: "{{ lookup('file', '/Users/syntaxerrormmm/.ssh/id_rsa.pub') }}"
state: present
become: yes
- name: Creazione directory per il build di RPM
shell: rpmdev-setuptree
become: yes
become_user: makepkg

View File

@ -0,0 +1,3 @@
---
- include: developuser.yml
tags: developuser

View File

@ -1,11 +0,0 @@
# vim:sts=2:sw=2
author "BgLUG - Bergamo Linux Users Group <info@bglug.it>"
description "Sanely starts epoptes server daemon on ubuntu."
start on net-device-up and started winbind
stop on stopped winbind
exec /usr/bin/twistd -n \
--logfile "/var/log/epoptes.log" --pidfile "/var/run/epoptes.pid" \
epoptes
respawn

View File

@ -1,52 +0,0 @@
---
# Managing Epoptes installation on 'docenti' role.
- name: Ensuring epoptes package has been installed
apt:
name: epoptes
state: present
- name: Configuring the Epoptes server
lineinfile:
dest: /etc/default/epoptes
line: 'SOCKET_GROUP="{{ ansible_local.domain.domainshort }}\docenti"'
state: present
- name: Stopping epoptes SysV daemon
shell: /etc/init.d/epoptes stop
ignore_errors: yes
- name: Disabling sysv start
shell: /usr/sbin/update-rc.d -f epoptes remove
- name: Installing upstart service
copy:
src: epoptes.conf
dest: /etc/init/epoptes.conf
owner: root
group: root
mode: 0644
- name: Verify epoptes status
shell: /sbin/status epoptes
register: epoptes_status
- name: Starting epoptes from upstart
shell: /sbin/start epoptes
when: epoptes_status.stdout.find("start/running") == -1
# Disabling ufw as per issue #12
- name: Disabling ufw by override
lineinfile:
path: /etc/init/ufw.override
line: "manual"
state: present
create: yes
owner: root
group: root
mode: 0644
- name: Stopping ufw
service:
name: ufw
state: stopped

View File

@ -1,8 +0,0 @@
---
# Managing actions for role 'docenti'
- include: epoptes.yml
when: ansible_local.noderole.role == 'docenti'
tags:
- role
- docenti

View File

@ -1,2 +0,0 @@
[com.canonical.indicator.session]
user-show-menu=false

View File

@ -1,25 +0,0 @@
#!/bin/bash
apt-get -y --force-yes install \
libldb1=1:1.1.16-1 \
libsmbclient=2:4.1.6+dfsg-1ubuntu2 \
python-ldb=1:1.1.16-1 \
python-samba=2:4.1.6+dfsg-1ubuntu2 \
samba=2:4.1.6+dfsg-1ubuntu2 \
samba-common=2:4.1.6+dfsg-1ubuntu2 \
samba-common-bin=2:4.1.6+dfsg-1ubuntu2 \
samba-dsdb-modules=2:4.1.6+dfsg-1ubuntu2 \
samba-libs=2:4.1.6+dfsg-1ubuntu2 \
samba-vfs-modules=2:4.1.6+dfsg-1ubuntu2 \
smbclient=2:4.1.6+dfsg-1ubuntu2 \
libnss-winbind=2:4.1.6+dfsg-1ubuntu2 \
libpam-winbind=2:4.1.6+dfsg-1ubuntu2 \
libwbclient0=2:4.1.6+dfsg-1ubuntu2 \
winbind=2:4.1.6+dfsg-1ubuntu2
pkglist="libldb1 libsmbclient python-ldb python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0"
for pkg in ${pkglist}; do
apt-mark auto ${pkg}
apt-mark hold ${pkg}
done

View File

@ -1,2 +0,0 @@
[org.freedesktop.ibus.general]
use-system-keyboard-layout=true

View File

@ -1,2 +0,0 @@
[org.gnome.nautilus.desktop]
volumes-visible=true

View File

@ -1,2 +0,0 @@
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin;unix-group:domopers

View File

@ -1,6 +0,0 @@
---
- name: reboot
shell: /sbin/shutdown -r now "Reboot by Ansible."
async: 0
poll: 0

View File

@ -1,5 +0,0 @@
---
dependencies:
- { role: base }
- { role: client }
- { role: docenti }

View File

@ -1,45 +0,0 @@
---
# Manages reactivation of pulseaudio as system daemon
- name: "Changing pulseaudio upstart script"
template:
src: pulseaudio.conf
dest: /etc/init/pulseaudio.conf
owner: root
group: root
mode: 0644
- name: "Checking if pulseaudio is started"
shell: /sbin/status pulseaudio
register: pulseaudio_status
- name: Starting pulseaudio service
shell: /usr/sbin/service pulseaudio start
when: pulseaudio_status.stdout.find("start/running") == -1
- name: "Configuring client options"
lineinfile:
line: '{{ item }}'
dest: /etc/pulse/client.conf
state: present
with_items:
- 'default-server = /var/run/pulse/native'
- 'autospawn = no'
- name: Disabling pulseaudio startup on lightdm
shell: chmod -x /usr/bin/start-pulseaudio-x11
args:
warn: false
- name: Removing old (and not-working) approach
file:
path: /etc/cron.d/pulseaudio-perms
state: absent
- name: Get the new script
get_url:
url: "http://{{ ansible_local.domain.serverfqdn }}/ks/paperms/paperms.sh"
dest: /tmp/paperms.sh
- name: Run the script (install other support files and fixes the permissions)
shell: bash /tmp/paperms.sh

