diff --git a/roles/nethcfg/tasks/base.yml b/roles/nethcfg/tasks/base.yml new file mode 100644 index 0000000..f8b2345 --- /dev/null +++ b/roles/nethcfg/tasks/base.yml @@ -0,0 +1,80 @@ +--- +# Base configurations to be implemented anyways. + +# Trusted networks: LAN + +- name: Check for LAN to be added as Trusted Network + shell: /sbin/e-smith/db networks printprop {{ ansible_local.domain.servernet }} Description + register: check_trusted + changed_when: '"Description=Local LAN" not in check_trusted.stdout' + ignore_errors: yes + tags: trustednet + +- name: Configuring trusted networks + shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }} + when: check_trusted|changed + tags: trustednet + +- name: Activating trusted network + shell: /sbin/e-smith/signal-event trusted-networks-modify + when: check_trusted|changed + tags: trustednet + +# Hostname and domainname + +- name: Configuring hostname + shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }} + register: chg_hostname + when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'" + tags: hostname + +- name: Configuring domain name + shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }} + register: chg_domainname + when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'" + tags: domainname + +- name: Activating hostname/domainname changes + shell: /sbin/e-smith/signal-event hostname-modify + when: chg_hostname|changed or chg_domainname|changed + tags: + - hostname + - domainname + +# Password policy + +- name: Check for password policy + shell: /sbin/e-smith/db configuration printprop passwordstrength Users + register: chk_passstr + changed_when: "'Users=none' not in chk_passstr.stdout" + ignore_errors: true + tags: password-policy + +- name: Configuring password policy + shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7 + when: chk_passstr|changed + tags: password-policy + +- name: Activating password policy + shell: /sbin/e-smith/signal-event password-policy-update + when: chk_passstr|changed + tags: password-policy + +# Base certificate + +- name: Checking CA configuration + shell: /sbin/e-smith/db configuration printprop pki CommonName + ignore_errors: true + register: chk_crt + changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout" + tags: regen-ca + +- name: Configuring CA + shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}" + tags: regen-ca + when: chk_crt|changed or force_regen_ca|bool + +- name: Activating CA and regenerate + shell: /sbin/e-smith/signal-event certificate-update + when: chk_crt|changed or force_regen_ca|bool + tags: regen-ca diff --git a/roles/nethcfg/tasks/dhcpdns.yml b/roles/nethcfg/tasks/dhcpdns.yml new file mode 100644 index 0000000..7df099d --- /dev/null +++ b/roles/nethcfg/tasks/dhcpdns.yml @@ -0,0 +1,45 @@ +--- +# Installing and configuring DHCP and DNS + +- name: Installing DHCP and DNS related NethServer packages. + yum: + name: nethserver-dnsmasq + state: present + +# DHCP + +- name: Checking DHCP configuration + shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart + ignore_errors: true + register: chk_dhcp + +- name: Configuring DHCP + shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled + when: chk_dhcp|failed + +- name: Activating DHCP + shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save + when: chk_dhcp|failed + +# DNS + +- name: Checking DNS configuration + shell: /sbin/e-smith/db configuration printprop dns NameServers + register: chk_dns + changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}' not in chk_dns.stdout" + ignore_errors: yes + +- name: Configuring DNS + shell: /sbin/e-smith/db configuration setprop dns role resolver NameServers "{{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}" + when: chk_dns|changed + +- name: Activating DNS + shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save + when: chk_dns|changed + +# Avahi + +- name: Installing avahi-daemon + yum: + name: nethserver-avahi + state: present diff --git a/roles/nethcfg/tasks/directory.yml b/roles/nethcfg/tasks/directory.yml new file mode 100644 index 0000000..0fdad3e --- /dev/null +++ b/roles/nethcfg/tasks/directory.yml @@ -0,0 +1,21 @@ +--- +# Organization configuration + +- name: Installing required packages + yum: + pkg: nethserver-directory + state: present + +- name: Check organization configuration + shell: /sbin/e-smith/db configuration printprop OrganizationContact City + register: check_org + changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout" + ignore_errors: yes + +- name: Configuring organization + shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}" + when: check_org|changed + +- name: Activating organization configuration + shell: /sbin/e-smith/signal-event organization-save + when: check_org|changed diff --git a/roles/nethcfg/tasks/domain_groups.yml b/roles/nethcfg/tasks/domain_groups.yml index 1c2bd6c..719d037 100644 --- a/roles/nethcfg/tasks/domain_groups.yml +++ b/roles/nethcfg/tasks/domain_groups.yml @@ -1,49 +1,47 @@ --- -- name: Verifico la presenza del gruppo Domain Users +# Domain groups + +# Domain Users + +- name: domusers - Checking for group shell: /sbin/e-smith/db accounts show domusers register: check_domusers - become: yes ignore_errors: true -- name: Creazione gruppo Domain Users +- name: domusers - Creating new group shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no - become: yes when: check_domusers|failed -- name: Configurazione nuovo gruppo Domain Users +- name: domusers - Activating group shell: /sbin/e-smith/signal-event group-create domusers - become: yes when: check_domusers|failed -- name: Verifico la presenza del gruppo Domain Operators +# Domain Operators + +- name: domopers - Checking for group shell: /sbin/e-smith/db accounts show domopers register: check_domopers - become: yes ignore_errors: true -- name: Creazione gruppo Domain Operators +- name: domopers - Creating new group shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no - become: yes when: check_domopers|failed -- name: Configurazione nuovo gruppo Domain Operators +- name: domopers - Activating group shell: /sbin/e-smith/signal-event group-create domopers - become: yes when: check_domopers|failed -- name: Verifico la presenza del gruppo Docenti +# Docenti + +- name: docenti - Checking for group shell: /sbin/e-smith/db accounts show docenti register: check_docenti - become: yes ignore_errors: true -- name: Creazione gruppo Docenti +- name: docenti - Creating new group shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no - become: yes when: check_docenti|failed -- name: Configurazione nuovo gruppo Docenti +- name: docenti - Activating group shell: /sbin/e-smith/signal-event group-create docenti - become: yes when: check_docenti|failed - diff --git a/roles/nethcfg/tasks/main.yml b/roles/nethcfg/tasks/main.yml index 37ad3a9..2ed8eaa 100644 --- a/roles/nethcfg/tasks/main.yml +++ b/roles/nethcfg/tasks/main.yml @@ -1,19 +1,58 @@ --- -# Configurazione principale di NethServer. +# Configuring NethServer as requested -# Installo pacchetti addizionali -- include: neth_pkgs.yml +# Network interfaces +- include: network.yml + when: development|bool + become: yes tags: - - nethpkg + - network -- include: reconfig_nic.yml +# Configuring base parameters +- include: base.yml + become: yes tags: - - nethnic + - base -- include: reconfig_srv.yml +- include: ntp.yml + become: yes tags: - - nethcfg + - ntp +# Directory and organization +- include: directory.yml + become: yes + tags: + - directory + +# DHCP and DNS +- include: dhcpdns.yml + become: yes + tags: + - dhcpdns + +# Other small services +- include: otherservices.yml + become: yes + tags: + - otherservices + +# Proxy and web filter +- include: proxy.yml + become: yes + tags: + - proxy + - webfilter + +# SAMBA and ibays +- include: samba.yml + become: yes + tags: + - samba + - ibay + +# Domain groups - include: domain_groups.yml + become: yes tags: - domaingroups diff --git a/roles/nethcfg/tasks/neth_pkgs.yml b/roles/nethcfg/tasks/neth_pkgs.yml deleted file mode 100644 index ee8a9d3..0000000 --- a/roles/nethcfg/tasks/neth_pkgs.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- - -- name: Installazione pacchetti neth - yum: name="{{ item }}" state=present - become: yes - with_items: '{{ neth_pkgs }}' diff --git a/roles/nethcfg/tasks/network.yml b/roles/nethcfg/tasks/network.yml new file mode 100644 index 0000000..e8ffb29 --- /dev/null +++ b/roles/nethcfg/tasks/network.yml @@ -0,0 +1,11 @@ +--- +# Reconfiguring network interfaces + +- name: Configuring external NIC + shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp + +- name: Configuring internal NIC + shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }} + +- name: Activating changes to NICs + shell: /sbin/e-smith/signal-event interface-update diff --git a/roles/nethcfg/tasks/ntp.yml b/roles/nethcfg/tasks/ntp.yml new file mode 100644 index 0000000..2012e35 --- /dev/null +++ b/roles/nethcfg/tasks/ntp.yml @@ -0,0 +1,24 @@ +--- +# Network time protocol + +- name: Installing NTP related packages. + yum: + name: nethserver-ntp + state: present + +- name: Checking for NTP Configuration + shell: /sbin/e-smith/db configuration printprop ntpd NTPServer + become: yes + register: chk_ntp + changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout" + ignore_errors: true + +- name: Configuring NTP + shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled + become: yes + when: chk_ntp|changed + +- name: Activating NTP + shell: /sbin/e-smith/signal-event nethserver-ntp-update + become: yes + when: chk_ntp|changed diff --git a/roles/nethcfg/tasks/otherservices.yml b/roles/nethcfg/tasks/otherservices.yml new file mode 100644 index 0000000..1dac462 --- /dev/null +++ b/roles/nethcfg/tasks/otherservices.yml @@ -0,0 +1,14 @@ +--- +# Installation and configuration of small services + +- name: Installing other small services + yum: + name: "{{ item }}" + state: present + with_items: + - nethserver-cups + - nethserver-collectd + - nethserver-collectd-web + - nethserver-firewall-base + - nethserver-backup-config + - nethserver-backup-data diff --git a/roles/nethcfg/tasks/proxy.yml b/roles/nethcfg/tasks/proxy.yml new file mode 100644 index 0000000..13d5e31 --- /dev/null +++ b/roles/nethcfg/tasks/proxy.yml @@ -0,0 +1,78 @@ +--- +# Proxy and webfiltering configurations + +- name: Installing proxy-related packages + yum: + name: "{{ item }}" + state: present + with_items: + - nethserver-squid + - nethserver-squidclamav + - nethserver-squidguard + +# Squid + +- name: Checking squid configuration + shell: /sbin/e-smith/db configuration printprop squid GreenMode + ignore_errors: yes + register: chk_squid + changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout" + +- name: Configuring Squid + shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000 + when: chk_squid|changed + +- name: Activating Squid configuration + shell: /sbin/e-smith/signal-event nethserver-squid-update + when: chk_squid|changed + +# Squid-clamav + +- name: Checking squidclamav configuration + shell: /sbin/e-smith/db configuration printprop squidclamav status + ignore_errors: true + register: chk_squidclamav + changed_when: "'status=enabled' not in chk_squidclamav.stdout" + +- name: Configuring squidclamav + shell: /sbin/e-smith/db configuration setprop squidclamav status enabled + when: chk_squidclamav|changed + +- name: Activating squidclamav + shell: /sbin/e-smith/signal-event nethserver-squidclamav-update + when: chk_squidclamav|changed + +# SquidGuard + +- name: Verifying squidguard configuration + shell: /sbin/e-smith/db configuration printprop squidguard status + register: check_squidguard + changed_when: check_cf_enabled.stdout.find("disabled") != -1 + +- name: Configuring squidguard + shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled + when: chk_squidguard|changed + +- name: Activating squidguard configuration + shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}" + with_items: + - save + - update + - downloadlists + when: chk_squidguard|changed + +# Content filtering settings + +- name: Verifying content filtering + shell: /sbin/e-smith/db contentfilter printprop default Categories + register: check_cf + changed_when: check_cf.stdout.find("porn") != -1 + +- name: Configuring content filtering + shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez + register: cf_cat + when: check_cf|changed + +- name: Activating content filtering as a whole + shell: /sbin/e-smith/signal-event nethserver-squidguard-update + when: check_cf|changed diff --git a/roles/nethcfg/tasks/reconfig_nic.yml b/roles/nethcfg/tasks/reconfig_nic.yml deleted file mode 100644 index 60674b7..0000000 --- a/roles/nethcfg/tasks/reconfig_nic.yml +++ /dev/null @@ -1,24 +0,0 @@ -- name: Configurazione scheda di rete esterna - shell: /sbin/e-smith/db networks setprop {{ extnic }} role red bootproto dhcp - when: development|bool - become: yes - -- name: Configurazione scheda di rete interna - shell: /sbin/e-smith/db networks setprop {{ intnic }} role green ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }} - when: development|bool - become: yes - -- name: Attivo configurazioni di rete - shell: /sbin/e-smith/signal-event interface-update - when: development|bool - become: yes - -- name: Configurazione rete trusted - shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }} - when: development|bool - become: yes - -- name: Modifico configurazioni - shell: /sbin/e-smith/signal-event trusted-networks-modify - when: development|bool - become: yes diff --git a/roles/nethcfg/tasks/reconfig_srv.yml b/roles/nethcfg/tasks/reconfig_srv.yml deleted file mode 100644 index 33aa9e7..0000000 --- a/roles/nethcfg/tasks/reconfig_srv.yml +++ /dev/null @@ -1,321 +0,0 @@ ---- -- name: Verifica configurazione organizzazione - shell: /sbin/e-smith/db configuration printprop OrganizationContact City - register: check_org - changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout" - ignore_errors: yes - become: yes - -- name: Configurazione organizzazione - shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}" - become: yes - when: check_org|changed - -- name: Configurazione nome server - shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }} - become: yes - register: chg_hostname - when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'" - -- name: Configurazione nome dominio - shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }} - become: yes - register: chg_domainname - when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'" - -- name: Attivazione cambiamenti hostname - shell: /sbin/e-smith/signal-event hostname-modify - become: yes - when: chg_hostname|changed or chg_domainname|changed - -- name: Verifica robustezza password - shell: /sbin/e-smith/db configuration printprop passwordstrength Users - register: chk_passstr - changed_when: "'Users=none' not in chk_passstr.stdout" - become: yes - ignore_errors: true - -- name: Configurazione forza password - shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7 - become: yes - when: chk_passstr|changed - -- name: Attivo configurazione policy password - shell: /sbin/e-smith/signal-event password-policy-update - become: yes - when: chk_passstr|changed - -- name: Verifica configurazione DHCP - shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart - become: yes - ignore_errors: true - register: chk_dhcp - -- name: Configurazione servizio DHCP - shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled - become: yes - when: chk_dhcp|failed - -- name: Attivazione configurazione DHCP - shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save - become: yes - when: chk_dhcp|failed - -- name: Verifica configurazione DNS - shell: /sbin/e-smith/db configuration printprop dns NameServers - become: yes - register: chk_dns - changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}' not in chk_dns.stdout" - ignore_errors: yes - -- name: Configurazione servizio DNS - shell: /sbin/e-smith/db configuration setprop dns role resolver NameServers "{{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}" - become: yes - when: chk_dns|changed - -- name: Attivo configurazione DNS - shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save - when: chk_dns|changed - become: yes - -- name: Verifica configurazione NTP - shell: /sbin/e-smith/db configuration printprop ntpd NTPServer - become: yes - register: chk_ntp - changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout" - ignore_errors: true - -- name: Configuro NTP - shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled - become: yes - when: chk_ntp|changed - -- name: Attivazione NTP - shell: /sbin/e-smith/signal-event nethserver-ntp-update - become: yes - when: chk_ntp|changed - -- name: Utilizzo unix extensions nei template per ibay - replace: - dest: /etc/e-smith/templates/etc/samba/smb.conf/10global - regexp: '^unix extensions = no$' - replace: 'unix extensions = yes' - become: yes - -- name: Verifica configurazione SMB - shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles - become: yes - register: chk_smb - changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout" - ignore_errors: true - -- name: Configurazione SMB - shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled - become: yes - when: chk_smb|changed - -- name: Attivo configurazione SMB - shell: /sbin/e-smith/signal-event nethserver-samba-save - become: yes - when: chk_smb|changed - -- name: Abilito il ricaricamento dei servizi smb su ibay-create - file: src="reload" dest="{{ item }}/smb" state=link force=yes - with_items: - - /etc/e-smith/events/ibay-delete/services2adjust - - /etc/e-smith/events/ibay-create/services2adjust - - /etc/e-smith/events/ibay-modify/services2adjust - become: yes - -- name: Verifica creazione share condiviso - shell: /sbin/e-smith/db accounts show shared - become: yes - ignore_errors: true - register: chk_shared - -- name: Copying default templates for new template type - shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared - become: yes - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configuring ibay-shared template structure (directory mask) - lineinfile: - dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default - line: 'directory mask = 0775' - insertafter: '^create mask' - state: present - become: yes - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configuring force create mode - lineinfile: - dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default - line: 'force create mode = 0664' - insertafter: '^directory mask' - state: present - become: yes - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configuring force directory mode - lineinfile: - dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default - line: 'force directory mode = 0775' - insertafter: '^force create mode' - state: present - become: yes - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configurazione share Condiviso - shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled - become: yes - when: chk_shared|failed - -- name: Attivazione share condiviso - shell: /sbin/e-smith/signal-event ibay-create shared - become: yes - when: chk_shared|failed - -- name: Changing ibay profile for shared - shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared - become: yes - when: force_ibay_shared|bool or chk_shared|failed - -- name: Forcing regeneration of smb.conf - shell: /sbin/e-smith/signal-event nethserver-samba-update - become: yes - when: force_ibay_shared|bool or chk_shared|failed - -- name: Verifica configurazione squid - shell: /sbin/e-smith/db configuration printprop squid GreenMode - become: yes - ignore_errors: yes - register: chk_squid - changed_when: "'DiskCacheSize=2000' not in chk_squid.stdout" - -- name: Configurazione squid - shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent GreenMode transparent PortBlock disabled status enabled DiskCache enabled DiskCacheSize 2000 - become: yes - when: chk_squid|changed - -- name: Attivazione configurazione squid - shell: /sbin/e-smith/signal-event nethserver-squid-update - become: yes - when: chk_squid|changed - -- name: Verifying content filter activation - shell: /sbin/e-smith/db configuration printprop squidguard status - register: check_cf_enabled - changed_when: check_cf_enabled.stdout.find("disabled") != -1 - become: yes - -- name: Activating squidguard - shell: /sbin/e-smith/db configuration setprop squidguard status enabled - when: check_cf_enabled|changed - register: cf_enable - become: yes - -- name: Verifying content filtering - shell: /sbin/e-smith/db contentfilter printprop default Categories - register: check_cf - changed_when: check_cf.stdout.find("porn") != -1 - become: yes - -- name: Configuring content filtering - shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez - become: yes - register: cf_cat - when: check_cf|changed - -- name: Activating content filtering as a whole - shell: /sbin/e-smith/signal-event nethserver-squidguard-update - when: cf_enable|changed or cf_cat|changed - become: yes - -- name: Verifica configurazione squidguard - shell: /sbin/e-smith/db configuration printprop squidguard Lists - become: yes - ignore_errors: true - register: chk_squidguard - changed_when: "'Lists=shalla' not in chk_squidguard.stdout" - -- name: Configurazione squidguard - shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled - become: yes - when: chk_squidguard|changed - -- name: Activating squidguard configuration - shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}" - with_items: - - save - - update - - downloadlists - become: yes - when: chk_squidguard|changed - -- name: Verifying content filter activation - shell: /sbin/e-smith/db configuration printprop squidguard status - register: check_cf_enabled - changed_when: "'disabled' not in check_cf_enabled.stdout" - become: yes - -- name: Enabling squidguard for content filtering - shell: /sbin/e-smith/db configuration setprop squidguard status enabled - when: check_cf_enabled|changed - register: cf_enable - become: yes - -- name: Verifying content filtering - shell: /sbin/e-smith/db contentfilter getprop default Categories - ignore_errors: yes - register: check_cf - changed_when: check_cf.rc != 0 - become: yes - -- name: Configuring content filtering - shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez - become: yes - register: cf_cat - when: check_cf|changed - -- name: Activating content filtering as a whole - shell: /sbin/e-smith/signal-event nethserver-squidguard-update - when: cf_enable|changed or cf_cat|changed - become: yes - - -- name: Verifica configurazione squidclamav - shell: /sbin/e-smith/db configuration printprop squidclamav status - become: yes - ignore_errors: true - register: chk_squidclamav - changed_when: "'status=enabled' not in chk_squidclamav.stdout" - -- name: Configurazione squidclamav - shell: /sbin/e-smith/db configuration setprop squidclamav status enabled - become: yes - when: chk_squidclamav|changed - -- name: Attivazione squidclamav - shell: /sbin/e-smith/signal-event nethserver-squidclamav-update - become: yes - when: chk_squidclamav|changed - -- name: Verifica completamento configurazione per certificato - shell: /sbin/e-smith/db configuration printprop pki CommonName - become: yes - ignore_errors: true - register: chk_crt - changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout" - tags: regen-ca - -- name: Completo la configurazione per produzione certificato - shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}" - become: yes - tags: regen-ca - when: chk_crt|changed or force_regen_ca|bool - -- name: Rigenero il certificato con le informazioni inserite - shell: /sbin/e-smith/signal-event certificate-update - become: yes - when: chk_crt|changed or force_regen_ca|bool - tags: regen-ca diff --git a/roles/nethcfg/tasks/samba.yml b/roles/nethcfg/tasks/samba.yml new file mode 100644 index 0000000..e7946d8 --- /dev/null +++ b/roles/nethcfg/tasks/samba.yml @@ -0,0 +1,98 @@ +--- +# SAMBA and ibays + +- name: Installing SAMBA and ibays packages + yum: + name: "{{ item }}" + state: present + with_items: + - nethserver-ibays + - nethserver-samba + - nethserver-samba-audit + +# SAMBA + +- name: Checking SMB configuration + shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles + register: chk_smb + changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout" + ignore_errors: true + +- name: "Enabling unix extensions on SAMBA" + replace: + dest: /etc/e-smith/templates/etc/samba/smb.conf/10global + regexp: '^unix extensions = no$' + replace: 'unix extensions = yes' + +- name: Configuring SMB + shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled + when: chk_smb|changed + +- name: Activating SMB + shell: /sbin/e-smith/signal-event nethserver-samba-save + when: chk_smb|changed + +# ibays + +- name: Enabling SMB services restart when managing ibays + file: + src: reload + dest: "{{ item }}/smb" + state: link + force: yes + with_items: + - /etc/e-smith/events/ibay-delete/services2adjust + - /etc/e-smith/events/ibay-create/services2adjust + - /etc/e-smith/events/ibay-modify/services2adjust + +- name: Checking for shared ibay + shell: /sbin/e-smith/db accounts show shared + ignore_errors: true + register: chk_shared + +- name: Copying default templates for shared template type + shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared + when: force_ibay_shared|bool or chk_shared|failed + +- name: Configuring ibay-shared template structure (directory mask) + lineinfile: + dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default + line: 'directory mask = 0775' + insertafter: '^create mask' + state: present + when: force_ibay_shared|bool or chk_shared|failed + +- name: Configuring force create mode + lineinfile: + dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default + line: 'force create mode = 0664' + insertafter: '^directory mask' + state: present + when: force_ibay_shared|bool or chk_shared|failed + +- name: Configuring force directory mode + lineinfile: + dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default + line: 'force directory mode = 0775' + insertafter: '^force create mode' + state: present + when: force_ibay_shared|bool or chk_shared|failed + +- name: Configuring shared ibay + shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled + when: chk_shared|failed + +- name: Activating shared ibay + shell: /sbin/e-smith/signal-event ibay-create shared + become: yes + when: chk_shared|failed + +- name: Changing ibay profile for shared + shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared + become: yes + when: force_ibay_shared|bool or chk_shared|failed + +- name: Forcing regeneration of smb.conf + shell: /sbin/e-smith/signal-event nethserver-samba-update + become: yes + when: force_ibay_shared|bool or chk_shared|failed diff --git a/roles/nethcfg/vars/main.yml b/roles/nethcfg/vars/main.yml deleted file mode 100644 index e8ed334..0000000 --- a/roles/nethcfg/vars/main.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- -neth_pkgs: - - nethserver-tftp - - nethserver-ibays - - nethserver-samba - - nethserver-samba-audit - - nethserver-cups - - nethserver-avahi - - nethserver-dnsmasq - - nethserver-collectd - - nethserver-collectd-web - - nethserver-squid - - nethserver-squidclamav - - nethserver-squidguard - - nethserver-firewall-base - - nethserver-backup-config - - nethserver-backup-data diff --git a/roles/pxe/tasks/main.yml b/roles/pxe/tasks/main.yml index 5e6acd5..9f4b2e6 100644 --- a/roles/pxe/tasks/main.yml +++ b/roles/pxe/tasks/main.yml @@ -1,3 +1,10 @@ --- +# PXE services +- include: tftp.yml + become: yes + tags: tftp + +# PXE configuration - include: pxe.yml + become: yes tags: pxe diff --git a/roles/pxe/tasks/pxe.yml b/roles/pxe/tasks/pxe.yml index da414e0..d907cb7 100644 --- a/roles/pxe/tasks/pxe.yml +++ b/roles/pxe/tasks/pxe.yml @@ -1,104 +1,79 @@ --- -# Configurazione dell'ambiente di boot via rete per i client +# Configuring other aspects for PXE -- name: Verifica configurazione tftp - shell: /sbin/e-smith/db configuration getprop dnsmasq dhcp-boot - register: chk_tftp_enabled - changed_when: "'pxelinux.0' not in chk_tftp_enabled.stdout" - ignore_errors: yes - become: yes - -- name: Configuro tftp - shell: /sbin/e-smith/db configuration setprop dnsmasq tftp-status enabled dhcp-boot pxelinux.0 - when: chk_tftp_enabled|changed - become: yes - -- name: Attivo tftp - shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save - when: chk_tftp_enabled|changed - become: yes - -- name: Creo directory necessarie - file: path={{ item }} state=directory +- name: Creating mandatory directories + file: + path: "{{ item }}" + state: directory with_items: - /var/lib/tftpboot/pxelinux.cfg - /var/lib/tftpboot/ubuntu/14.04/i386 - /var/lib/tftpboot/ubuntu/14.04/amd64 - /var/lib/tftpboot/utils/memtest86 - become: yes - name: pxelinux.0 get_url: - url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/pxelinux.0 + url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/pxelinux.0" dest: /var/lib/tftpboot/pxelinux.0 - become: yes - name: pxelinux.cfg/default - template: src=pxelinux.cfg/default dest=/var/lib/tftpboot/pxelinux.cfg/default - become: yes + template: + src: pxelinux.cfg/default + dest: /var/lib/tftpboot/pxelinux.cfg/default when: development is not defined or development|bool == false - name: pxelinux.cfg/default - development template: src: pxelinux.cfg/default.dev dest: /var/lib/tftpboot/pxelinux.cfg/default - become: yes when: development is defined and development|bool - name: bglug.png - copy: src=bglug.png dest=/var/lib/tftpboot/utils/bglug.png - become: yes + copy: + src: bglug.png + dest: /var/lib/tftpboot/utils/bglug.png - name: vesamenu.c32 get_url: url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/boot-screens/vesamenu.c32" dest: /var/lib/tftpboot/utils/vesamenu.c32 - become: yes - name: chain.c32 get_url: url: "http://repo.bglug.it/pxelinux/chain.c32" dest: /var/lib/tftpboot/utils/chain.c32 - become: yes - name: linux i386 get_url: - url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/linux + url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/linux" dest: /var/lib/tftpboot/ubuntu/14.04/i386/linux - become: yes - name: initrd.gz i386 get_url: - url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/initrd.gz + url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-i386/current/images/netboot/ubuntu-installer/i386/initrd.gz" dest: /var/lib/tftpboot/ubuntu/14.04/i386/initrd.gz - become: yes - name: linux amd64 get_url: - url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/linux + url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/linux" dest: /var/lib/tftpboot/ubuntu/14.04/amd64/linux - become: yes - name: initrd.gz amd64 get_url: - url: http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/initrd.gz + url: "http://archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/initrd.gz" dest: /var/lib/tftpboot/ubuntu/14.04/amd64/initrd.gz - become: yes - name: memdisk get_url: url: "http://repo.bglug.it/pxelinux/memdisk" dest: /var/lib/tftpboot/utils/memdisk - become: yes - name: memtest86 get_url: url: "http://repo.bglug.it/pxelinux/memtest86/vmlinuz" dest: /var/lib/tftpboot/utils/memtest86/vmlinuz - become: yes - name: hdt get_url: url: "http://repo.bglug.it/pxelinux/hdt.img" dest: /var/lib/tftpboot/utils/hdt.img - become: yes diff --git a/roles/setup/tasks/centos_pkgs.yml b/roles/setup/tasks/centos_pkgs.yml index af525d2..37028e4 100644 --- a/roles/setup/tasks/centos_pkgs.yml +++ b/roles/setup/tasks/centos_pkgs.yml @@ -40,7 +40,7 @@ tags: upgrade - name: Installo pacchetti addizionali - yum: name={{ item }} state=present + yum: name='{{ item }}' state=present become: yes - with_items: addin_pkgs + with_items: '{{ addin_pkgs }}' tags: pkg diff --git a/roles/tftp.yml b/roles/tftp.yml new file mode 100644 index 0000000..8d260ca --- /dev/null +++ b/roles/tftp.yml @@ -0,0 +1,21 @@ +--- +# TFTP + +- name: Installing TFTP + yum: + name: nethserver-tftp + state: present + +- name: Checking TFTP configuration + shell: /sbin/e-smith/db configuration getprop dnsmasq dhcp-boot + register: chk_tftp_enabled + changed_when: "'pxelinux.0' not in chk_tftp_enabled.stdout" + ignore_errors: yes + +- name: Configuring TFTP + shell: /sbin/e-smith/db configuration setprop dnsmasq tftp-status enabled dhcp-boot pxelinux.0 + when: chk_tftp_enabled|changed + +- name: Activating tftp + shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save + when: chk_tftp_enabled|changed