Initial working import.
This commit is contained in:
commit
96f402a807
25
README.md
Normal file
25
README.md
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# Ansible playbooks for a mirror + backup server #
|
||||||
|
|
||||||
|
## Progetto Scuola [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG Logo" /> BgLUG][bglug] - Scenary 1 ##
|
||||||
|
|
||||||
|
Starting from a configured Debian 8 machine, this playbooks install some stuff
|
||||||
|
required to set up a mirror for Ubuntu, that keeps syncronized itself during
|
||||||
|
the night.
|
||||||
|
|
||||||
|
They also configure some exports for NFS to share the repository and a
|
||||||
|
`backups` folder for backups.
|
||||||
|
|
||||||
|
### Quick start ###
|
||||||
|
|
||||||
|
Start with a basic Debian 8 machine, with python, sudo and ssh server installed.
|
||||||
|
Then allow your user to use sudo without passwords:
|
||||||
|
|
||||||
|
$ echo "${your_user} ALL = (ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers.d/${your_user}
|
||||||
|
|
||||||
|
Then you may use these playbooks as follows:
|
||||||
|
|
||||||
|
$ vim hosts
|
||||||
|
$ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub"
|
||||||
|
$ ansible-playbook setup.yml
|
||||||
|
|
||||||
|
[bglug]: http://bglug.it/ "BgLUG Homepage"
|
5
ansible.cfg
Normal file
5
ansible.cfg
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
[defaults]
|
||||||
|
host_key_checking=False
|
||||||
|
inventory=hosts
|
||||||
|
roles_path=roles
|
||||||
|
pipelining=True
|
5
hosts
Normal file
5
hosts
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
[defaults]
|
||||||
|
host_key_checking=false
|
||||||
|
|
||||||
|
[mirror]
|
||||||
|
mirror ansible_ssh_user=amgmt
|
7
init.yml
Normal file
7
init.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- hosts: mirror
|
||||||
|
vars:
|
||||||
|
- ansible_ssh_user: bglug
|
||||||
|
roles:
|
||||||
|
- init
|
4
roles/init/defaults/main.yml
Normal file
4
roles/init/defaults/main.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_ssh_user: root
|
||||||
|
admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub
|
7
roles/init/files/domain.fact
Normal file
7
roles/init/files/domain.fact
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
from yaml import load
|
||||||
|
from json import dumps
|
||||||
|
|
||||||
|
with open('/etc/domain.yml') as file:
|
||||||
|
print(dumps(load(file)))
|
4
roles/init/tasks/basepkg.yml
Normal file
4
roles/init/tasks/basepkg.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Installo prerequisiti per Ansible
|
||||||
|
shell: apt-get -y install python-apt aptitude
|
8
roles/init/tasks/main.yml
Normal file
8
roles/init/tasks/main.yml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
# Task basilari per la prima configurazione
|
||||||
|
|
||||||
|
- include: mgmtuser.yml
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- include: basepkg.yml
|
||||||
|
become: yes
|
21
roles/init/tasks/mgmtuser.yml
Normal file
21
roles/init/tasks/mgmtuser.yml
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
- name: Creazione account di gestione Ansible
|
||||||
|
user:
|
||||||
|
name: amgmt
|
||||||
|
comment: "Ansible Management User"
|
||||||
|
group: adm
|
||||||
|
state: present
|
||||||
|
password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
|
||||||
|
|
||||||
|
- name: Concessione diritti all'utente di gestione Ansible
|
||||||
|
template:
|
||||||
|
src: sudoers.d
|
||||||
|
dest: /etc/sudoers.d/amgmt
|
||||||
|
mode: "u=r,g=r"
|
||||||
|
validate: "/usr/sbin/visudo -cf %s"
|
||||||
|
|
||||||
|
- name: Installazione chiave privata PC locale
|
||||||
|
authorized_key:
|
||||||
|
user: amgmt
|
||||||
|
key: "{{ lookup('file', admin_sshkey) }}"
|
||||||
|
state: present
|
3
roles/init/templates/sudoers.d
Normal file
3
roles/init/templates/sudoers.d
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
# {{ ansible_managed }}
|
||||||
|
# Autorizzazione di gestione per l'utente di ansible
|
||||||
|
amgmt ALL=(ALL:ALL) NOPASSWD:ALL
|
2
roles/nfs/files/exports
Normal file
2
roles/nfs/files/exports
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
"/var/spool/apt-mirror" *(ro,sync,insecure,no_root_squash,no_subtree_check)
|
||||||
|
/var/lib/backups *(rw,sync,no_root_squash,subtree_check)
|
57
roles/nfs/tasks/main.yml
Normal file
57
roles/nfs/tasks/main.yml
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
