forked from LibreSchool/server-config
Simplifying ansible-pull management, script to run ansible are run live from the server. Moved server-ca in its folder. Simplified post-ks scripts.
This commit is contained in:
parent
2d1f6b780f
commit
a6bd1c6deb
@ -6,6 +6,7 @@
|
|||||||
- name: Template
|
- name: Template
|
||||||
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
|
template: src={{ item }} dest=/var/lib/nethserver/ibay/ks/ansible-pull/{{ item }}
|
||||||
with_items:
|
with_items:
|
||||||
|
- init-ansible.sh
|
||||||
- ansible-pull.sh
|
- ansible-pull.sh
|
||||||
- getvaultpass.py
|
- getvaultpass.py
|
||||||
- crontab
|
- crontab
|
||||||
|
@ -10,7 +10,7 @@ logfile=/var/lib/ansible-pull.log
|
|||||||
branch=master
|
branch=master
|
||||||
playbook=local.yml
|
playbook=local.yml
|
||||||
|
|
||||||
vaultpassfile=$(/var/lib/{{ ansible_local.domain.domainfull }}/bin/getvaultpass.py)
|
vaultpassfile=$(\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py | python)
|
||||||
|
|
||||||
ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
|
ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" $@
|
||||||
rm -f "${vaultpassfile}"
|
rm -f "${vaultpassfile}"
|
||||||
|
@ -1 +1 @@
|
|||||||
@reboot root /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh >>/var/log/ansible-pull.log 2>&1
|
@reboot root \curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh | bash >>/var/log/ansible-pull.log 2>&1
|
||||||
|
14
roles/ansible-pull/templates/init-ansible.sh
Normal file
14
roles/ansible-pull/templates/init-ansible.sh
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Creo directory dipendenti
|
||||||
|
install -d -o root -g locals /var/lib/{{ ansible_local.domain.domainfull }}/config
|
||||||
|
|
||||||
|
# Installo il cronjob per ansible-pull
|
||||||
|
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /etc/cron.d/ansible-pull
|
||||||
|
chown root:locals /etc/cron.d/ansible-pull
|
||||||
|
chmod 0644 /etc/cron.d/ansible-pull
|
||||||
|
|
||||||
|
# Installo il logrotate per ansible
|
||||||
|
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /etc/logrotate.d/ansible-pull
|
||||||
|
chown root:locals /etc/logrotate.d/ansible-pull
|
||||||
|
chmod 0644 /etc/logrotate.d/ansible-pull
|
@ -7,16 +7,24 @@
|
|||||||
url: "http://localhost/proxy.crt"
|
url: "http://localhost/proxy.crt"
|
||||||
dest: /tmp/ca.crt
|
dest: /tmp/ca.crt
|
||||||
|
|
||||||
|
- name: Creo directory per certificati
|
||||||
|
file:
|
||||||
|
path: /var/lib/nethserver/ibay/ks/server-ca
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
mode: 0755
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
- name: 'Utilizzo cert8.db precedentemente fornito (pulito da FF appena aperto)'
|
- name: 'Utilizzo cert8.db precedentemente fornito (pulito da FF appena aperto)'
|
||||||
copy:
|
copy:
|
||||||
src: cert8.db
|
src: cert8.db
|
||||||
dest: /var/lib/nethserver/ibay/ks/cert8.db
|
dest: /var/lib/nethserver/ibay/ks/server-ca/cert8.db
|
||||||
owner: root
|
owner: root
|
||||||
mode: 0644
|
mode: 0644
|
||||||
sudo: yes
|
sudo: yes
|
||||||
|
|
||||||
- name: Integro la CA nel db
|
- name: Integro la CA nel db
|
||||||
shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks
|
shell: certutil -A -n "{{ ansible_local.domain.domainfull }}" -t "TCu,Cuw,Tuw" -i /tmp/ca.crt -d /var/lib/nethserver/ibay/ks/server-ca
|
||||||
sudo: yes
|
sudo: yes
|
||||||
|
|
||||||
- name: Pulizia
|
- name: Pulizia
|
||||||
@ -24,5 +32,5 @@
|
|||||||
sudo: yes
|
sudo: yes
|
||||||
with_items:
|
with_items:
