commit 96f402a807a5b3a4da38d0736dcdf44bbbc4c1df Author: Emiliano Vavassori Date: Thu Mar 10 23:43:40 2016 +0100 Initial working import. diff --git a/README.md b/README.md new file mode 100644 index 0000000..51163ae --- /dev/null +++ b/README.md @@ -0,0 +1,25 @@ +# Ansible playbooks for a mirror + backup server # + +## Progetto Scuola [BgLUG Logo BgLUG][bglug] - Scenary 1 ## + +Starting from a configured Debian 8 machine, this playbooks install some stuff +required to set up a mirror for Ubuntu, that keeps syncronized itself during +the night. + +They also configure some exports for NFS to share the repository and a +`backups` folder for backups. + +### Quick start ### + +Start with a basic Debian 8 machine, with python, sudo and ssh server installed. +Then allow your user to use sudo without passwords: + + $ echo "${your_user} ALL = (ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers.d/${your_user} + +Then you may use these playbooks as follows: + + $ vim hosts + $ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub" + $ ansible-playbook setup.yml + +[bglug]: http://bglug.it/ "BgLUG Homepage" diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..31ee71b --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,5 @@ +[defaults] +host_key_checking=False +inventory=hosts +roles_path=roles +pipelining=True diff --git a/hosts b/hosts new file mode 100644 index 0000000..03008fe --- /dev/null +++ b/hosts @@ -0,0 +1,5 @@ +[defaults] +host_key_checking=false + +[mirror] +mirror ansible_ssh_user=amgmt diff --git a/init.yml b/init.yml new file mode 100644 index 0000000..90c70f5 --- /dev/null +++ b/init.yml @@ -0,0 +1,7 @@ +--- + +- hosts: mirror + vars: + - ansible_ssh_user: bglug + roles: + - init diff --git a/roles/init/defaults/main.yml b/roles/init/defaults/main.yml new file mode 100644 index 0000000..0f66ae8 --- /dev/null +++ b/roles/init/defaults/main.yml @@ -0,0 +1,4 @@ +--- + +ansible_ssh_user: root +admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub diff --git a/roles/init/files/domain.fact b/roles/init/files/domain.fact new file mode 100644 index 0000000..7f4612c --- /dev/null +++ b/roles/init/files/domain.fact @@ -0,0 +1,7 @@ +#!/usr/bin/env python + +from yaml import load +from json import dumps + +with open('/etc/domain.yml') as file: + print(dumps(load(file))) diff --git a/roles/init/tasks/basepkg.yml b/roles/init/tasks/basepkg.yml new file mode 100644 index 0000000..c62b201 --- /dev/null +++ b/roles/init/tasks/basepkg.yml @@ -0,0 +1,4 @@ +--- + +- name: Installo prerequisiti per Ansible + shell: apt-get -y install python-apt aptitude diff --git a/roles/init/tasks/main.yml b/roles/init/tasks/main.yml new file mode 100644 index 0000000..0fc2bfc --- /dev/null +++ b/roles/init/tasks/main.yml @@ -0,0 +1,8 @@ +--- +# Task basilari per la prima configurazione + +- include: mgmtuser.yml + become: yes + +- include: basepkg.yml + become: yes diff --git a/roles/init/tasks/mgmtuser.yml b/roles/init/tasks/mgmtuser.yml new file mode 100644 index 0000000..1f6e262 --- /dev/null +++ b/roles/init/tasks/mgmtuser.yml @@ -0,0 +1,21 @@ +--- +- name: Creazione account di gestione Ansible + user: + name: amgmt + comment: "Ansible Management User" + group: adm + state: present + password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k. + +- name: Concessione diritti all'utente di gestione Ansible + template: + src: sudoers.d + dest: /etc/sudoers.d/amgmt + mode: "u=r,g=r" + validate: "/usr/sbin/visudo -cf %s" + +- name: Installazione chiave privata PC locale + authorized_key: + user: amgmt + key: "{{ lookup('file', admin_sshkey) }}" + state: present diff --git a/roles/init/templates/sudoers.d b/roles/init/templates/sudoers.d new file mode 100644 index 0000000..ea85220 --- /dev/null +++ b/roles/init/templates/sudoers.d @@ -0,0 +1,3 @@ +# {{ ansible_managed }} +# Autorizzazione di gestione per l'utente di ansible +amgmt ALL=(ALL:ALL) NOPASSWD:ALL diff --git a/roles/nfs/files/exports b/roles/nfs/files/exports new file mode 100644 index 0000000..ee15692 --- /dev/null +++ b/roles/nfs/files/exports @@ -0,0 +1,2 @@ +"/var/spool/apt-mirror" *(ro,sync,insecure,no_root_squash,no_subtree_check) +/var/lib/backups *(rw,sync,no_root_squash,subtree_check) diff --git a/roles/nfs/tasks/main.yml b/roles/nfs/tasks/main.yml new file mode 100644 index 0000000..de2ee49 --- /dev/null +++ b/roles/nfs/tasks/main.yml @@ -0,0 +1,57 @@ +--- +# Configurazione server NFS + +- name: Installazione pacchetti specifici per NFS + apt: + name: "{{ item }}" + state: present + with_items: + - nfs-kernel-server + - rpcbind + become: yes + +- name: Apro configurazione a sistemi remoti + lineinfile: + regexp: '^NEED_IDMAPD(.*)$' + line: 'NEED_IDMAPD=YES' + dest: /etc/defaults/nfs-common + state: present + become: yes + +- name: Abilito rpcbind in tcpwrapper + lineinfile: + dest: /etc/hosts.allow + line: "rpcbind: ALL" + state: present + become: yes + +- name: Riavvio il servizio rpcbind + service: + name: rpcbind + state: restarted + become: yes + +- name: Creo directory per il backup + file: + path: /var/lib/backups + state: directory + owner: root + group: users + mode: 0775 + become: yes + +- name: Configuro nfs + copy: + src: exports + dest: /etc/exports + owner: root + group: root + mode: 0644 + become: yes + +- name: Ricarico servizio NFS + service: + name: nfs-kernel-server + state: reloaded + become: yes + diff --git a/roles/setup/tasks/main.yml b/roles/setup/tasks/main.yml new file mode 100644 index 0000000..580c375 --- /dev/null +++ b/roles/setup/tasks/main.yml @@ -0,0 +1,7 @@ +--- + +- include: ssh-keygen.yml + tags: ssh + +- include: packages.yml + tags: packages diff --git a/roles/setup/tasks/packages.yml b/roles/setup/tasks/packages.yml new file mode 100644 index 0000000..a218d85 --- /dev/null +++ b/roles/setup/tasks/packages.yml @@ -0,0 +1,15 @@ +--- + +- name: Ricarico i repository e aggiorno il sistema. + apt: + update_cache: yes + upgrade: full + cache_valid_time: 300 + become: yes + +- name: Installo pacchetti addizionali + apt: + name: "{{ item }}" + state: present + become: yes + with_items: '{{ addin_pkgs }}' diff --git a/roles/setup/tasks/ssh-keygen.yml b/roles/setup/tasks/ssh-keygen.yml new file mode 100644 index 0000000..504cd86 --- /dev/null +++ b/roles/setup/tasks/ssh-keygen.yml @@ -0,0 +1,20 @@ +--- + +- name: Verifica presenza directory .ssh + shell: test -d $HOME/.ssh + register: check_sshdir + ignore_errors: true + +- name: Creazione directory .ssh + shell: mkdir -p $HOME/.ssh + when: check_sshdir|failed + +- name: Verifica chiave ssh + shell: test -f $HOME/.ssh/id_rsa + changed_when: false + ignore_errors: true + register: check_key + +- name: Gestione creazione chiave ssh + shell: ssh-keygen -t rsa -b 1024 -f $HOME/.ssh/id_rsa -N '' + when: check_key|failed diff --git a/roles/setup/vars/main.yml b/roles/setup/vars/main.yml new file mode 100644 index 0000000..745b581 --- /dev/null +++ b/roles/setup/vars/main.yml @@ -0,0 +1,8 @@ +--- +addin_pkgs: + - git + - vim + - screen + - rsync + - logrotate + - localepurge diff --git a/roles/ubuntu-mirror/defaults/main.yml b/roles/ubuntu-mirror/defaults/main.yml new file mode 100644 index 0000000..689abd1 --- /dev/null +++ b/roles/ubuntu-mirror/defaults/main.yml @@ -0,0 +1,6 @@ +--- +# Defaults for installation +host: archive.ubuntu.com +path: /ubuntu +shost: security.ubuntu.com +spath: /ubuntu diff --git a/roles/ubuntu-mirror/files/apt-mirror-cron b/roles/ubuntu-mirror/files/apt-mirror-cron new file mode 100755 index 0000000..f4932d5 --- /dev/null +++ b/roles/ubuntu-mirror/files/apt-mirror-cron @@ -0,0 +1,3 @@ +#!/bin/bash + +apt-mirror >/var/log/apt-mirror.log 2>&1 diff --git a/roles/ubuntu-mirror/files/apt-mirror-logrotate b/roles/ubuntu-mirror/files/apt-mirror-logrotate new file mode 100644 index 0000000..83dae13 --- /dev/null +++ b/roles/ubuntu-mirror/files/apt-mirror-logrotate @@ -0,0 +1,6 @@ +/var/log/apt-mirror.log { + daily + rotate 15 + compress + missingok +} diff --git a/roles/ubuntu-mirror/tasks/local-mirror.yml b/roles/ubuntu-mirror/tasks/local-mirror.yml new file mode 100644 index 0000000..76cf748 --- /dev/null +++ b/roles/ubuntu-mirror/tasks/local-mirror.yml @@ -0,0 +1,28 @@ +--- +# Configurazione del server come repo + +- name: Installazione apt-mirror + apt: + name: apt-mirror + state: present + become: yes + +- name: Installazione configurazione apt-mirror + template: + src: apt-mirror.list + dest: /etc/apt-mirror.list + become: yes + +- name: Installazione cron per sincronizzazione notturna + copy: + src: apt-mirror-cron + dest: /etc/cron.daily/apt-mirror + mode: 0755 + become: yes + +- name: Installazione logrotate per sincronizzazione notturna + copy: + src: apt-mirror-logrotate + dest: /etc/logrotate.d/apt-mirror + mode: 0644 + become: yes diff --git