View File

@ -1,11 +0,0 @@
---
# Final tasks.
- name: Ensuring APT stack is healthy
shell: dpkg --configure -a && apt-get install -f
# Correctly managing ansible-pull runs.
- name: Updating local version for repo
shell: 'rm -f {{ ansible_local.checksum.repover_file }} && echo "{{ ansible_local.checksum.repover }}" > {{ ansible_local.checksum.repover_file }}'
args:
warn: false

View File

@ -1,12 +0,0 @@
---
- name: Removing upgrade-notification from /etc
lineinfile:
dest: /etc/update-manager/release-upgrades
line: "Prompt=never"
regexp: '^Prompt='
state: present
- name: Removing notifications for system upgrade
shell: >
test -f /usr/share/upstart/sessions/update-notifier-release.conf && mv /usr/share/upstart/sessions/update-notifier-release.conf /usr/share/upstart/sessions/update-notifier-release.conf.disabled
ignore_errors: yes

View File

@ -1,15 +0,0 @@
---
# Domain join tasks
- name: Checking domain join
shell: wbinfo -t
register: check_domain
changed_when: check_domain.rc != 0
ignore_errors: yes
- name: Joining domain
shell: 'net rpc join -U admin%{{ domainadminpasswd }}'
when: check_domain is changed
register: domainjoin
notify:
- reboot

View File

@ -1,27 +0,0 @@
---
# Glib2 settings for a better user experience
- name: Disabling user listings in Metacity menu
copy:
src: com.canonical.indicator.session.gschema.override
dest: /usr/share/glib-2.0/schemas/com.canonical.indicator.session.gschema.override
backup: yes
register: cfg_glib_users
- name: Visualizing mounted drives on desktop
copy:
src: org.gnome.nautilus.desktop.gschema.override
dest: /usr/share/glib-2.0/schemas/org.gnome.nautilus.desktop.gschema.override
backup: yes
register: cfg_glib_mounted
- name: Fixing keyboard layout
copy:
src: org.freedesktop.ibus.general.gschema.override
dest: /usr/share/glib-2.0/schemas/org.freedesktop.ibus.general.schema.override
backup: yes
register: cfg_keyb_layout
- name: Recompiling glib2 schemas
shell: glib-compile-schemas --strict /usr/share/glib-2.0/schemas/
when: cfg_glib_users is changed or cfg_glib_mounted is changed or cfg_keyb_layout is changed

View File

@ -1,14 +0,0 @@
---
# Adjusting Graphical User Interface
- include: lightdm.yml
tags: lightdm
- include: glib2.yml
tags: glib2
- include: policykit-1.yml
tags: policykit
- include: disable-upgrade-notifications.yml
tags: disable-upgrade-notifications

View File

@ -1,12 +0,0 @@
---
# Adjusting lightdm settings
- name: Adjusting lightdm settings
lineinfile:
dest: /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf
regexp: "{{ item }}"
line: "{{ item }}"
with_items:
- "allow-guest=false"
- "greeter-hide-users=true"
- "greeter-show-manual-login=true"

View File

@ -1,63 +0,0 @@
---
# Domain configurations
- include: networkmanager.yml
tags:
- domain
- networkmanager
- include: ntp.yml
tags:
- domain
- ntp
- include: nss.yml
tags:
- domain
- nss
- include: audio.yml
tags:
- domain
- audio
- include: gui-changes.yml
tags:
- domain
- gui
- include: sslproxy.yml
tags:
- domain
- crt
- include: pkgs.yml
tags:
- domain
- pkgs
- include: pam_base.yml
tags:
- domain
- pam
- include: pam_mount.yml
tags:
- domain
- pam
- pam_mount
- include: smb_config.yml
tags:
- domain
- smb
- include: domain_join.yml
tags:
- domain
- join
- include: cleanup.yml
tags:
- domain
- cleanup

View File

@ -1,21 +0,0 @@
---
# Since students are disabling deliberately the network interface from
# NetworkManager, we insert the default interface in /etc/network/interfaces
# so they are not available to NM
- name: Ensuring first NIC will never be disabled again
lineinfile:
line: "{{ item }}"
state: present
dest: /etc/network/interfaces
insertafter: EOF
with_items:
- " "
- "auto {{ ansible_default_ipv4.interface }}"
- "iface {{ ansible_default_ipv4.interface }} inet dhcp"
# Hiding NetworkManager icon from any sessions
- name: Disabling NetworkManager from popping up in sessions
shell: mv /etc/xdg/autostart/nm-applet.desktop /etc/xdg/autostart/nm-applet.desktop.disabled
ignore_errors: yes

View File

@ -1,11 +0,0 @@
---
# configuring NSS
- name: Configuring NSS
template:
src: nsswitch.conf
dest: /etc/nsswitch.conf
backup: yes
owner: root
group: root
mode: 0644

View File

@ -1,29 +0,0 @@
---
# Configuring NTP for domain clients
- name: Installing NTP
apt:
name: ntp
state: present
- name: Configuring NTP
template:
src: ntp.conf
dest: /etc/ntp.conf
backup: yes
owner: root
group: root
mode: 0644
register: cfg_ntp
- name: Configuring AppArmor for NTP
lineinfile:
dest: /etc/apparmor.d/usr.sbin.ntpd
regexp: "/run/samba/winbindd/pipe"
line: ' /run/samba/winbindd/pipe crw,'
insertafter: 'samba/ntp_signd/socket'
state: present
- name: Restarting NTP service
shell: service ntp restart
when: cfg_ntp is changed

View File

@ -1,52 +0,0 @@
---
# base configuration for PAM Module
- name: Installing winbind bindings for PAM
apt:
name: libpam-winbind
state: present
# Leaving them here commented, as they may be needed in the future
# for improvements on login times.
# common-auth
#- name: 'common-auth: modifica pam_unix'
# replace:
# dest: /etc/pam.d/common-auth
# regexp: '^.*pam_unix\.so.*nullok_secure$'
# replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass'
#
#- name: 'common-auth: rimuovo config auto pam_winbind'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: 'pam_winbind\.so krb5'
# state: absent
#
#- name: 'common-auth: aggiunta pam_winbind'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: '^auth.*pam_winbind\.so$'
# insertbefore: '^auth.*pam_unix\.so'
# line: 'auth [success=2 default=ignore] pam_winbind.so'
# state: present
## common-password
#
#- name: 'common-password: configurazione pam_unix'
# replace:
# dest: /etc/pam.d/common-password
# regexp: '^(password.*pam_unix\.so.*sha512)$'
# replace: '\1 min=4 max=20'
# backup: yes
#
## common-session
#
#- name: 'common-session: configurazione pam_mkhomedir'
# lineinfile:
# dest: /etc/pam.d/common-session
# regexp: '^session.*pam_mkhomedir\.so.*$'
# insertafter: '^session\s*required.*pam_permit.so'
# line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
# state: present
# backup: yes

View File

@ -1,13 +0,0 @@
---
# PAM_mount configuration
- name: Installing pam_mount
apt:
name: libpam-mount
state: present
- name: Configuring pam_mount
template:
src: pam_mount.conf.xml
dest: /etc/security/pam_mount.conf.xml
backup: yes

View File

@ -1,35 +0,0 @@
---
# Packages needed for domain join
# Badlock wrong resolution: downgrading SAMBA
- name: Copying scripts for fixing SAMBA
copy:
src: "{{ item }}"
dest: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/{{ item }}"
owner: root
mode: 0755
with_items:
- downgrade_samba.sh
- name: Verifying SAMBA version on client
shell: dpkg -l | grep libsmbclient
register: check_samba_version
ignore_errors: yes
changed_when: "'2:4.1.6+dfsg-1ubuntu2' not in check_samba_version.stdout"
#- name: Downgrading SAMBA if not the right version
# shell: "/var/lib/{{ ansible_local.domain.domainfull }}/bin/downgrade_samba.sh"
# when: check_samba_version is changed
#
#- name: Checking again for the correct SAMBA version
# shell: dpkg -l | grep libsmbclient
# register: recheck_samba_version
# changed_when: "'2:4.1.6+dfsg-1ubuntu2' in check_samba_version.stdout"
- name: Installing domain packages
apt:
pkg:
- winbind
- samba
state: present

View File

@ -1,10 +0,0 @@
---
- name: Configuring sudo to accept users other than local admin
copy:
src: polkit-1.txt
dest: /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf
owner: root
group: root
mode: 0644
backup: yes

View File

@ -1,40 +0,0 @@
---
# SAMBA configuration for domain
- name: Configuring SAMBA
template:
src: smb.conf
dest: /etc/samba/smb.conf
validate: 'testparm -s %s'
backup: yes
register: cfg_samba
- name: Configuring AppArmor home directories
replace:
dest: /etc/apparmor.d/tunables/home
regexp: '^@\{HOMEDIRS\}=/home/$'
replace: '@{HOMEDIRS}=/home/ /home/{{ ansible_local.domain.domainshort }}/'
- name: SAMBA restart
shell: /sbin/restart smbd
when: cfg_samba is changed
- name: Winbind restart
shell: /sbin/restart winbind
when: cfg_samba is changed
- name: Creating home base
file:
path: '/home/{{ ansible_local.domain.domainshort }}'
owner: root
group: root
state: directory
- name: Permitting SAMBA domopers to run sudo
template:
src: sudoers.d
dest: /etc/sudoers.d/domain
owner: root
group: root
mode: 0440
validate: "/usr/sbin/visudo -cf %s"

View File

@ -1,26 +0,0 @@
---
# Adjusting system for domain proxy certificate
- name: Creating needed directories
file:
path: '{{ item }}'
mode: 0755
state: directory
with_items:
- '/usr/lib/firefox/browser/defaults/profile'
- '/usr/local/share/ca-certificates/{{ ansible_local.domain.domainfull }}'
- name: Getting SSL transparent proxy certificate
get_url:
url: 'http://{{ ansible_local.domain.serverfqdn }}/proxy.crt'
dest: '/usr/local/share/ca-certificates/{{ ansible_local.domain.domainfull }}/ca.crt'
register: proxycrt_dwnl
- name: Adding certificates to the ones used by the system
shell: update-ca-certificates
when: proxycrt_dwnl is changed
- name: Firefox settings to include certificate
get_url:
url: 'http://{{ ansible_local.domain.serverfqdn }}/ks/server-ca/cert8.db'
dest: /usr/lib/firefox/browser/defaults/profile/cert8.db

View File

@ -1,11 +0,0 @@
# {{ ansible_managed }}
passwd: compat winbind
group: compat winbind
shadow: compat winbind
hosts: files myhostname dns wins
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis

View File

@ -1,58 +0,0 @@
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
driftfile /var/lib/ntp/ntp.drift
# Enable this if you want statistics to be logged.
#statsdir /var/log/ntpstats/
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
# Specify one or more NTP servers.
# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
# more information.
#server 0.ubuntu.pool.ntp.org
#server 1.ubuntu.pool.ntp.org
#server 2.ubuntu.pool.ntp.org
#server 3.ubuntu.pool.ntp.org
# Use Ubuntu's ntp server as a fallback.
#server ntp.ubuntu.com
# {{ ansible_managed }}
server {{ ansible_local.domain.ntpserver }} prefer
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
# might also be helpful.
#
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.
# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1
restrict ::1
# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust
# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)
#broadcast 192.168.123.255
# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines. Please do this only if you trust everybody on the network!
#disable auth
#broadcastclient

View File

@ -1,47 +0,0 @@
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
See pam_mount.conf(5) for a description.
-->
<pam_mount>
<!--
debug should come before everything else, since this file is still
processed in a single pass from top-to-bottom
-->
<debug enable="0" />
<!-- Volume definitions -->
<volume user="*" sgrp="domain users" fstype="cifs"
server="{{ ansible_local.domain.server }}" path="%(USER)" mountpoint="~"
options="setuids,acl,user_xattr,iocharset=utf8,file_mode=0644,dir_mode=0755,cache=none" />
<volume user="*" sgrp="domain users" fstype="cifs"
server="{{ ansible_local.domain.server }}" path="shared" mountpoint="~/Condiviso"
options="setuids,acl,user_xattr,iocharset=utf8,file_mode=0664,dir_mode=0775,cache=strict" />
<!-- pam_mount parameters: General tunables -->
<!--
<luserconf name=".pam_mount.conf.xml" />
-->
<!--
Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing.
-->
<!--
<mntoptions allow="loop,encryption,fsck,nonempty,allow_root,allow_other" />
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
<mntoptions require="nosuid,nodev,exec" />
-->
<logout wait="10" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="false" />
</pam_mount>
<!--
{{ ansible_managed }}
-->

View File

@ -1,48 +0,0 @@
# System PulseAudio service
description "System PulseAudio sound server"
author "Pali Rohár <pali.rohar@gmail.com>"
# uncomment the 'start on' to start pulseaudio in system mode
# (enables the pulseaudio init script - requires that users be in the
# pulse-access group)
# System mode is not the recommended way to run PulseAudio as it has some
# limitations (such as no shared memory access) and could potentially allow
# users to disconnect or redirect each others' audio streams. The
# recommended way to run PulseAudio is as a per-session daemon. For GNOME/KDE/
# Xfce sessions in Ubuntu Lucid/10.04, /etc/xdg/autostart/pulseaudio.desktop
# handles this function of automatically starting PulseAudio on login, and for
# it to work correctly your user must *not* have "autospawn = no" set in
# ~/.pulse/client.conf (or in /etc/pulse/client.conf). By default, autospawn
# is enabled. For other sessions, you can simply start PulseAudio with
# "pulseaudio --daemonize".
start on (started winbind)
stop on runlevel [016]
expect daemon
respawn
# Prevent users from dynamically loading modules into the PulseAudio sound
# server. Dynamic module loading enhances the flexibility of the PulseAudio
# system, but may pose a security risk.
# 0 = no, 1 = yes
env DISALLOW_MODULE_LOADING=1
# extra arguments to pass to the daemon
env PULSEAUDIO_ARGS=
pre-start exec install -d -m755 -o pulse -g pulse /run/pulse
exec /usr/bin/pulseaudio --system --daemonize --high-priority --log-target=syslog --disallow-exit --disallow-module-loading=$DISALLOW_MODULE_LOADING $PULSEAUDIO_ARGS
post-start script
if [ -e /var/run/pulse/.esd_auth ]; then
chown pulse:pulse-access /var/run/pulse/.esd_auth
chmod 640 /var/run/pulse/.esd_auth
fi
if [ -e /var/run/pulse/.pulse-cookie ]; then
chown pulse:pulse-access /var/run/pulse/.pulse-cookie
chmod 640 /var/run/pulse/.pulse-cookie
fi
end script

View File

@ -1,16 +0,0 @@
# {{ ansible_managed }}
[global]
security = domain
netbios name = {{ ansible_hostname }}
password server = {{ ansible_local.domain.serverfqdn }}
workgroup = {{ ansible_local.domain.domainshort }}
idmap uid = 10000000-19999999
idmap gid = 10000000-19999999
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind expand groups = 1
template shell = /bin/bash
template homedir = /home/%D/%U
domain master = no
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u

View File

@ -1,6 +0,0 @@
# {{ ansible_managed }}
# Autorizzazione per gli utenti di dominio
%domain\ admins ALL=(ALL:ALL) NOPASSWD:ALL
%{{ ansible_local.domain.domainshort }}\\domain\ admins ALL=(ALL:ALL) NOPASSWD:ALL
%domopers ALL=(ALL:ALL) ALL
%{{ ansible_local.domain.domainshort }}\\domopers ALL=(ALL:ALL) ALL

View File

@ -0,0 +1,3 @@
---
doraemon_pkg: doraemon
doraemon_version: 1.2.0-1

View File

@ -0,0 +1,15 @@
---
# Installa e configura il servizio per rinominare il client
# Grazie per il servizio a Enrico Bacis
# Considerando di aver creato il repo, viene comunque installata l'ultima versione disponibile
- name: Installazione doraemon
yum:
pkg: "{{ doraemon_pkg }}"
state: latest
become: yes
- name: Verifico avvio di doraemon
service: name=doraemon state=restarted
become: yes

View File

@ -0,0 +1,3 @@
---
- include: doraemon.yml
tags: doraemon

View File

@ -0,0 +1,3 @@
---
client_gitrepo: "https://github.com/bglug-it/client-pull-installation.git"
client_gitbranch: master

View File

@ -0,0 +1 @@
@daily git-daemon pushd /var/lib/git-daemon/repositories/client-pull-installation.git; git fetch -p origin; popd

View File

@ -0,0 +1,64 @@
#!/bin/sh
#
# Startup/shutdown script for Git Daemon
# chkconfig: 345 56 10
#
# description: Startup/shutdown script for Git Daemon
#
# Taken from: https://gist.github.com/esoupy/3823712
. /etc/init.d/functions
DAEMON=/usr/libexec/git-core/git-daemon
USER=git-daemon
GROUP=git
BASE_PATH=/var/lib/git-daemon/repositories
ARGS="--user=$USER --group=$GROUP --detach --base-path=$BASE_PATH"
prog=git-daemon
start () {
echo -n $"Starting $prog: "
# start daemon
daemon $DAEMON $ARGS
RETVAL=$?
echo
[ $RETVAL = 0 ] && touch /var/lock/git-daemon
return $RETVAL
}
stop () {
# stop daemon
echo -n $"Stopping $prog: "
killproc $DAEMON
RETVAL=$?
echo
[ $RETVAL = 0 ] && rm -f /var/lock/git-daemon
}
restart() {
stop
start
}
case $1 in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
status)
status $DAEMON
RETVAL=$?
;;
*)
echo $"Usage: $prog {start|stop|restart|status}"
exit 3
;;
esac
exit $RETVAL

View File

@ -0,0 +1,140 @@
---
# Configura e lancia il servizio git-daemon per servire i repository locali
- name: Installo git-daemon
yum: pkg=git-daemon state=present
become: yes
- name: Creazione gruppo git
group:
name: git
system: yes
state: present
become: yes
- name: Creazione utente git-daemon
user:
name: git-daemon
system: yes
group: git
home: /var/lib/git-daemon
state: present
become: yes
- name: Creo directory repositories
file:
path: /var/lib/git-daemon/repositories
state: directory
become: yes
become_user: git-daemon
- name: Verifica presenza repo
shell: test -d /var/lib/git-daemon/repositories/client-pull-installation.git
register: chk_clientpullinstall_repo
changed_when: chk_clientpullinstall_repo.rc != 0
ignore_errors: yes
become: yes
tags:
- git-daemon-update
- name: Aggiorno il repo se già esistente
shell: pushd /var/lib/git-daemon/repositories/client-pull-installation.git; git fetch -p origin; popd
become: yes
become_user: git-daemon
when: chk_clientpullinstall_repo|success
tags:
- git-daemon-update
# E' in forma di shell perché non c'è modo di passare ad ansible
# il parametro --mirror
- name: Clono il repository client-pull-installation
shell: git clone --mirror {{ client_gitrepo }} /var/lib/git-daemon/repositories/client-pull-installation.git
become: yes
become_user: git-daemon
when: chk_clientpullinstall_repo|changed
- name: Rendo il repository esportabile
file:
path: /var/lib/git-daemon/repositories/client-pull-installation.git/git-daemon-export-ok
state: touch
become: yes
become_user: git-daemon
tags:
- git-daemon-update
- name: Installo task di cron per aggiornamento repo
copy:
src: git-daemon-crontab
dest: /etc/cron.d/git-daemon
mode: 0644
owner: root
group: root
become: yes
- name: Installo l'init
copy:
src: git-daemon-init
dest: /etc/init.d/git-daemon
mode: 0755
owner: root
group: root
become: yes
- name: Configuro l'avvio di git-daemon
shell: /sbin/chkconfig --add git-daemon
become: yes
- name: Verifica aggiunta servizio
shell: /sbin/e-smith/db configuration show git-daemon
become: yes
register: chk_gitdaemon_srv
changed_when: chk_gitdaemon_srv.rc != 0
ignore_errors: yes
- name: Aggiungo servizio a gestione NethServer
shell: /sbin/e-smith/db configuration set git-daemon service status enabled TCPPort 9418 access private
become: yes
when: chk_gitdaemon_srv|changed
- name: Creazione directory defaults per NethServer
file:
path: /etc/e-smith/db/configuration/defaults/git-daemon
recurse: yes
state: directory
become: yes
when: chk_gitdaemon_srv|changed
- name: Creazione tipo default per NethServer
lineinfile:
dest: /etc/e-smith/db/configuration/defaults/git-daemon/type
regexp: "^service"
line: "service"
create: yes
state: present
become: yes
when: chk_gitdaemon_srv|changed
- name: Creazione stato default per NethServer
lineinfile:
dest: /etc/e-smith/db/configuration/defaults/git-daemon/status
regexp: "^enabled"
line: "enabled"
create: yes
state: present
become: yes
when: chk_gitdaemon_srv|changed
- name: Aggiunta servizio
shell: /sbin/e-smith/signal-event runlevel-adjust
become: yes
when: chk_gitdaemon_srv|changed
- name: Aggiunta servizio di rete e cambio firewall
shell: /sbin/e-smith/signal-event firewall-adjust
become: yes
when: chk_gitdaemon_srv|changed
- name: Avvio servizio
shell: service git-daemon start
become: yes
when: chk_gitdaemon_srv|changed

View File

@ -0,0 +1,9 @@
---
- name: Overriding default gitrepo if defined in domain.yml
set_fact: client_gitrepo="{{ ansible_local.domain.client_gitrepo }}"
when: "ansible_local.domain.client_gitrepo is defined"
- name: Overriding default gitbranch if defined in domain.yml
set_fact: client_gitbranch="{{ ansible_local.domain.client_gitbranch }}"
when: "ansible_local.domain.client_gitbranch is defined"

View File

@ -0,0 +1,7 @@
---
- include: initvars.yml
tags: git-daemon
- include: git-daemon.yml
tags: git-daemon

View File

@ -0,0 +1,4 @@
---
ansible_ssh_user: root
admin_sshkey: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"

View File

@ -0,0 +1,22 @@
---
# Copia le configurazioni per il dominio in locale sul server.
- name: Copia le configurazioni di dominio.
copy: src=../../../domain.yml dest=/etc/domain.yml force=yes
become: yes
- name: Creo la cartella per le configurazioni di Ansible
file: path=/etc/ansible/facts.d state=directory owner=root mode=0755
become: yes
- name: Installo PyYAML, necessario per i facts
yum:
name: PyYAML
state: present
become: yes
- name: Utilizzo un piccolo wrapper per passare come fatti informazioni di dominio
copy: src=domain.fact dest=/etc/ansible/facts.d/domain.fact mode=0755 owner=root
become: yes
- name: Rileggo i fatti per essere sicuri che vengano utilizzati
setup: filter=ansible_local

View File

@ -1,42 +0,0 @@
---
# Initialization task (for simpler ansible management)
- name: Setting up sudoers for root
lineinfile:
dest: /etc/sudoers.d/root
regexp: "^root.*NOPASSWD"
line: "root ALL=(ALL:ALL) NOPASSWD:ALL"
owner: root
group: root
mode: 0440
create: yes
state: present
validate: '/usr/sbin/visudo -c -f %s'
- name: Creating Ansible Management User
user:
name: amgmt
comment: "Ansible Management User"
group: users
password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
shell: /bin/bash
state: present
generate_ssh_key: yes
- name: Setting up sudoers for Ansible Management User
lineinfile:
dest: /etc/sudoers.d/amgmt
regexp: "^amgmt.*NOPASSWD"
line: "amgmt ALL=(ALL:ALL) NOPASSWD:ALL"
owner: root
group: root
mode: 0440
create: yes
state: present
validate: '/usr/sbin/visudo -c -f %s'
- name: Authorizing Ansible Management User's key from server
authorized_key:
user: amgmt
key: "{{ lookup('pipe', 'curl -sSL http://' + ansible_local.domain.serverfqdn + ':3000/mgmtkey') }}"
state: present

View File

@ -1,5 +1,11 @@
---
# Task basilari per la prima configurazione
- include: selinux-binding.yml
when: ansible_os_family == "RedHat"
- include: init.yml
tags:
- init
- include: yum-utils.yml
- include: mgmtuser.yml
- include: domaininfo.yml
tags: domaininfo

