Simplifying ansible-pull management, script to run ansible are run live from the server. Moved server-ca in its folder. Simplified post-ks scripts.

This commit is contained in:
Emiliano Vavassori 2015-10-02 02:33:59 +02:00
parent 2d1f6b780f
commit a6bd1c6deb
7 changed files with 33 additions and 76 deletions

View File

@ -6,6 +6,7 @@
- name: Template
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
with_items:
- init-ansible.sh
- ansible-pull.sh
- getvaultpass.py
- crontab

View File

@ -10,7 +10,7 @@ logfile=/var/lib/ansible-pull.log
branch=master
playbook=local.yml
vaultpassfile=$(/var/lib/{{ ansible_local.domain.domainfull }}/bin/getvaultpass.py)
vaultpassfile=$(\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | python)
ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
rm -f "${vaultpassfile}"

View File

@ -1 +1 @@
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1
@reboot root \curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh | bash >>/var/log/ansible-pull.log 2>&1

View File

@ -0,0 +1,14 @@
#!/bin/bash
# Creo directory dipendenti
install -d -o root -g locals /var/lib/{{ ansible_local.domain.domainfull }}/config
# Installo il cronjob per ansible-pull
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull
chown root:locals /etc/cron.d/ansible-pull
chmod 0644 /etc/cron.d/ansible-pull
# Installo il logrotate per ansible
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull
chown root:locals /etc/logrotate.d/ansible-pull
chmod 0644 /etc/logrotate.d/ansible-pull

View File

@ -7,16 +7,24 @@
url: "http://localhost/proxy.crt"
dest: /tmp/ca.crt
- name: Creo directory per certificati
file:
path: /var/lib/nethserver/ibay/ks/server-ca
state: directory
owner: root
mode: 0755
sudo: yes
- name: 'Utilizzo cert8.db precedentemente fornito (pulito da FF appena aperto)'
copy:
src: cert8.db
dest: /var/lib/nethserver/ibay/ks/cert8.db
dest: /var/lib/nethserver/ibay/ks/server-ca/cert8.db
owner: root
mode: 0644
sudo: yes
- name: Integro la CA nel db
shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks
shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks/server-ca
sudo: yes
- name: Pulizia
@ -24,5 +32,5 @@
sudo: yes
with_items:
- /tmp/ca.crt
- /var/lib/nethserver/ibay/ks/key3.db
- /var/lib/nethserver/ibay/ks/secmod.db
- /var/lib/nethserver/ibay/ks/server-ca/key3.db
- /var/lib/nethserver/ibay/ks/server-ca/secmod.db

View File

@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha
echo $TARGETHOSTNAME > /etc/hostname
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
{% if ansible_product_name == 'VirtualBox' %}
# Installo l'ultimo ansible per ansible-pull
export https_proxy=https://{{ ansible_local.domain.serverip }}:3128
add-apt-repository -y ppa:ansible/ansible
apt-get update && apt-get install -y ansible
unset https_proxy
{% else %}
# Adding ansible manually from local
wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add -
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list
apt-get update && apt-get install -y ansible
{% endif %}
# Creo directory dipendenti
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin
# Installo lo script per la decrittazione della password del vault
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py
rm -f /tmp/getvaultpass.py
# Installo lo script per l'avvio di ansible-pull da root
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh
install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh
rm -f /tmp/ansible-pull.sh
# Installo il cronjob
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab
install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull
rm -f /tmp/ansible-pull-crontab
# Installo il logrotate
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate
install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible
rm -f /tmp/ansible-pull-logrotate
# Installo i file necessari per ansible.
\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash

View File

@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha
echo $TARGETHOSTNAME > /etc/hostname
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
{% if ansible_product_name == 'VirtualBox' %}
# Installo l'ultimo ansible per ansible-pull
export https_proxy=https://{{ ansible_local.domain.serverip }}:3128
add-apt-repository -y ppa:ansible/ansible
apt-get update && apt-get install -y ansible
unset https_proxy
{% else %}
# Adding ansible manually from local
wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add -
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list
apt-get update && apt-get install -y ansible
{% endif %}
# Creo directory dipendenti
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin
# Installo lo script per la decrittazione della password del vault
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py
rm -f /tmp/getvaultpass.py
# Installo lo script per l'avvio di ansible-pull da root
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh
install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh
rm -f /tmp/ansible-pull.sh
# Installo il cronjob
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab
install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull
rm -f /tmp/ansible-pull-crontab
# Installo il logrotate
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate
install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible
rm -f /tmp/ansible-pull-logrotate
# Installo i file necessari per ansible.
\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash