Initial working import.
This commit is contained in:
commit
96f402a807
25
README.md
Normal file
25
README.md
Normal file
@ -0,0 +1,25 @@
|
||||
# Ansible playbooks for a mirror + backup server #
|
||||
|
||||
## Progetto Scuola [<img src="https://avatars1.githubusercontent.com/u/12886037?v=3&s=200" width="25" height="25" alt="BgLUG Logo" /> BgLUG][bglug] - Scenary 1 ##
|
||||
|
||||
Starting from a configured Debian 8 machine, this playbooks install some stuff
|
||||
required to set up a mirror for Ubuntu, that keeps syncronized itself during
|
||||
the night.
|
||||
|
||||
They also configure some exports for NFS to share the repository and a
|
||||
`backups` folder for backups.
|
||||
|
||||
### Quick start ###
|
||||
|
||||
Start with a basic Debian 8 machine, with python, sudo and ssh server installed.
|
||||
Then allow your user to use sudo without passwords:
|
||||
|
||||
$ echo "${your_user} ALL = (ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers.d/${your_user}
|
||||
|
||||
Then you may use these playbooks as follows:
|
||||
|
||||
$ vim hosts
|
||||
$ ansible-playbook init.yml --ask-pass -e "admin_sshkey=/path/to/id_rsa.pub"
|
||||
$ ansible-playbook setup.yml
|
||||
|
||||
[bglug]: http://bglug.it/ "BgLUG Homepage"
|
5
ansible.cfg
Normal file
5
ansible.cfg
Normal file
@ -0,0 +1,5 @@
|
||||
[defaults]
|
||||
host_key_checking=False
|
||||
inventory=hosts
|
||||
roles_path=roles
|
||||
pipelining=True
|
5
hosts
Normal file
5
hosts
Normal file
@ -0,0 +1,5 @@
|
||||
[defaults]
|
||||
host_key_checking=false
|
||||
|
||||
[mirror]
|
||||
mirror ansible_ssh_user=amgmt
|
7
init.yml
Normal file
7
init.yml
Normal file
@ -0,0 +1,7 @@
|
||||
---
|
||||
|
||||
- hosts: mirror
|
||||
vars:
|
||||
- ansible_ssh_user: bglug
|
||||
roles:
|
||||
- init
|
4
roles/init/defaults/main.yml
Normal file
4
roles/init/defaults/main.yml
Normal file
@ -0,0 +1,4 @@
|
||||
---
|
||||
|
||||
ansible_ssh_user: root
|
||||
admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub
|
7
roles/init/files/domain.fact
Normal file
7
roles/init/files/domain.fact
Normal file
@ -0,0 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
from yaml import load
|
||||
from json import dumps
|
||||
|
||||
with open('/etc/domain.yml') as file:
|
||||
print(dumps(load(file)))
|
4
roles/init/tasks/basepkg.yml
Normal file
4
roles/init/tasks/basepkg.yml
Normal file
@ -0,0 +1,4 @@
|
||||
---
|
||||
|
||||
- name: Installo prerequisiti per Ansible
|
||||
shell: apt-get -y install python-apt aptitude
|
8
roles/init/tasks/main.yml
Normal file
8
roles/init/tasks/main.yml
Normal file
@ -0,0 +1,8 @@
|
||||
---
|
||||
# Task basilari per la prima configurazione
|
||||
|
||||
- include: mgmtuser.yml
|
||||
become: yes
|
||||
|
||||
- include: basepkg.yml
|
||||
become: yes
|
21
roles/init/tasks/mgmtuser.yml
Normal file
21
roles/init/tasks/mgmtuser.yml
Normal file
@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Creazione account di gestione Ansible
|
||||
user:
|
||||
name: amgmt
|
||||
comment: "Ansible Management User"
|
||||
group: adm
|
||||
state: present
|
||||
password: $6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
|
||||
|
||||
- name: Concessione diritti all'utente di gestione Ansible
|
||||
template:
|
||||
src: sudoers.d
|
||||
dest: /etc/sudoers.d/amgmt
|
||||
mode: "u=r,g=r"
|
||||
validate: "/usr/sbin/visudo -cf %s"
|
||||
|
||||
- name: Installazione chiave privata PC locale
|
||||
authorized_key:
|
||||
user: amgmt
|
||||
key: "{{ lookup('file', admin_sshkey) }}"
|
||||
state: present
|
3
roles/init/templates/sudoers.d
Normal file
3
roles/init/templates/sudoers.d
Normal file
@ -0,0 +1,3 @@
|
||||
# {{ ansible_managed }}
|
||||
# Autorizzazione di gestione per l'utente di ansible
|
||||
amgmt ALL=(ALL:ALL) NOPASSWD:ALL
|
2
roles/nfs/files/exports
Normal file
2
roles/nfs/files/exports
Normal file
@ -0,0 +1,2 @@
|
||||
"/var/spool/apt-mirror" *(ro,sync,insecure,no_root_squash,no_subtree_check)
|
||||
/var/lib/backups *(rw,sync,no_root_squash,subtree_check)
|
57
roles/nfs/tasks/main.yml
Normal file
57
roles/nfs/tasks/main.yml
Normal file
@ -0,0 +1,57 @@
|
||||
---
|
||||
# Configurazione server NFS
|
||||
|
||||
