From 0faf2f2ef43d6f073a7b0fe07b775d0cdb3f2246 Mon Sep 17 00:00:00 2001 From: Emiliano Vavassori Date: Mon, 13 Jul 2015 23:57:01 +0200 Subject: [PATCH] Inserimento di doraemon al posto di mac2hostname e ansiblehelper. Modifica script per creazione, in fase di prima installazione, della password del vault. --- roles/ansiblehelper/tasks/ansiblehelper.yml | 59 ------------------ roles/ansiblehelper/tasks/main.yml | 3 - roles/client-install/meta/main.yml | 3 +- roles/doraemon/tasks/doraemon.yml | 14 +++++ .../{mac2hostname => doraemon}/tasks/main.yml | 2 +- roles/mac2hostname/tasks/mac2hostname.yml | 60 ------------------- roles/pxe/tasks/pxe.yml | 1 + roles/pxe/templates/ks/ansible-pull.sh | 2 +- roles/pxe/templates/ks/getvaultpass.py | 21 +++++++ roles/pxe/templates/ks/post-ks.sh | 4 ++ 10 files changed, 43 insertions(+), 126 deletions(-) delete mode 100644 roles/ansiblehelper/tasks/ansiblehelper.yml delete mode 100644 roles/ansiblehelper/tasks/main.yml create mode 100644 roles/doraemon/tasks/doraemon.yml rename roles/{mac2hostname => doraemon}/tasks/main.yml (55%) delete mode 100644 roles/mac2hostname/tasks/mac2hostname.yml create mode 100644 roles/pxe/templates/ks/getvaultpass.py diff --git a/roles/ansiblehelper/tasks/ansiblehelper.yml b/roles/ansiblehelper/tasks/ansiblehelper.yml deleted file mode 100644 index fcfb0fc..0000000 --- a/roles/ansiblehelper/tasks/ansiblehelper.yml +++ /dev/null @@ -1,59 +0,0 @@ ---- -# Installa e configura il servizio per aiutare ansible-pull - -- name: Installazione dipendenze Python - yum: pkg=python-bottle state=present - sudo: yes - -- name: Check installazione + versione ansiblehelper - shell: rpm -q ansiblehelper - ignore_errors: yes - register: check_ansiblehelper_pkg - changed_when: check_ansiblehelper_pkg.rc != 0 or check_ansiblehelper_pkg.stdout.find('1.0.0-1') == -1 - -- name: Installazione ansiblehelper - yum: pkg=http://syntaxerrormmm.zapto.org/downloads/rpm/ansiblehelper-1.0.0-1.el6.noarch.rpm state=present - when: check_ansiblehelper_pkg|changed - sudo: yes - -- name: Verifica aggiunta servizi - shell: /sbin/e-smith/db configuration show ansiblehelper - sudo: yes - register: chk_ansiblehelper_srv - changed_when: chk_ansiblehelper_srv.rc != 0 - ignore_errors: yes - -- name: Aggiungo il servizio ai servizi gestiti da NethServer - shell: /sbin/e-smith/db configuration set ansiblehelper service status enabled TCPPort 3001 access private - sudo: yes - when: chk_ansiblehelper_srv|changed - -- name: Default per NetServer - Cartella defaults - shell: mkdir -p /etc/e-smith/db/configuration/defaults/ansiblehelper - sudo: yes - when: chk_ansiblehelper_srv|changed - -- name: Default per NethServer - Tipo - shell: echo "service" > /etc/e-smith/db/configuration/defaults/ansiblehelper/type - sudo: yes - when: chk_ansiblehelper_srv|changed - -- name: Default per NethServer - Stato - shell: echo "enabled" > /etc/e-smith/db/configuration/defaults/ansiblehelper/status - sudo: yes - when: chk_ansiblehelper_srv|changed - -- name: Aggiunta servizio - shell: /sbin/e-smith/signal-event runlevel-adjust - sudo: yes - when: chk_ansiblehelper_srv|changed - -- name: Aggiunta servizio di rete e cambio firewall - shell: /sbin/e-smith/signal-event firewall-adjust - sudo: yes - when: chk_ansiblehelper_srv|changed - -- name: Avvio di ansiblehelper - shell: service ansiblehelper start - sudo: yes - when: chk_ansiblehelper_srv|changed diff --git a/roles/ansiblehelper/tasks/main.yml b/roles/ansiblehelper/tasks/main.yml deleted file mode 100644 index 7ce5fd6..0000000 --- a/roles/ansiblehelper/tasks/main.