# Configurazione server NFS
|
||||||
|
|
||||||
|
- name: Installazione pacchetti specifici per NFS
|
||||||
|
apt:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
with_items:
|
||||||
|
- nfs-kernel-server
|
||||||
|
- rpcbind
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Apro configurazione a sistemi remoti
|
||||||
|
lineinfile:
|
||||||
|
regexp: '^NEED_IDMAPD(.*)$'
|
||||||
|
line: 'NEED_IDMAPD=YES'
|
||||||
|
dest: /etc/defaults/nfs-common
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Abilito rpcbind in tcpwrapper
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/hosts.allow
|
||||||
|
line: "rpcbind: ALL"
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Riavvio il servizio rpcbind
|
||||||
|
service:
|
||||||
|
name: rpcbind
|
||||||
|
state: restarted
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Creo directory per il backup
|
||||||
|
file:
|
||||||
|
path: /var/lib/backups
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
group: users
|
||||||
|
mode: 0775
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Configuro nfs
|
||||||
|
copy:
|
||||||
|
src: exports
|
||||||
|
dest: /etc/exports
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0644
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Ricarico servizio NFS
|
||||||
|
service:
|
||||||
|
name: nfs-kernel-server
|
||||||
|
state: reloaded
|
||||||
|
become: yes
|
||||||
|
|
7
roles/setup/tasks/main.yml
Normal file
7
roles/setup/tasks/main.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- include: ssh-keygen.yml
|
||||||
|
tags: ssh
|
||||||
|
|
||||||
|
- include: packages.yml
|
||||||
|
tags: packages
|
15
roles/setup/tasks/packages.yml
Normal file
15
roles/setup/tasks/packages.yml
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Ricarico i repository e aggiorno il sistema.
|
||||||
|
apt:
|
||||||
|
update_cache: yes
|
||||||
|
upgrade: full
|
||||||
|
cache_valid_time: 300
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Installo pacchetti addizionali
|
||||||
|
apt:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
with_items: '{{ addin_pkgs }}'
|
20
roles/setup/tasks/ssh-keygen.yml
Normal file
20
roles/setup/tasks/ssh-keygen.yml
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Verifica presenza directory .ssh
|
||||||
|
shell: test -d $HOME/.ssh
|
||||||
|
register: check_sshdir
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: Creazione directory .ssh
|
||||||
|
shell: mkdir -p $HOME/.ssh
|
||||||
|
when: check_sshdir|failed
|
||||||
|
|
||||||
|
- name: Verifica chiave ssh
|
||||||
|
shell: test -f $HOME/.ssh/id_rsa
|
||||||
|
changed_when: false
|
||||||
|
ignore_errors: true
|
||||||
|
register: check_key
|
||||||
|
|
||||||
|
- name: Gestione creazione chiave ssh
|
||||||
|
shell: ssh-keygen -t rsa -b 1024 -f $HOME/.ssh/id_rsa -N ''
|
||||||
|
when: check_key|failed
|
8
roles/setup/vars/main.yml
Normal file
8
roles/setup/vars/main.yml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
addin_pkgs:
|
||||||
|
- git
|
||||||
|
- vim
|
||||||
|
- screen
|
||||||
|
- rsync
|
||||||
|
- logrotate
|
||||||
|
- localepurge
|
6
roles/ubuntu-mirror/defaults/main.yml
Normal file
6
roles/ubuntu-mirror/defaults/main.yml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
# Defaults for installation
|
||||||
|
host: archive.ubuntu.com
|
||||||
|
path: /ubuntu
|
||||||
|
shost: security.ubuntu.com
|
||||||
|
spath: /ubuntu
|
3
roles/ubuntu-mirror/files/apt-mirror-cron
Executable file
3
roles/ubuntu-mirror/files/apt-mirror-cron
Executable file
@ -0,0 +1,3 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
apt-mirror >/var/log/apt-mirror.log 2>&1
|
6
roles/ubuntu-mirror/files/apt-mirror-logrotate
Normal file
6
roles/ubuntu-mirror/files/apt-mirror-logrotate
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
/var/log/apt-mirror.log {
|
||||||
|
daily
|
||||||
|
rotate 15
|
||||||
|
compress
|
||||||
|
missingok
|
||||||
|
}
|
28
roles/ubuntu-mirror/tasks/local-mirror.yml
Normal file
28
roles/ubuntu-mirror/tasks/local-mirror.yml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
---
|
||||||
|
# Configurazione del server come repo
|
||||||
|
|
||||||
|
- name: Installazione apt-mirror
|
||||||
|
apt:
|
||||||
|
name: apt-mirror
|
||||||
|
state: present
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Installazione configurazione apt-mirror
|
||||||
|
template:
|
||||||
|
src: apt-mirror.list
|
||||||
|
dest: /etc/apt-mirror.list
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Installazione cron per sincronizzazione notturna
|
||||||
|
copy:
|
||||||
|
src: apt-mirror-cron
|
||||||
|
dest: /etc/cron.daily/apt-mirror
|
||||||
|
mode: 0755
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
- name: Installazione logrotate per sincronizzazione notturna
|
||||||
|
copy:
|
||||||
|
src: apt-mirror-logrotate
|
||||||
|
dest: /etc/logrotate.d/apt-mirror
|
||||||
|
mode: 0644
|
||||||
|
become: yes
|
6
roles/ubuntu-mirror/tasks/main.yml
Normal file
6
roles/ubuntu-mirror/tasks/main.yml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- include: local-mirror.yml
|
||||||
|
tags:
|
||||||
|
- mirror
|
||||||
|
- local-mirror
|
88
roles/ubuntu-mirror/templates/apt-mirror.list
Normal file
88
roles/ubuntu-mirror/templates/apt-mirror.list
Normal file
@ -0,0 +1,88 @@
|
|||||||
|
############# config ##################
|
||||||
|
#
|
||||||
|
# set base_path /var/spool/apt-mirror
|
||||||
|
#
|
||||||
|
# set path $base_path/mirror
|
||||||
|
# set skel_path $base_path/skel
|
||||||
|
# set var_path $base_path/var
|
||||||
|
# set cleanscript $var_path/clean.sh
|
||||||
|
# set defaultarch <running host architecture>
|
||||||
|
# set postmirror_script $var_path/postmirror.sh
|
||||||
|
# set run_postmirror 0
|
||||||
|
set nthreads 20
|
||||||
|
set _tilde 0
|
||||||
|
#set limit_rate 200k
|
||||||
|
#
|
||||||
|
############# end config ##############
|
||||||
|
|
||||||
|
#
|
||||||
|
# 14.04 LTS - Trusty Tahr
|
||||||
|
#
|
||||||
|
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty main restricted universe multiverse
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
|
||||||
|
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty main restricted universe multiverse
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
|
||||||
|
|
||||||
|
deb-src http://{{ host }}{{ path }} trusty main restricted universe multiverse
|
||||||
|
deb-src http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
|
||||||
|
deb-src http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
|
||||||
|
deb-src http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
|
||||||
|
deb-src http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
|
||||||
|
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-i386 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-amd64 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
|
||||||
|
deb-i386 http://extras.ubuntu.com/ubuntu trusty main
|
||||||
|
deb-amd64 http://extras.ubuntu.com/ubuntu trusty main
|
||||||
|
deb-src http://extras.ubuntu.com/ubuntu trusty main
|
||||||
|
|
||||||
|
deb-i386 http://archive.canonical.com/ trusty partner
|
||||||
|
deb-i386 http://archive.canonical.com/ trusty-proposed partner
|
||||||
|
|
||||||
|
deb-amd64 http://archive.canonical.com/ trusty partner
|
||||||
|
deb-amd64 http://archive.canonical.com/ trusty-proposed partner
|
||||||
|
|
||||||
|
deb-i386 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
|
||||||
|
deb-i386 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-amd64 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
|
||||||
|
deb-amd64 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||||
|
deb-src http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
|
||||||
|
|
||||||
|
# Ansible
|
||||||
|
deb-i386 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main
|
||||||
|
deb-amd64 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main
|
||||||
|
|
||||||
|
# LibreOffice PPA
|
||||||
|
deb-i386 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
|
||||||
|
deb-amd64 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
|
||||||
|
deb-src http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
|
||||||
|
|
||||||
|
# sys42
|
||||||
|
deb-i386 http://bglug.sys42.eu/ubuntu trusty main
|
||||||
|
deb-amd64 http://bglug.sys42.eu/ubuntu trusty main
|
||||||
|
deb-src http://bglug.sys42.eu/ubuntu trusty main
|
||||||
|
|
||||||
|
clean http://{{ host }}{{ path }}
|
||||||
|
clean http://extras.ubuntu.com/ubuntu
|
||||||
|
clean http://archive.canonical.com
|
||||||
|
clean http://{{ shost }}{{ spath }}
|
||||||
|
clean http://ppa.launchpad.net/ansible/ansible/ubuntu
|
||||||
|
clean http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu
|
||||||
|
clean http://bglug.sys42.eu/ubuntu
|
Loading…
x
Reference in New Issue
Block a user