a/roles/ubuntu-mirror/tasks/main.yml b/roles/ubuntu-mirror/tasks/main.yml new file mode 100644 index 0000000..a97166e --- /dev/null +++ b/roles/ubuntu-mirror/tasks/main.yml @@ -0,0 +1,6 @@ +--- + +- include: local-mirror.yml + tags: + - mirror + - local-mirror diff --git a/roles/ubuntu-mirror/templates/apt-mirror.list b/roles/ubuntu-mirror/templates/apt-mirror.list new file mode 100644 index 0000000..e8192bb --- /dev/null +++ b/roles/ubuntu-mirror/templates/apt-mirror.list @@ -0,0 +1,88 @@ +############# config ################## +# +# set base_path /var/spool/apt-mirror +# +# set path $base_path/mirror +# set skel_path $base_path/skel +# set var_path $base_path/var +# set cleanscript $var_path/clean.sh +# set defaultarch +# set postmirror_script $var_path/postmirror.sh +# set run_postmirror 0 +set nthreads 20 +set _tilde 0 +#set limit_rate 200k +# +############# end config ############## + +# +# 14.04 LTS - Trusty Tahr +# + +deb-i386 http://{{ host }}{{ path }} trusty main restricted universe multiverse +deb-i386 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse +deb-i386 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse +deb-i386 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse +deb-i386 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse + +deb-amd64 http://{{ host }}{{ path }} trusty main restricted universe multiverse +deb-amd64 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse +deb-amd64 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse +deb-amd64 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse +deb-amd64 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse + +deb-src http://{{ host }}{{ path }} trusty main restricted universe multiverse +deb-src http://{{ host }}{{ path }} trusty-security main restricted universe multiverse +deb-src http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse +deb-src http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse +deb-src http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse + +deb-i386 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-i386 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-i386 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-i386 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-i386 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer + +deb-amd64 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-amd64 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-amd64 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-amd64 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-amd64 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer + +deb-i386 http://extras.ubuntu.com/ubuntu trusty main +deb-amd64 http://extras.ubuntu.com/ubuntu trusty main +deb-src http://extras.ubuntu.com/ubuntu trusty main + +deb-i386 http://archive.canonical.com/ trusty partner +deb-i386 http://archive.canonical.com/ trusty-proposed partner + +deb-amd64 http://archive.canonical.com/ trusty partner +deb-amd64 http://archive.canonical.com/ trusty-proposed partner + +deb-i386 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse +deb-i386 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-amd64 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse +deb-amd64 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer +deb-src http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse + +# Ansible +deb-i386 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main +deb-amd64 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main + +# LibreOffice PPA +deb-i386 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main +deb-amd64 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main +deb-src http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main + +# sys42 +deb-i386 http://bglug.sys42.eu/ubuntu trusty main +deb-amd64 http://bglug.sys42.eu/ubuntu trusty main +deb-src http://bglug.sys42.eu/ubuntu trusty main + +clean http://{{ host }}{{ path }} +clean http://extras.ubuntu.com/ubuntu +clean http://archive.canonical.com +clean http://{{ shost }}{{ spath }} +clean http://ppa.launchpad.net/ansible/ansible/ubuntu +clean http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu +clean http://bglug.sys42.eu/ubuntu diff --git a/setup.yml b/setup.yml new file mode 100644 index 0000000..3bc6eaa --- /dev/null +++ b/setup.yml @@ -0,0 +1,7 @@ +--- + +- hosts: mirror + roles: + - setup + - ubuntu-mirror + - nfs