diff --git a/roles/ansible-pull/tasks/ansible-pull.yml b/roles/ansible-pull/tasks/ansible-pull.yml index 7667fe1..0e08f9f 100644 --- a/roles/ansible-pull/tasks/ansible-pull.yml +++ b/roles/ansible-pull/tasks/ansible-pull.yml @@ -6,6 +6,7 @@ - name: Template template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }} with_items: + - init-ansible.sh - ansible-pull.sh - getvaultpass.py - crontab diff --git a/roles/ansible-pull/templates/ansible-pull.sh b/roles/ansible-pull/templates/ansible-pull.sh index 11a1c35..a634acd 100644 --- a/roles/ansible-pull/templates/ansible-pull.sh +++ b/roles/ansible-pull/templates/ansible-pull.sh @@ -10,7 +10,7 @@ logfile=/var/lib/ansible-pull.log branch=master playbook=local.yml -vaultpassfile=$(/var/lib/{{ ansible_local.domain.domainfull }}/bin/getvaultpass.py) +vaultpassfile=$(\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | python) ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@ rm -f "${vaultpassfile}" diff --git a/roles/ansible-pull/templates/crontab b/roles/ansible-pull/templates/crontab index 3ab9a0b..55e73d3 100644 --- a/roles/ansible-pull/templates/crontab +++ b/roles/ansible-pull/templates/crontab @@ -1 +1 @@ -@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1 +@reboot root \curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh | bash >>/var/log/ansible-pull.log 2>&1 diff --git a/roles/ansible-pull/templates/init-ansible.sh b/roles/ansible-pull/templates/init-ansible.sh new file mode 100644 index 0000000..2d0c53e --- /dev/null +++ b/roles/ansible-pull/templates/init-ansible.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# Creo directory dipendenti +install -d -o root -g locals /var/lib/{{ ansible_local.domain.domainfull }}/config + +# Installo il cronjob per ansible-pull +wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull +chown root:locals /etc/cron.d/ansible-pull +chmod 0644 /etc/cron.d/ansible-pull + +# Installo il logrotate per ansible +wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull +chown root:locals /etc/logrotate.d/ansible-pull +chmod 0644 /etc/logrotate.d/ansible-pull diff --git a/roles/preseed/tasks/firefoxcert.yml b/roles/preseed/tasks/firefoxcert.yml index 4fd3140..596e969 100644 --- a/roles/preseed/tasks/firefoxcert.yml +++ b/roles/preseed/tasks/firefoxcert.yml @@ -7,16 +7,24 @@ url: "http://localhost/proxy.crt" dest: /tmp/ca.crt +- name: Creo directory per certificati + file: + path: /var/lib/nethserver/ibay/ks/server-ca + state: directory + owner: root + mode: 0755 + sudo: yes + - name: 'Utilizzo cert8.db precedentemente fornito (pulito da FF appena aperto)' copy: src: cert8.db - dest: /var/lib/nethserver/ibay/ks/cert8.db + dest: /var/lib/nethserver/ibay/ks/server-ca/cert8.db owner: root mode: 0644 sudo: yes - name: Integro la CA nel db - shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks + shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks/server-ca sudo: yes - name: Pulizia @@ -24,5 +32,5 @@ sudo: yes with_items: - /tmp/ca.crt - - /var/lib/nethserver/ibay/ks/key3.db - - /var/lib/nethserver/ibay/ks/secmod.db + - /var/lib/nethserver/ibay/ks/server-ca/key3.db + - /var/lib/nethserver/ibay/ks/server-ca/secmod.db diff --git a/roles/preseed/templates/preseed/post-client-ks.sh b/roles/preseed/templates/preseed/post-client-ks.sh index ba8fec3..1b4d0a0 100644 --- a/roles/preseed/templates/preseed/post-client-ks.sh +++ b/roles/preseed/templates/preseed/post-client-ks.sh @@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha echo $TARGETHOSTNAME > /etc/hostname sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts -{% if ansible_product_name == 'VirtualBox' %} -# Installo l'ultimo ansible per ansible-pull -export https_proxy=https://{{ ansible_local.domain.serverip }}:3128 -add-apt-repository -y ppa:ansible/ansible -apt-get update && apt-get install -y ansible -unset https_proxy -{% else %} -# Adding ansible manually from local -wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add - -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list -apt-get update && apt-get install -y ansible -{% endif %} - -# Creo directory dipendenti -install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config -install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin - -# Installo lo script per la decrittazione della password del vault -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py -install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py -rm -f /tmp/getvaultpass.py - -# Installo lo script per l'avvio di ansible-pull da root -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh -install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh -rm -f /tmp/ansible-pull.sh - -# Installo il cronjob -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab -install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull -rm -f /tmp/ansible-pull-crontab -# Installo il logrotate -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate -install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible -rm -f /tmp/ansible-pull-logrotate +# Installo i file necessari per ansible. +\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash diff --git a/roles/preseed/templates/preseed/post-docenti-ks.sh b/roles/preseed/templates/preseed/post-docenti-ks.sh index 9a4a82b..88d1a71 100644 --- a/roles/preseed/templates/preseed/post-docenti-ks.sh +++ b/roles/preseed/templates/preseed/post-docenti-ks.sh @@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha echo $TARGETHOSTNAME > /etc/hostname sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts -{% if ansible_product_name == 'VirtualBox' %} -# Installo l'ultimo ansible per ansible-pull -export https_proxy=https://{{ ansible_local.domain.serverip }}:3128 -add-apt-repository -y ppa:ansible/ansible -apt-get update && apt-get install -y ansible -unset https_proxy -{% else %} -# Adding ansible manually from local -wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add - -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list -apt-get update && apt-get install -y ansible -{% endif %} - -# Creo directory dipendenti -install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config -install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin - -# Installo lo script per la decrittazione della password del vault -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py -install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py -rm -f /tmp/getvaultpass.py - -# Installo lo script per l'avvio di ansible-pull da root -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh -install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh -rm -f /tmp/ansible-pull.sh - -# Installo il cronjob -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab -install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull -rm -f /tmp/ansible-pull-crontab -# Installo il logrotate -wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate -install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible -rm -f /tmp/ansible-pull-logrotate +# Installo i file necessari per ansible. +\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash