server-config/roles/nethcfg/tasks/reconfig_srv.yml

263 lines
9.6 KiB
YAML
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

---
- name: Verifica configurazione organizzazione
shell: /sbin/e-smith/db configuration printprop OrganizationContact City
register: check_org
changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout"
ignore_errors: yes
become: yes
- name: Configurazione organizzazione
shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}"
become: yes
when: check_org|changed
- name: Configurazione nome server
shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }}
become: yes
register: chg_hostname
when: "'{{ ansible_hostname }}' != '{{ ansible_local.domain.server }}'"
- name: Configurazione nome dominio
shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }}
become: yes
register: chg_domainname
when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfull }}'"
- name: Attivazione cambiamenti hostname
shell: /sbin/e-smith/signal-event hostname-modify
become: yes
when: chg_hostname|changed or chg_domainname|changed
- name: Verifica robustezza password
shell: /sbin/e-smith/db configuration printprop passwordstrength Users
register: chk_passstr
changed_when: "'Users=none' not in chk_passstr.stdout"
become: yes
ignore_errors: true
- name: Configurazione forza password
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
become: yes
when: chk_passstr|changed
- name: Attivo configurazione policy password
shell: /sbin/e-smith/signal-event password-policy-update
become: yes
when: chk_passstr|changed
- name: Verifica configurazione DHCP
shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart
become: yes
ignore_errors: true
register: chk_dhcp
- name: Configurazione servizio DHCP
shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled
become: yes
when: chk_dhcp|failed
- name: Attivazione configurazione DHCP
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
become: yes
when: chk_dhcp|failed
- name: Verifica configurazione DNS
shell: /sbin/e-smith/db configuration printprop dns NameServers
become: yes
register: chk_dns
changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}' not in chk_dns.stdout"
ignore_errors: yes
- name: Configurazione servizio DNS
shell: /sbin/e-smith/db configuration setprop dns role resolver NameServers "{{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}"
become: yes
when: chk_dns|changed
- name: Attivo configurazione DNS
shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save
when: chk_dns|changed
become: yes
- name: Verifica configurazione NTP
shell: /sbin/e-smith/db configuration printprop ntpd NTPServer
become: yes
register: chk_ntp
changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout"
ignore_errors: true
- name: Configuro NTP
shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled
become: yes
when: chk_ntp|changed
- name: Attivazione NTP
shell: /sbin/e-smith/signal-event nethserver-ntp-update
become: yes
when: chk_ntp|changed
- name: Utilizzo unix extensions nei template per ibay
replace:
dest: /etc/e-smith/templates/etc/samba/smb.conf/10global
regexp: '^unix extensions = no$'
replace: 'unix extensions = yes'
become: yes
- name: Verifica configurazione SMB
shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
become: yes
register: chk_smb
changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
ignore_errors: true
- name: Configurazione SMB
shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
become: yes
when: chk_smb|changed
- name: Attivo configurazione SMB
shell: /sbin/e-smith/signal-event nethserver-samba-save
become: yes
when: chk_smb|changed
- name: Abilito il ricaricamento dei servizi smb su ibay-create
file: src="reload" dest="{{ item }}/smb" state=link force=yes
with_items:
- /etc/e-smith/events/ibay-delete/services2adjust
- /etc/e-smith/events/ibay-create/services2adjust
- /etc/e-smith/events/ibay-modify/services2adjust
become: yes
- name: Verifica creazione share condiviso
shell: /sbin/e-smith/db accounts show shared
become: yes
ignore_errors: true
register: chk_shared
- name: Copying default templates for new template type
shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring ibay-shared template structure (directory mask)
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'directory mask = 0775'
insertafter: '^create mask'
state: present
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring force create mode
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force create mode = 0664'
insertafter: '^directory mask'
state: present
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring force directory mode
lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force directory mode = 0775'
insertafter: '^force create mode'
state: present
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Configurazione share Condiviso
shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled
become: yes
when: chk_shared|failed
- name: Attivazione share condiviso
shell: /sbin/e-smith/signal-event ibay-create shared
become: yes
when: chk_shared|failed
- name: Changing ibay profile for shared
shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Forcing regeneration of smb.conf
shell: /sbin/e-smith/signal-event nethserver-samba-update
become: yes
when: force_ibay_shared|bool or chk_shared|failed
- name: Verifica configurazione squid
shell: /sbin/e-smith/db configuration printprop squid GreenMode
become: yes
ignore_errors: yes
register: chk_squid
changed_when: "'GreenMode=transparent_ssl' not in chk_squid.stdout"
- name: Configurazione squid
shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent_ssl GreenMode transparent_ssl PortBlock enabled status enabled DiskCache enabled DiskCacheSize 500
become: yes
when: chk_squid|changed
- name: Attivazione configurazione squid
shell: /sbin/e-smith/signal-event nethserver-squid-update
become: yes
when: chk_squid|changed
- name: Verifica configurazione squidguard
shell: /sbin/e-smith/db configuration printprop squidguard Lists
become: yes
ignore_errors: true
register: chk_squidguard
changed_when: "'Lists=shalla' not in chk_squidguard.stdout"
- name: Configurazione squidguard
shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled
become: yes
when: chk_squidguard|changed
- name: Scarico liste di filtraggio
shell: /sbin/e-smith/signal-event nethserver-squidguard-downloadlists
become: yes
when: chk_squidguard|changed
- name: Attivazione squidguard
shell: /sbin/e-smith/signal-event nethserver-squidguard-update
become: yes
when: chk_squidguard|changed
- name: Verifica configurazione squidclamav
shell: /sbin/e-smith/db configuration printprop squidclamav status
become: yes
ignore_errors: true
register: chk_squidclamav
changed_when: "'status=enabled' not in chk_squidclamav.stdout"
- name: Configurazione squidclamav
shell: /sbin/e-smith/db configuration setprop squidclamav status enabled
become: yes
when: chk_squidclamav|changed
- name: Attivazione squidclamav
shell: /sbin/e-smith/signal-event nethserver-squidclamav-update
become: yes
when: chk_squidclamav|changed
- name: Verifica completamento configurazione per certificato
shell: /sbin/e-smith/db configuration printprop pki CommonName
become: yes
ignore_errors: true
register: chk_crt
changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout"
tags: regen-ca
- name: Completo la configurazione per produzione certificato
shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} CountryCode {{ ansible_local.domain.org_countrycode }} EmailAddress {{ ansible_local.domain.org_email }} Locality "{{ ansible_local.domain.org_city }}" Organization "{{ ansible_local.domain.org_company }}"
become: yes
tags: regen-ca
when: chk_crt|changed or force_regen_ca|bool
- name: Rigenero il certificato con le informazioni inserite
shell: /sbin/e-smith/signal-event certificate-update
become: yes
when: chk_crt|changed or force_regen_ca|bool
tags: regen-ca