View File

@ -0,0 +1,23 @@
---
- name: Creazione account di gestione Ansible
user:
name: amgmt
comment: "Ansible Management User"
group: wheel
state: present
password: $6$mVKMBMbAxeql$eqSe8tu2qKjtwmpiFy07b6nv2g4F80N.U9EzOmQTrNZwKZ61n6NLrSEQHQo1FOlQghOiB8as6Z35oTUUKN8y2.
- name: Concessione diritti all'utente di gestione Ansible
template:
src: sudoers.d
dest: /etc/sudoers.d/amgmt
owner: root
group: root
mode: 0440
validate: "/usr/sbin/visudo -cf %s"
- name: Installazione chiave privata PC locale
authorized_key:
user: amgmt
key: "{{ lookup('file', admin_sshkey) }}"
state: present

View File

@ -0,0 +1,4 @@
---
# Preconfigurazione selinux per host
- name: Binding Python per selinux
yum: name=libselinux-python state=present

View File

@ -0,0 +1,5 @@
---
- name: Installing yum-utils to enable repositories
yum:
name: yum-utils
state: present

View File

@ -0,0 +1,3 @@
# {{ ansible_managed }}
# Autorizzazione di gestione per l'utente di ansible
amgmt ALL=(ALL:ALL) NOPASSWD:ALL

View File

@ -0,0 +1,6 @@
---
extnic: wan0
intnic: lan0
force_regen_ca: false
force_ibay_shared: false
development: false

View File

@ -0,0 +1,86 @@
---
# Base configurations to be implemented anyways.
# installing italian interface translation
- name: Making available also Italian NethGUI
yum:
pkg: nethserver-lang-it
state: present
tags: nethgui
# Trusted networks: LAN
- name: Check for LAN to be added as Trusted Network
shell: /sbin/e-smith/db networks printprop {{ ansible_local.domain.servernet }} Description
register: check_trusted
changed_when: '"Description=Local LAN" not in check_trusted.stdout'
ignore_errors: yes
tags: trustednet
- name: Configuring trusted networks
shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }}
when: check_trusted|changed
tags: trustednet
- name: Activating trusted network
shell: /sbin/e-smith/signal-event trusted-networks-modify
when: check_trusted|changed
tags: trustednet
# Preconfiguring DNS anyways
- name: Checking DNS configuration
shell: /sbin/e-smith/db configuration printprop dns NameServers
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout"
ignore_errors: yes
- name: Configuring DNS resolution
shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}
when: chk_dns|changed
tags: dns-preset
- name: Activating correct DNS resolution
shell: "/sbin/e-smith/signal-event nethserver-base-update"
when: chk_dns|changed
# Hostname and domainname
- name: Configuring hostname
shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }}
register: chg_hostname
when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'"
tags: hostname
- name: Configuring domain name
shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }}
register: chg_domainname
when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'"
tags: domainname
- name: Activating hostname/domainname changes
shell: /sbin/e-smith/signal-event hostname-modify
when: chg_hostname|changed or chg_domainname|changed
tags:
- hostname
- domainname
# Base certificate
- name: Checking CA configuration
shell: /sbin/e-smith/db configuration printprop pki CommonName
ignore_errors: true
register: chk_crt
changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout"
tags: regen-ca
- name: Configuring CA
shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}"
tags: regen-ca
when: chk_crt|changed or force_regen_ca|bool
- name: Activating CA and regenerate
shell: /sbin/e-smith/signal-event certificate-update
when: chk_crt|changed or force_regen_ca|bool
tags: regen-ca

View File

@ -0,0 +1,52 @@
---
# Installing and configuring DHCP and DNS
- name: Installing DHCP and DNS related NethServer packages.
yum:
name: nethserver-dnsmasq
state: present
# DHCP
- name: Checking DHCP configuration
shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart
ignore_errors: true
register: chk_dhcp
- name: Configuring DHCP
shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled
when: chk_dhcp|failed
- name: Activating DHCP
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_dhcp|failed
# DNS
# Already preconfigured before (roles/nethcfg/tasks/base.yml)
# reforcing the resolver addresses to the ones configured
- name: Checking DNS configuration
shell: /sbin/e-smith/db configuration printprop dns NameServers
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout"
tags: force-resolvers
- name: Configuring DNS resolution
shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}
when: chk_dns|changed
tags: force-resolvers
- name: Activating correct DNS resolution
shell: "/sbin/e-smith/signal-event nethserver-{{ item }}-update"
with_items:
- base
- dnsmasq
when: chk_dns|changed
tags: force-resolvers
# Avahi
- name: Installing avahi-daemon
yum:
name: nethserver-avahi
state: present

View File

@ -0,0 +1,42 @@
---
# Organization
- name: Installing required packages
yum:
pkg: nethserver-directory
state: present
- name: Check organization configuration
shell: /sbin/e-smith/db configuration printprop OrganizationContact City
register: check_org
changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout"
ignore_errors: yes
# Password policy
- name: Check for password policy
shell: /sbin/e-smith/db configuration printprop passwordstrength Users
register: chk_passstr
changed_when: "'Users=none' not in chk_passstr.stdout"
ignore_errors: true
tags: password-policy
- name: Configuring password policy
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
when: chk_passstr|changed
tags: password-policy
- name: Activating password policy
shell: /sbin/e-smith/signal-event password-policy-update
when: chk_passstr|changed
tags: password-policy
# Organization configuration
- name: Configuring organization
shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}"
when: check_org|changed
- name: Activating organization configuration
shell: /sbin/e-smith/signal-event organization-save
when: check_org|changed

View File

@ -0,0 +1,47 @@
---
# Domain groups
# Domain Users
- name: domusers - Checking for group
shell: /sbin/e-smith/db accounts show domusers
register: check_domusers
ignore_errors: true
- name: domusers - Creating new group
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
when: check_domusers|failed
- name: domusers - Activating group
shell: /sbin/e-smith/signal-event group-create domusers
when: check_domusers|failed
# Domain Operators
- name: domopers - Checking for group
shell: /sbin/e-smith/db accounts show domopers
register: check_domopers
ignore_errors: true
- name: domopers - Creating new group
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
when: check_domopers|failed
- name: domopers - Activating group
shell: /sbin/e-smith/signal-event group-create domopers
when: check_domopers|failed
# Docenti
- name: docenti - Checking for group
shell: /sbin/e-smith/db accounts show docenti
register: check_docenti
ignore_errors: true
- name: docenti - Creating new group
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
when: check_docenti|failed
- name: docenti - Activating group
shell: /sbin/e-smith/signal-event group-create docenti
when: check_docenti|failed

View File

@ -0,0 +1,57 @@
---
# Configuring NethServer as requested
# Network interfaces
- include: network.yml
become: yes
tags:
- network
# Configuring base parameters
- include: base.yml
become: yes
tags:
- base
- include: ntp.yml
become: yes
tags:
- ntp
# Directory and organization
- include: directory.yml
become: yes
tags:
- directory
# DHCP and DNS
- include: dhcpdns.yml
become: yes
tags:
- dhcpdns
# Other small services
- include: otherservices.yml
become: yes
tags:
- otherservices
# Proxy and web filter
- include: proxy.yml
become: yes
tags:
- proxy
- webfilter
# SAMBA and ibays
- include: samba.yml
become: yes
tags:
- samba
- ibay
# Domain groups
- include: domain_groups.yml
become: yes
tags:
- domaingroups

View File

@ -0,0 +1,11 @@
---
# Reconfiguring network interfaces
- name: Configuring external NIC
shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp
- name: Configuring internal NIC
shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }}
- name: Activating changes to NICs
shell: /sbin/e-smith/signal-event interface-update

View File

@ -0,0 +1,24 @@
---
# Network time protocol
- name: Installing NTP related packages.
yum:
name: nethserver-ntp
state: present
- name: Checking for NTP Configuration
shell: /sbin/e-smith/db configuration printprop ntpd NTPServer
become: yes
register: chk_ntp
changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout"
ignore_errors: true
- name: Configuring NTP
shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled
become: yes
when: chk_ntp|changed
- name: Activating NTP
shell: /sbin/e-smith/signal-event nethserver-ntp-update
become: yes
when: chk_ntp|changed

View File

@ -0,0 +1,15 @@
---
# Installation and configuration of small services
- name: Installing other small services
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-cups
- nethserver-collectd
- nethserver-collectd-web
- nethserver-firewall-base
- nethserver-firewall-base-ui
- nethserver-backup-config
- nethserver-backup-data

View File

@ -0,0 +1,79 @@
---
# Proxy and webfiltering configurations
- name: Installing proxy-related packages
yum:
name: "{{ item }}"
state: present
with_items:
- nethserver-squid
- nethserver-squidclamav
- nethserver-squidguard
# Squid
- name: Checking squid configuration
shell: /sbin/e-smith/db configuration printprop squid DiskCacheSize
ignore_errors: yes
register: chk_squid
changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout"
- name: Configuring Squid
shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000
when: chk_squid|changed
- name: Activating Squid configuration
shell: /sbin/e-smith/signal-event nethserver-squid-update
when: chk_squid|changed
# Squid-clamav
- name: Checking squidclamav configuration
shell: /sbin/e-smith/db configuration printprop squidclamav status
ignore_errors: true
register: chk_squidclamav
changed_when: "'status=enabled' not in chk_squidclamav.stdout"
- name: Configuring squidclamav
shell: /sbin/e-smith/db configuration setprop squidclamav status enabled
when: chk_squidclamav|changed
- name: Activating squidclamav
shell: /sbin/e-smith/signal-event nethserver-squidclamav-update
when: chk_squidclamav|changed
# SquidGuard
- name: Verifying squidguard configuration
shell: /sbin/e-smith/db configuration printprop squidguard status
register: check_squidguard
ignore_errors: true
changed_when: '"status=enabled" not in check_squidguard.stdout'
- name: Configuring squidguard
shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled
when: check_squidguard|changed
- name: Activating squidguard configuration
shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}"
with_items:
- save
- update
- downloadlists
when: check_squidguard|changed
# Content filtering settings
- name: Verifying content filtering
shell: /sbin/e-smith/db contentfilter printprop default Categories
register: check_cf
changed_when: "'sex' not in check_cf.stdout"
- name: Configuring content filtering
shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez
register: cf_cat
when: check_cf|changed
- name: Activating content filtering as a whole
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
when: check_cf|changed

Some files were not shown because too many files have changed in this diff Show More