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- -- include: ansiblehelper.yml - tags: ansiblehelper diff --git a/roles/client-install/meta/main.yml b/roles/client-install/meta/main.yml index 338ced1..9e77520 100644 --- a/roles/client-install/meta/main.yml +++ b/roles/client-install/meta/main.yml @@ -2,6 +2,5 @@ dependencies: - { role: pxe, tags: [ 'client-install', 'pxe' ] } - { role: ubuntu-mirror, tags: [ 'client-install', 'ubuntu-mirror' ] } - - { role: mac2hostname, tags: [ 'client-install', 'mac2hostname' ] } + - { role: doraemon, tags: [ 'client-install', 'doraemon' ] } - { role: git-daemon, tags: [ 'client-install', 'git-daemon' ] } - - { role: ansiblehelper, tags: [ 'client-install', 'ansiblehelper' ] } diff --git a/roles/doraemon/tasks/doraemon.yml b/roles/doraemon/tasks/doraemon.yml new file mode 100644 index 0000000..01d1623 --- /dev/null +++ b/roles/doraemon/tasks/doraemon.yml @@ -0,0 +1,14 @@ +--- +# Installa e configura il servizio per rinominare il client +# Grazie per il servizio a Enrico Bacis + +- name: Check installazione + versione doraemon + shell: rpm -q doraemon + ignore_errors: yes + register: check_doraemon_pkg + changed_when: check_doraemon_pkg.rc != 0 or check_doraemon_pkg.stdout.find('1.0.0-1') == -1 + +- name: Installazione doraemon + yum: pkg=http://syntaxerrormmm.zapto.org/downloads/rpm/doraemon-1.0.0-1.ns6.noarch.rpm state=present + when: check_doraemon_pkg|changed + sudo: yes diff --git a/roles/mac2hostname/tasks/main.yml b/roles/doraemon/tasks/main.yml similarity index 55% rename from roles/mac2hostname/tasks/main.yml rename to roles/doraemon/tasks/main.yml index 1aab2c2..0effc26 100644 --- a/roles/mac2hostname/tasks/main.yml +++ b/roles/doraemon/tasks/main.yml @@ -1,4 +1,4 @@ --- -- include: mac2hostname.yml +- include: doraemon.yml tags: - "client-install" diff --git a/roles/mac2hostname/tasks/mac2hostname.yml b/roles/mac2hostname/tasks/mac2hostname.yml deleted file mode 100644 index 383d15d..0000000 --- a/roles/mac2hostname/tasks/mac2hostname.yml +++ /dev/null @@ -1,60 +0,0 @@ ---- -# Installa e configura il servizio per rinominare il client -# Grazie per il servizio a Enrico Bacis - -- name: Installazione dipendenze Python - yum: pkg=python-bottle state=present - sudo: yes - -- name: Check installazione + versione mac2hostname - shell: rpm -q mac2hostname - ignore_errors: yes - register: check_mac2hostname_pkg - changed_when: check_mac2hostname_pkg.rc != 0 or check_mac2hostname_pkg.stdout.find('2.0.0-1') == -1 - -- name: Installazione mac2hostname - yum: pkg=http://syntaxerrormmm.zapto.org/downloads/rpm/mac2hostname-2.0.0-1.el6.noarch.rpm state=present - when: check_mac2hostname_pkg|changed - sudo: yes - -- name: Verifica aggiunta servizi - shell: /sbin/e-smith/db configuration show mac2hostname - sudo: yes - register: chk_mac2hostname_srv - changed_when: chk_mac2hostname_srv.rc != 0 - ignore_errors: yes - -- name: Aggiungo il servizio ai servizi gestiti da NethServer - shell: /sbin/e-smith/db configuration set mac2hostname service status enabled TCPPort 3000 access private - sudo: yes - when: chk_mac2hostname_srv|changed - -- name: Default per NetServer - Cartella defaults - shell: mkdir -p /etc/e-smith/db/configuration/defaults/mac2hostname - sudo: yes - when: chk_mac2hostname_srv|changed - -- name: Default per NethServer - Tipo - shell: echo "service" > /etc/e-smith/db/configuration/defaults/mac2hostname/type - sudo: yes - when: chk_mac2hostname_srv|changed - -- name: Default per NethServer - Stato - shell: echo "enabled" > /etc/e-smith/db/configuration/defaults/mac2hostname/status - sudo: yes - when: chk_mac2hostname_srv|changed - -- name: Aggiunta servizio - shell: /sbin/e-smith/signal-event runlevel-adjust - sudo: yes - when: chk_mac2hostname_srv|changed - -- name: Aggiunta servizio di rete e cambio firewall - shell: /sbin/e-smith/signal-event firewall-adjust - sudo: yes - when: chk_mac2hostname_srv|changed - -- name: Avvio di mac2hostname - shell: service mac2hostname start - sudo: yes - when: chk_mac2hostname_srv|changed diff --git a/roles/pxe/tasks/pxe.yml b/roles/pxe/tasks/pxe.yml index 8ed3436..b8336ee 100644 --- a/roles/pxe/tasks/pxe.yml +++ b/roles/pxe/tasks/pxe.yml @@ -129,6 +129,7 @@ - docenti-trusty.cfg - ubuntu-trusty.cfg - post-ks.sh + - getvaultpass.py - ansible-pull.sh - ansible-pull-crontab diff --git a/roles/pxe/templates/ks/ansible-pull.sh b/roles/pxe/templates/ks/ansible-pull.sh index 040b3b9..332f211 100644 --- a/roles/pxe/templates/ks/ansible-pull.sh +++ b/roles/pxe/templates/ks/ansible-pull.sh @@ -10,4 +10,4 @@ logfile=/var/lib/ansible-pull.log branch=master playbook=local.yml -ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" +ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "/root/.ansible/vault.txt" diff --git a/roles/pxe/templates/ks/getvaultpass.py b/roles/pxe/templates/ks/getvaultpass.py new file mode 100644 index 0000000..0d6e8a8 --- /dev/null +++ b/roles/pxe/templates/ks/getvaultpass.py @@ -0,0 +1,21 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +from Crypto.Hash import MD5 +from Crypto.Cipher import AES +from base64 import b64decode +from requests import get +from socket import gethostname +from os import makedirs, path + +key = MD5.new(gethostname()).digest() +cipher = AES.new(key, AES.MODE_ECB) +base64enc = get("http://{{ serverfqdn }}:3000/vaultpass") +encrypted = b64decode(base64enc) +longpass = cipher.decrypt(encrypted) + +if not path.exists('/root/.ansible'): + makedirs('/root/.ansible') + +with open('/root/.ansible/vault.txt', 'w') as vaultfile: + vaultfile.write(longpass.strip('x')) diff --git a/roles/pxe/templates/ks/post-ks.sh b/roles/pxe/templates/ks/post-ks.sh index bf54ccc..7e2b59a 100644 --- a/roles/pxe/templates/ks/post-ks.sh +++ b/roles/pxe/templates/ks/post-ks.sh @@ -15,6 +15,10 @@ unset https_proxy install -d -o root -g root /var/lib/{{ domainfull }}/config install -d -o root -g root /var/lib/{{ domainfull }}/bin +# Installo lo script per la decrittazione della password del vault +wget -q http://{{ serverfqdn }}/ks/getvaultpass.py -O /tmp/getvaultpass.py +python /tmp/getvaultpass.py && rm -f /tmp/getvaultpass.py + # Installo lo script per l'avvio di ansible-pull da root wget -q http://{{ serverfqdn }}/ks/ansible-pull.sh -O /tmp/ansible-pull.sh install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ domainfull }}/bin/ansible-pull.sh