- name: Installazione pacchetti specifici per NFS
|
||||
apt:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items:
|
||||
- nfs-kernel-server
|
||||
- rpcbind
|
||||
become: yes
|
||||
|
||||
- name: Apro configurazione a sistemi remoti
|
||||
lineinfile:
|
||||
regexp: '^NEED_IDMAPD(.*)$'
|
||||
line: 'NEED_IDMAPD=YES'
|
||||
dest: /etc/defaults/nfs-common
|
||||
state: present
|
||||
become: yes
|
||||
|
||||
- name: Abilito rpcbind in tcpwrapper
|
||||
lineinfile:
|
||||
dest: /etc/hosts.allow
|
||||
line: "rpcbind: ALL"
|
||||
state: present
|
||||
become: yes
|
||||
|
||||
- name: Riavvio il servizio rpcbind
|
||||
service:
|
||||
name: rpcbind
|
||||
state: restarted
|
||||
become: yes
|
||||
|
||||
- name: Creo directory per il backup
|
||||
file:
|
||||
path: /var/lib/backups
|
||||
state: directory
|
||||
owner: root
|
||||
group: users
|
||||
mode: 0775
|
||||
become: yes
|
||||
|
||||
- name: Configuro nfs
|
||||
copy:
|
||||
src: exports
|
||||
dest: /etc/exports
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
become: yes
|
||||
|
||||
- name: Ricarico servizio NFS
|
||||
service:
|
||||
name: nfs-kernel-server
|
||||
state: reloaded
|
||||
become: yes
|
||||
|
7
roles/setup/tasks/main.yml
Normal file
7
roles/setup/tasks/main.yml
Normal file
@ -0,0 +1,7 @@
|
||||
---
|
||||
|
||||
- include: ssh-keygen.yml
|
||||
tags: ssh
|
||||
|
||||
- include: packages.yml
|
||||
tags: packages
|
15
roles/setup/tasks/packages.yml
Normal file
15
roles/setup/tasks/packages.yml
Normal file
@ -0,0 +1,15 @@
|
||||
---
|
||||
|
||||
- name: Ricarico i repository e aggiorno il sistema.
|
||||
apt:
|
||||
update_cache: yes
|
||||
upgrade: full
|
||||
cache_valid_time: 300
|
||||
become: yes
|
||||
|
||||
- name: Installo pacchetti addizionali
|
||||
apt:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
become: yes
|
||||
with_items: '{{ addin_pkgs }}'
|
20
roles/setup/tasks/ssh-keygen.yml
Normal file
20
roles/setup/tasks/ssh-keygen.yml
Normal file
@ -0,0 +1,20 @@
|
||||
---
|
||||
|
||||
- name: Verifica presenza directory .ssh
|
||||
shell: test -d $HOME/.ssh
|
||||
register: check_sshdir
|
||||
ignore_errors: true
|
||||
|
||||
- name: Creazione directory .ssh
|
||||
shell: mkdir -p $HOME/.ssh
|
||||
when: check_sshdir|failed
|
||||
|
||||
- name: Verifica chiave ssh
|
||||
shell: test -f $HOME/.ssh/id_rsa
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
register: check_key
|
||||
|
||||
- name: Gestione creazione chiave ssh
|
||||
shell: ssh-keygen -t rsa -b 1024 -f $HOME/.ssh/id_rsa -N ''
|
||||
when: check_key|failed
|
8
roles/setup/vars/main.yml
Normal file
8
roles/setup/vars/main.yml
Normal file
@ -0,0 +1,8 @@
|
||||
---
|
||||
addin_pkgs:
|
||||
- git
|
||||
- vim
|
||||
- screen
|
||||
- rsync
|
||||
- logrotate
|
||||
- localepurge
|
6
roles/ubuntu-mirror/defaults/main.yml
Normal file
6
roles/ubuntu-mirror/defaults/main.yml
Normal file
@ -0,0 +1,6 @@
|
||||
---
|
||||
# Defaults for installation
|
||||
host: archive.ubuntu.com
|
||||
path: /ubuntu
|
||||
shost: security.ubuntu.com
|
||||
spath: /ubuntu
|
3
roles/ubuntu-mirror/files/apt-mirror-cron
Executable file
3
roles/ubuntu-mirror/files/apt-mirror-cron
Executable file
@ -0,0 +1,3 @@
|
||||
#!/bin/bash
|
||||
|
||||
apt-mirror >/var/log/apt-mirror.log 2>&1
|
6
roles/ubuntu-mirror/files/apt-mirror-logrotate
Normal file
6
roles/ubuntu-mirror/files/apt-mirror-logrotate
Normal file
@ -0,0 +1,6 @@
|
||||
/var/log/apt-mirror.log {
|
||||
daily
|
||||
rotate 15
|
||||
compress
|
||||
missingok
|
||||
}
|
28
roles/ubuntu-mirror/tasks/local-mirror.yml
Normal file
28
roles/ubuntu-mirror/tasks/local-mirror.yml
Normal file
@ -0,0 +1,28 @@
|
||||
---
|
||||
# Configurazione del server come repo
|
||||
|
||||
- name: Installazione apt-mirror
|
||||
apt:
|
||||
name: apt-mirror
|
||||
state: present
|
||||
become: yes
|
||||
|
||||
- name: Installazione configurazione apt-mirror
|
||||
template:
|
||||
src: apt-mirror.list
|
||||
dest: /etc/apt-mirror.list
|
||||
become: yes
|
||||
|
||||
- name: Installazione cron per sincronizzazione notturna
|
||||
copy:
|
||||
src: apt-mirror-cron
|
||||
dest: /etc/cron.daily/apt-mirror
|
||||
mode: 0755
|
||||
become: yes
|
||||
|
||||
- name: Installazione logrotate per sincronizzazione notturna
|
||||
copy:
|
||||
src: apt-mirror-logrotate
|
||||
dest: /etc/logrotate.d/apt-mirror
|
||||
mode: 0644
|
||||
become: yes
|
6
roles/ubuntu-mirror/tasks/main.yml
Normal file
6
roles/ubuntu-mirror/tasks/main.yml
Normal file
@ -0,0 +1,6 @@
|
||||
---
|
||||
|
||||
- include: local-mirror.yml
|
||||
tags:
|
||||
- mirror
|
||||
- local-mirror
|
88
roles/ubuntu-mirror/templates/apt-mirror.list
Normal file
88
roles/ubuntu-mirror/templates/apt-mirror.list
Normal file
@ -0,0 +1,88 @@
|
||||
############# config ##################
|
||||
#
|
||||
# set base_path /var/spool/apt-mirror
|
||||
#
|
||||
# set path $base_path/mirror
|
||||
# set skel_path $base_path/skel
|
||||
# set var_path $base_path/var
|
||||
# set cleanscript $var_path/clean.sh
|
||||
# set defaultarch <running host architecture>
|
||||
# set postmirror_script $var_path/postmirror.sh
|
||||
# set run_postmirror 0
|
||||
set nthreads 20
|
||||
set _tilde 0
|
||||
#set limit_rate 200k
|
||||
#
|
||||
############# end config ##############
|
||||
|
||||
#
|
||||
# 14.04 LTS - Trusty Tahr
|
||||
#
|
||||
|
||||
deb-i386 http://{{ host }}{{ path }} trusty main restricted universe multiverse
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
|
||||
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty main restricted universe multiverse
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
|
||||
|
||||
deb-src http://{{ host }}{{ path }} trusty main restricted universe multiverse
|
||||
deb-src http://{{ host }}{{ path }} trusty-security main restricted universe multiverse
|
||||
deb-src http://{{ host }}{{ path }} trusty-updates main restricted universe multiverse
|
||||
deb-src http://{{ host }}{{ path }} trusty-proposed main restricted universe multiverse
|
||||
deb-src http://{{ host }}{{ path }} trusty-backports main restricted universe multiverse
|
||||
|
||||
deb-i386 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-i386 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-updates main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-proposed main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-amd64 http://{{ host }}{{ path }} trusty-backports main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
|
||||
deb-i386 http://extras.ubuntu.com/ubuntu trusty main
|
||||
deb-amd64 http://extras.ubuntu.com/ubuntu trusty main
|
||||
deb-src http://extras.ubuntu.com/ubuntu trusty main
|
||||
|
||||
deb-i386 http://archive.canonical.com/ trusty partner
|
||||
deb-i386 http://archive.canonical.com/ trusty-proposed partner
|
||||
|
||||
deb-amd64 http://archive.canonical.com/ trusty partner
|
||||
deb-amd64 http://archive.canonical.com/ trusty-proposed partner
|
||||
|
||||
deb-i386 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
|
||||
deb-i386 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-amd64 http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
|
||||
deb-amd64 http://{{ shost }}{{ spath }} trusty-security main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer
|
||||
deb-src http://{{ shost }}{{ spath }} trusty-security main restricted universe multiverse
|
||||
|
||||
# Ansible
|
||||
deb-i386 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main
|
||||
deb-amd64 http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main
|
||||
|
||||
# LibreOffice PPA
|
||||
deb-i386 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
|
||||
deb-amd64 http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
|
||||
deb-src http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu trusty main
|
||||
|
||||
# sys42
|
||||
deb-i386 http://bglug.sys42.eu/ubuntu trusty main
|
||||
deb-amd64 http://bglug.sys42.eu/ubuntu trusty main
|
||||
deb-src http://bglug.sys42.eu/ubuntu trusty main
|
||||
|
||||
clean http://{{ host }}{{ path }}
|
||||
clean http://extras.ubuntu.com/ubuntu
|
||||
clean http://archive.canonical.com
|
||||
clean http://{{ shost }}{{ spath }}
|
||||
clean http://ppa.launchpad.net/ansible/ansible/ubuntu
|
||||
clean http://ppa.launchpad.net/libreoffice/libreoffice-5-0/ubuntu
|
||||
clean http://bglug.sys42.eu/ubuntu
|
Loading…
x
Reference in New Issue
Block a user