Simplifying ansible-pull management, script to run ansible are run live from the server. Moved server-ca in its folder. Simplified post-ks scripts.
This commit is contained in:
parent
2d1f6b780f
commit
a6bd1c6deb
@ -6,6 +6,7 @@
|
||||
- name: Template
|
||||
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
|
||||
with_items:
|
||||
- init-ansible.sh
|
||||
- ansible-pull.sh
|
||||
- getvaultpass.py
|
||||
- crontab
|
||||
|
@ -10,7 +10,7 @@ logfile=/var/lib/ansible-pull.log
|
||||
branch=master
|
||||
playbook=local.yml
|
||||
|
||||
vaultpassfile=$(/var/lib/{{ ansible_local.domain.domainfull }}/bin/getvaultpass.py)
|
||||
vaultpassfile=$(\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | python)
|
||||
|
||||
ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
|
||||
rm -f "${vaultpassfile}"
|
||||
|
@ -1 +1 @@
|
||||
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1
|
||||
@reboot root \curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh | bash >>/var/log/ansible-pull.log 2>&1
|
||||
|
14
roles/ansible-pull/templates/init-ansible.sh
Normal file
14
roles/ansible-pull/templates/init-ansible.sh
Normal file
@ -0,0 +1,14 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Creo directory dipendenti
|
||||
install -d -o root -g locals /var/lib/{{ ansible_local.domain.domainfull }}/config
|
||||
|
||||
# Installo il cronjob per ansible-pull
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull
|
||||
chown root:locals /etc/cron.d/ansible-pull
|
||||
chmod 0644 /etc/cron.d/ansible-pull
|
||||
|
||||
# Installo il logrotate per ansible
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull
|
||||
chown root:locals /etc/logrotate.d/ansible-pull
|
||||
chmod 0644 /etc/logrotate.d/ansible-pull
|
@ -7,16 +7,24 @@
|
||||
url: "http://localhost/proxy.crt"
|
||||
dest: /tmp/ca.crt
|
||||
|
||||
- name: Creo directory per certificati
|
||||
file:
|
||||
path: /var/lib/nethserver/ibay/ks/server-ca
|
||||
state: directory
|
||||
owner: root
|
||||
mode: 0755
|
||||
sudo: yes
|
||||
|
||||
- name: 'Utilizzo cert8.db precedentemente fornito (pulito da FF appena aperto)'
|
||||
copy:
|
||||
src: cert8.db
|
||||
dest: /var/lib/nethserver/ibay/ks/cert8.db
|
||||
dest: /var/lib/nethserver/ibay/ks/server-ca/cert8.db
|
||||
owner: root
|
||||
mode: 0644
|
||||
sudo: yes
|
||||
|
||||
- name: Integro la CA nel db
|
||||
shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks
|
||||
shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks/server-ca
|
||||
sudo: yes
|
||||
|
||||
- name: Pulizia
|
||||
@ -24,5 +32,5 @@
|
||||
sudo: yes
|
||||
with_items:
|
||||
- /tmp/ca.crt
|
||||
- /var/lib/nethserver/ibay/ks/key3.db
|
||||
- /var/lib/nethserver/ibay/ks/secmod.db
|
||||
- /var/lib/nethserver/ibay/ks/server-ca/key3.db
|
||||
- /var/lib/nethserver/ibay/ks/server-ca/secmod.db
|
||||
|
@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha
|
||||
echo $TARGETHOSTNAME > /etc/hostname
|
||||
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
|
||||
|
||||
{% if ansible_product_name == 'VirtualBox' %}
|
||||
# Installo l'ultimo ansible per ansible-pull
|
||||
export https_proxy=https://{{ ansible_local.domain.serverip }}:3128
|
||||
add-apt-repository -y ppa:ansible/ansible
|
||||
apt-get update && apt-get install -y ansible
|
||||
unset https_proxy
|
||||
{% else %}
|
||||
# Adding ansible manually from local
|
||||
wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add -
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list
|
||||
apt-get update && apt-get install -y ansible
|
||||
{% endif %}
|
||||
|
||||
# Creo directory dipendenti
|
||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config
|
||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin
|
||||
|
||||
# Installo lo script per la decrittazione della password del vault
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py
|
||||
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py
|
||||
rm -f /tmp/getvaultpass.py
|
||||
|
||||
# Installo lo script per l'avvio di ansible-pull da root
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh
|
||||
install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh
|
||||
rm -f /tmp/ansible-pull.sh
|
||||
|
||||
# Installo il cronjob
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab
|
||||
install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull
|
||||
rm -f /tmp/ansible-pull-crontab
|
||||
# Installo il logrotate
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate
|
||||
install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible
|
||||
rm -f /tmp/ansible-pull-logrotate
|
||||
# Installo i file necessari per ansible.
|
||||
\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash
|
||||
|
@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha
|
||||
echo $TARGETHOSTNAME > /etc/hostname
|
||||
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
|
||||
|
||||
{% if ansible_product_name == 'VirtualBox' %}
|
||||
# Installo l'ultimo ansible per ansible-pull
|
||||
export https_proxy=https://{{ ansible_local.domain.serverip }}:3128
|
||||
add-apt-repository -y ppa:ansible/ansible
|
||||
apt-get update && apt-get install -y ansible
|
||||
unset https_proxy
|
||||
{% else %}
|
||||
# Adding ansible manually from local
|
||||
wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add -
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list
|
||||
apt-get update && apt-get install -y ansible
|
||||
{% endif %}
|
||||
|
||||
# Creo directory dipendenti
|
||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config
|
||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin
|
||||
|
||||
# Installo lo script per la decrittazione della password del vault
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py
|
||||
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py
|
||||
rm -f /tmp/getvaultpass.py
|
||||
|
||||
# Installo lo script per l'avvio di ansible-pull da root
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh
|
||||
install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh
|
||||
rm -f /tmp/ansible-pull.sh
|
||||
|
||||
# Installo il cronjob
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab
|
||||
install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull
|
||||
rm -f /tmp/ansible-pull-crontab
|
||||
# Installo il logrotate
|
||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate
|
||||
install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible
|
||||
rm -f /tmp/ansible-pull-logrotate
|
||||
# Installo i file necessari per ansible.
|
||||
\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash
|
||||
|
Loading…
x
Reference in New Issue
Block a user