|
||||||
- /tmp/ca.crt
|
- /tmp/ca.crt
|
||||||
- /var/lib/nethserver/ibay/ks/key3.db
|
- /var/lib/nethserver/ibay/ks/server-ca/key3.db
|
||||||
- /var/lib/nethserver/ibay/ks/secmod.db
|
- /var/lib/nethserver/ibay/ks/server-ca/secmod.db
|
||||||
|
@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha
|
|||||||
echo $TARGETHOSTNAME > /etc/hostname
|
echo $TARGETHOSTNAME > /etc/hostname
|
||||||
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
|
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
|
||||||
|
|
||||||
{% if ansible_product_name == 'VirtualBox' %}
|
# Installo i file necessari per ansible.
|
||||||
# Installo l'ultimo ansible per ansible-pull
|
\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash
|
||||||
export https_proxy=https://{{ ansible_local.domain.serverip }}:3128
|
|
||||||
add-apt-repository -y ppa:ansible/ansible
|
|
||||||
apt-get update && apt-get install -y ansible
|
|
||||||
unset https_proxy
|
|
||||||
{% else %}
|
|
||||||
# Adding ansible manually from local
|
|
||||||
wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add -
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list
|
|
||||||
apt-get update && apt-get install -y ansible
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
# Creo directory dipendenti
|
|
||||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config
|
|
||||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin
|
|
||||||
|
|
||||||
# Installo lo script per la decrittazione della password del vault
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py
|
|
||||||
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py
|
|
||||||
rm -f /tmp/getvaultpass.py
|
|
||||||
|
|
||||||
# Installo lo script per l'avvio di ansible-pull da root
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh
|
|
||||||
install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh
|
|
||||||
rm -f /tmp/ansible-pull.sh
|
|
||||||
|
|
||||||
# Installo il cronjob
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab
|
|
||||||
install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull
|
|
||||||
rm -f /tmp/ansible-pull-crontab
|
|
||||||
# Installo il logrotate
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate
|
|
||||||
install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible
|
|
||||||
rm -f /tmp/ansible-pull-logrotate
|
|
||||||
|
@ -5,38 +5,5 @@ TARGETHOSTNAME=$(wget -qO- http://{{ ansible_local.domain.serverfqdn }}:3000/wha
|
|||||||
echo $TARGETHOSTNAME > /etc/hostname
|
echo $TARGETHOSTNAME > /etc/hostname
|
||||||
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
|
sed -i "s/kickseed/$TARGETHOSTNAME/g" /etc/hosts
|
||||||
|
|
||||||
{% if ansible_product_name == 'VirtualBox' %}
|
# Installo i file necessari per ansible.
|
||||||
# Installo l'ultimo ansible per ansible-pull
|
\curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/init-ansible.sh | bash
|
||||||
export https_proxy=https://{{ ansible_local.domain.serverip }}:3128
|
|
||||||
add-apt-repository -y ppa:ansible/ansible
|
|
||||||
apt-get update && apt-get install -y ansible
|
|
||||||
unset https_proxy
|
|
||||||
{% else %}
|
|
||||||
# Adding ansible manually from local
|
|
||||||
wget -qO- http://{{ ansible_local.domain.serverfqdn }}/ks/ppa-ansible.gpg | apt-key add -
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-ansible-trusty.list -O /etc/apt/sources.list.d/ansible-ansible-trusty.list
|
|
||||||
apt-get update && apt-get install -y ansible
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
# Creo directory dipendenti
|
|
||||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/config
|
|
||||||
install -d -o root -g root /var/lib/{{ ansible_local.domain.domainfull }}/bin
|
|
||||||
|
|
||||||
# Installo lo script per la decrittazione della password del vault
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/getvaultpass.py -O /tmp/getvaultpass.py
|
|
||||||
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ ansible_local.domain.domainfull}}/bin/getvaultpass.py
|
|
||||||
rm -f /tmp/getvaultpass.py
|
|
||||||
|
|
||||||
# Installo lo script per l'avvio di ansible-pull da root
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/ansible-pull.sh -O /tmp/ansible-pull.sh
|
|
||||||
install -m744 -o root -g root /tmp/ansible-pull.sh /var/lib/{{ ansible_local.domain.domainfull }}/bin/ansible-pull.sh
|
|
||||||
rm -f /tmp/ansible-pull.sh
|
|
||||||
|
|
||||||
# Installo il cronjob
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/crontab -O /tmp/ansible-pull-crontab
|
|
||||||
install -m644 -o root -g root /tmp/ansible-pull-crontab /etc/cron.d/ansible-pull
|
|
||||||
rm -f /tmp/ansible-pull-crontab
|
|
||||||
# Installo il logrotate
|
|
||||||
wget -q http://{{ ansible_local.domain.serverfqdn }}/ks/ansible-pull/logrotate -O /tmp/ansible-pull-logrotate
|
|
||||||
install -m644 -o root -g root /tmp/ansible-pull-logrotate /etc/logrotate.d/ansible
|
|
||||||
rm -f /tmp/ansible-pull-logrotate
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user