Initial working import.

This commit is contained in:
Emiliano Vavassori 2016-03-10 23:43:40 +01:00
commit 96f402a807
23 changed files with 342 additions and 0 deletions

25
README.md Normal file
View File

@ -0,0 +1,25 @@
# Ansible playbooks for a mirror + backup server #
## Progetto Scuola [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG Logo" /> BgLUG][bglug] - Scenary 1 ##
Starting from a configured Debian 8 machine, this playbooks install some stuff
required to set up a mirror for Ubuntu, that keeps syncronized itself during
the night.
They also configure some exports for NFS to share the repository and a
`backups` folder for backups.
### Quick start ###
Start with a basic Debian 8 machine, with python, sudo and ssh server installed.
Then allow your user to use sudo without passwords:
$ echo "${your_user} ALL = (ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers.d/${your_user}
Then you may use these playbooks as follows:
$ vim hosts
$ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub"
$ ansible-playbook setup.yml
[bglug]: http://bglug.it/ "BgLUG Homepage"

5
ansible.cfg Normal file
View File

@ -0,0 +1,5 @@
[defaults]
host_key_checking=False
inventory=hosts
roles_path=roles
pipelining=True

5
hosts Normal file
View File

@ -0,0 +1,5 @@
[defaults]
host_key_checking=false
[mirror]
mirror ansible_ssh_user=amgmt

7
init.yml Normal file
View File

@ -0,0 +1,7 @@
---
- hosts: mirror
vars:
- ansible_ssh_user: bglug
roles:
- init

View File

@ -0,0 +1,4 @@
---
ansible_ssh_user: root
admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub

View File

@ -0,0 +1,7 @@
#!/usr/bin/env python
from yaml import load
from json import dumps
with open('/etc/domain.yml') as file:
print(dumps(load(file)))

View File

@ -0,0 +1,4 @@
---
- name: Installo prerequisiti per Ansible
shell: apt-get -y install python-apt aptitude

View File

@ -0,0 +1,8 @@
---
# Task basilari per la prima configurazione
- include: mgmtuser.yml
become: yes
- include: basepkg.yml
become: yes

View File

@ -0,0 +1,21 @@
---
- name: Creazione account di gestione Ansible
user:
name: amgmt
comment: "Ansible Management User"
group: adm
state: present
password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
- name: Concessione diritti all'utente di gestione Ansible
template:
src: sudoers.d
dest: /etc/sudoers.d/amgmt
mode: "u=r,g=r"
validate: "/usr/sbin/visudo -cf %s"
- name: Installazione chiave privata PC locale
authorized_key:
user: amgmt
key: "{{ lookup('file', admin_sshkey) }}"
state: present

View File

@ -0,0 +1,3 @@
# {{ ansible_managed }}
# Autorizzazione di gestione per l'utente di ansible
amgmt ALL=(ALL:ALL) NOPASSWD:ALL

2
roles/nfs/files/exports Normal file
View File

@ -0,0 +1,2 @@
"/var/spool/apt-mirror" *(ro,sync,insecure,no_root_squash,no_subtree_check)
/var/lib/backups *(rw,sync,no_root_squash,subtree_check)

57
roles/nfs/tasks/main.yml Normal file
View File

@ -0,0 +1,57 @@
---
# Configurazione server NFS
- name: Installazione pacchetti specifici per NFS
apt:
name: "{{ item }}"
state: present
with_items:
- nfs-kernel-server
- rpcbind
become: yes
- name: Apro configurazione a sistemi remoti
lineinfile:
regexp: '^NEED_IDMAPD(.*)$'
line: 'NEED_IDMAPD=YES'
dest: /etc/defaults/nfs-common
state: present
become: yes
- name: Abilito rpcbind in tcpwrapper
lineinfile:
dest: /etc/hosts.allow
line: "rpcbind: ALL"
state: present
become: yes
- name: Riavvio il servizio rpcbind
service:
name: rpcbind
state: restarted
become: yes
- name: Creo directory per il backup
file:
path: /var/lib/backups
state: directory
owner: root
group: users
mode: 0775
become: yes
- name: Configuro nfs
copy:
src: exports
dest: /etc/exports
owner: root
group: root
mode: 0644
become: yes
- name: Ricarico servizio NFS
service:
name: nfs-kernel-server
state: reloaded
become: yes

View File

@ -0,0 +1,7 @@
---
- include: ssh-keygen.yml
tags: ssh
- include: packages.yml
tags: packages

View File

@ -0,0 +1,15 @@
---
- name: Ricarico i repository e aggiorno il sistema.
apt:
update_cache: yes
upgrade: full
cache_valid_time: 300
become: yes
- name: Installo pacchetti addizionali
apt:
name: "{{ item }}"
state: present
become: yes
with_items: '{{ addin_pkgs }}'

View File

@ -0,0 +1,20 @@
---
- name: Verifica presenza directory .ssh
shell: test -d $HOME/.ssh
register: check_sshdir
ignore_errors: true
- name: Creazione directory .ssh
shell: mkdir -p $HOME/.ssh
when: check_sshdir|failed
- name: Verifica chiave ssh
shell: test -f $HOME/.ssh/id_rsa
changed_when: false
ignore_errors: true
register: check_key
- name: Gestione creazione chiave ssh
shell: ssh-keygen -t rsa -b 1024 -f $HOME/.ssh/id_rsa -N ''
when: check_key|failed

View File

@ -0,0 +1,8 @@
---
addin_pkgs:
- git
- vim
- screen
- rsync
- logrotate
- localepurge

View File

@ -0,0 +1,6 @@
---
# Defaults for installation
host: archive.ubuntu.com
path: /ubuntu
shost: security.ubuntu.com
spath: /ubuntu

View File

@ -0,0 +1,3 @@
#!/bin/bash
apt-mirror >/var/log/apt-mirror.log 2>&1

View File

@ -0,0 +1,6 @@
/var/log/apt-mirror.log {
daily
rotate 15
compress
missingok
}

View File

@ -0,0 +1,28 @@
---
# Configurazione del server come repo
- name: Installazione apt-mirror
apt:
name: apt-mirror
state: present
become: yes
- name: Installazione configurazione apt-mirror
template:
src: apt-mirror.list
dest: /etc/apt-mirror.list
become: yes
- name: Installazione cron per sincronizzazione notturna
copy:
src: apt-mirror-cron
dest: /etc/cron.daily/apt-mirror
mode: 0755
become: yes
- name: Installazione logrotate per sincronizzazione notturna
copy:
src: apt-mirror-logrotate
dest: /etc/logrotate.d/apt-mirror
mode: 0644
become: yes

View File

@ -0,0 +1,6 @@
---
- include: local-mirror.yml
tags:
- mirror
- local-mirror

View File

@ -0,0 +1,88 @@
############# config ##################
#
# set base_path /var/spool/apt-mirror
#
# set path $base_path/mirror
# set skel_path $base_path/skel
# set var_path $base_path/var
# set cleanscript $var_path/clean.sh
# set defaultarch <running host architecture>
# set postmirror_script $var_path/postmirror.sh
# set run_postmirror 0
set nthreads 20
set _tilde 0
#set limit_rate 200k
#
############# end config ##############
#
# 14.04 LTS - Trusty Tahr
#
deb-i386 http://{{ host }}{{ path }} trusty main restricted universe multiverse
deb-i386 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
deb-i386 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
deb-i386 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
deb-i386 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
deb-amd64 http://{{ host }}{{ path }} trusty main restricted universe multiverse
deb-amd64 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
deb-amd64 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
deb-amd64 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
deb-amd64 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
deb-src http://{{ host }}{{ path }} trusty main restricted universe multiverse
deb-src http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
deb-src http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
deb-src http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
deb-src http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
deb-i386 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-i386 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-i386 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-i386 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-i386 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-amd64 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-amd64 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-amd64 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-amd64 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-amd64 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-i386 http://extras.ubuntu.com/ubuntu trusty main
deb-amd64 http://extras.ubuntu.com/ubuntu trusty main
deb-src http://extras.ubuntu.com/ubuntu trusty main
deb-i386 http://archive.canonical.com/ trusty partner
deb-i386 http://archive.canonical.com/ trusty-proposed partner
deb-amd64 http://archive.canonical.com/ trusty partner
deb-amd64 http://archive.canonical.com/ trusty-proposed partner
deb-i386 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
deb-i386 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-amd64 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
deb-amd64 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
deb-src http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
# Ansible
deb-i386 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main
deb-amd64 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main
# LibreOffice PPA
deb-i386 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
deb-amd64 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
deb-src http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
# sys42
deb-i386 http://bglug.sys42.eu/ubuntu trusty main
deb-amd64 http://bglug.sys42.eu/ubuntu trusty main
deb-src http://bglug.sys42.eu/ubuntu trusty main
clean http://{{ host }}{{ path }}
clean http://extras.ubuntu.com/ubuntu
clean http://archive.canonical.com
clean http://{{ shost }}{{ spath }}
clean http://ppa.launchpad.net/ansible/ansible/ubuntu
clean http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu
clean http://bglug.sys42.eu/ubuntu

7
setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- hosts: mirror
roles:
- setup
- ubuntu-mirror
- nfs