Skip to content

Commit 991fed4

Browse files
hunleydhunleyd
committed
refactor(ansible): bring our ansible up to modern ansible-lint standards
1 parent 61ba084 commit 991fed4

File tree

1 file changed

+175
-200
lines changed

1 file changed

+175
-200
lines changed

‎ansible/tasks/setup-system.yml‎

Lines changed: 175 additions & 200 deletions
Original file line numberDiff line numberDiff line change
@@ -1,209 +1,184 @@
1-
- name: System - apt update and apt upgrade
2-
apt: update_cache=yes upgrade=yes
3-
when: debpkg_mode or nixpkg_mode
4-
# SEE http://archive.vn/DKJjs#parameter-upgrade
5-
6-
- name: Install required security updates
7-
apt:
8-
pkg:
9-
- tzdata
10-
- linux-libc-dev
11-
when: debpkg_mode or nixpkg_mode
12-
# SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
13-
# Without this, a similar error is faced
14-
- name: Install Ansible dependencies
15-
apt:
16-
pkg:
17-
- acl
18-
when: debpkg_mode or nixpkg_mode
19-
20-
- name: Install security tools
21-
apt:
22-
pkg:
23-
- nftables
24-
- fail2ban
25-
update_cache: yes
26-
cache_valid_time: 3600
27-
when: debpkg_mode or nixpkg_mode
28-
29-
- name: Use nftables backend
30-
shell: |
31-
update-alternatives --set iptables /usr/sbin/iptables-nft
32-
update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
33-
update-alternatives --set arptables /usr/sbin/arptables-nft
34-
update-alternatives --set ebtables /usr/sbin/ebtables-nft
35-
systemctl restart ufw
36-
when: debpkg_mode or nixpkg_mode
37-
38-
- name: Create Sysstat log directory
39-
file:
40-
path: /var/log/sysstat
41-
state: directory
42-
when: debpkg_mode or nixpkg_mode
43-
44-
- name: Install other useful tools
45-
apt:
46-
pkg:
47-
- bwm-ng
48-
- htop
49-
- net-tools
50-
- ngrep
51-
- sysstat
52-
- vim-tiny
53-
update_cache: yes
54-
when: debpkg_mode or nixpkg_mode
55-
56-
- name: Configure sysstat
57-
copy:
58-
src: files/sysstat.sysstat
59-
dest: /etc/sysstat/sysstat
60-
when: debpkg_mode or nixpkg_mode
61-
62-
- name: Configure default sysstat
63-
copy:
64-
src: files/default.sysstat
65-
dest: /etc/default/sysstat
66-
when: debpkg_mode or nixpkg_mode
67-
68-
69-
- name: Adjust APT update intervals
70-
copy:
71-
src: files/apt_periodic
72-
dest: /etc/apt/apt.conf.d/10periodic
73-
when: debpkg_mode or nixpkg_mode
1+
- name: execute (debpkg_mode or nixpkg_mode) tasks
2+
when:
3+
- (debpkg_mode or nixpkg_mode)
4+
block:
5+
- name: System - apt update and apt upgrade
6+
ansible.builtin.apt:
7+
update_cache: true
8+
upgrade: true
9+
# SEE http://archive.vn/DKJjs#parameter-upgrade
10+
11+
- name: Install desired packages
12+
ansible.builtin.apt:
13+
cache_valid_time: 3600
14+
pkg:
15+
- acl # SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
16+
- fail2ban
17+
- htop
18+
- linux-libc-dev
19+
- net-tools
20+
- nftables
21+
- ngrep
22+
- sysstat
23+
- tzdata
24+
- vim-tiny
25+
state: 'present'
26+
update_cache: true
27+
28+
- name: Use nftables backend
29+
community.general.alternatives:
30+
name: "{{ nft_alt_item['name'] }}"
31+
path: "{{ nft_alt_item['path'] }}"
32+
loop:
33+
- { name: 'arptables', path: '/usr/sbin/arptables-nft' }
34+
- { name: 'ebtables', path: '/usr/sbin/ebtables-nft' }
35+
- { name: 'iptables', path: '/usr/sbin/iptables-nft' }
36+
- { name: 'ip6tables', path: '/usr/sbin/ip6tables-nft' }
37+
loop_control:
38+
loop_var: 'nft_alt_item'
39+
40+
- name: Restart ufw
41+
ansible.builtin.systemd_service:
42+
name: 'ufw'
43+
state: 'restarted'
44+
45+
- name: Create Sysstat log directory
46+
ansible.builtin.file:
47+
path: '/var/log/sysstat'
48+
state: 'directory'
49+
50+
- bwm-ng
51+
52+
- name: Configure sysstat
53+
ansible.builtin.copy:
54+
dest: "/etc/{{ systat_item }}/sysstat"
55+
src: "files/{{ systat_item }}.sysstat"
56+
loop:
57+
- default
58+
- systat
59+
loop_control:
60+
loop_var: 'systat_item'
61+
62+
- name: Adjust APT update intervals
63+
ansible.builtin.copy:
64+
dest: '/etc/apt/apt.conf.d/10periodic'
65+
src: 'files/apt_periodic'
7466

7567
# Find platform architecture and set as a variable
76-
- name: finding platform architecture
77-
shell: if [ $(uname -m) = "aarch64" ]; then echo "arm64"; else echo "amd64"; fi
78-
register: platform_output
68+
- name: set the arch as a fact
69+
ansible.builtin.set_fact:
70+
platform: "{{ 'arm64' if ansible_facts['architecture'] == 'aarch64' else 'amd64' }}"
7971
tags:
8072
- update
8173
- update-only
82-
- set_fact:
83-
platform: "{{ platform_output.stdout }}"
84-
tags:
85-
- update
86-
- update-only
87-
when: debpkg_mode or nixpkg_mode or stage2_nix
88-
89-
- name: create overrides dir
90-
file:
91-
state: directory
92-
owner: root
93-
group: root
94-
path: /etc/systemd/system/systemd-resolved.service.d
95-
mode: '0700'
96-
when: debpkg_mode or nixpkg_mode
97-
98-
- name: Custom systemd overrides for resolved
99-
copy:
100-
src: files/systemd-resolved.conf
101-
dest: /etc/systemd/system/systemd-resolved.service.d/override.conf
102-
when: debpkg_mode or nixpkg_mode
103-
104-
- name: System - Create services.slice
105-
template:
106-
src: files/services.slice.j2
107-
dest: /etc/systemd/system/services.slice
108-
when: debpkg_mode or nixpkg_mode
109-
110-
111-
- name: System - systemd reload
112-
systemd: daemon_reload=yes
113-
when: debpkg_mode or nixpkg_mode
114-
115-
- name: Configure journald
116-
copy:
117-
src: files/journald.conf
118-
dest: /etc/systemd/journald.conf
119-
when: debpkg_mode or nixpkg_mode
120-
121-
- name: reload systemd-journald
122-
systemd:
123-
name: systemd-journald
124-
state: restarted
125-
when: debpkg_mode or nixpkg_mode
126-
127-
- name: Configure logind
128-
copy:
129-
src: files/logind.conf
130-
dest: /etc/systemd/logind.conf
131-
when: debpkg_mode or nixpkg_mode
132-
133-
- name: reload systemd-logind
134-
systemd:
135-
name: systemd-logind
136-
state: restarted
137-
when: debpkg_mode or nixpkg_mode
138-
139-
- name: enable timestamps for shell history
140-
copy:
141-
content: |
142-
export HISTTIMEFORMAT='%d/%m/%y %T '
143-
dest: /etc/profile.d/09-history-timestamps.sh
144-
mode: 0644
145-
owner: root
146-
group: root
147-
when: debpkg_mode or nixpkg_mode
148-
149-
- name: configure systemd's pager
150-
copy:
151-
content: |
152-
export SYSTEMD_LESS=FRXMK
153-
dest: /etc/profile.d/10-systemd-pager.sh
154-
mode: 0644
155-
owner: root
156-
group: root
157-
when: debpkg_mode or nixpkg_mode
158-
159-
- name: set hosts file
160-
copy:
161-
content: |
162-
127.0.0.1 localhost
163-
::1 localhost
164-
dest: /etc/hosts
165-
mode: 0644
166-
owner: root
167-
group: root
168-
when: debpkg_mode or stage2_nix
169-
170-
#Set Sysctl params for restarting the OS on oom after 10
171-
- name: Set vm.panic_on_oom=1
172-
ansible.builtin.sysctl:
173-
name: vm.panic_on_oom
174-
value: '1'
175-
state: present
176-
reload: yes
177-
when: debpkg_mode or nixpkg_mode
178-
179-
- name: Set kernel.panic=10
180-
ansible.builtin.sysctl:
181-
name: kernel.panic
182-
value: '10'
183-
state: present
184-
reload: yes
185-
when: debpkg_mode or nixpkg_mode
74+
when:
75+
- (debpkg_mode or nixpkg_mode or stage2_nix)
76+
77+
- name: execute tasks when )debpkg_mode or nixpkg_mode)
78+
when:
79+
- (debpkg_mode or nixpkg_mode)
80+
block:
81+
- name: create overrides dir
82+
ansible.builtin.file:
83+
group: 'root'
84+
mode: '0700'
85+
owner: 'root'
86+
path: '/etc/systemd/system/systemd-resolved.service.d'
87+
state: 'directory'
88+
89+
- name: Custom systemd overrides for resolved
90+
ansible.builtin.copy:
91+
dest: '/etc/systemd/system/systemd-resolved.service.d/override.conf'
92+
src: 'files/systemd-resolved.conf'
93+
94+
- name: System - Create services.slice
95+
ansible.builtin.template:
96+
dest: '/etc/systemd/system/services.slice'
97+
src: 'files/services.slice.j2'
98+
99+
100+
- name: System - systemd reload
101+
ansible.builtin.systemd_service:
102+
daemon_reload: true
103+
104+
- name: Configure journald
105+
ansible.builtin.copy:
106+
dest: '/etc/systemd/journald.conf'
107+
src: 'files/journald.conf'
108+
109+
- name: reload systemd-journald
110+
ansible.builtin.systemd_service:
111+
name: 'systemd-journald'
112+
state: 'restarted'
113+
114+
- name: Configure logind
115+
ansible.builtin.copy:
116+
dest: '/etc/systemd/logind.conf'
117+
src: 'files/logind.conf'
118+
119+
- name: reload systemd-logind
120+
ansible.builtin.systemd_service:
121+
name: 'systemd-logind'
122+
state: 'restarted'
123+
124+
- name: enable timestamps for shell history
125+
ansible.builtin.lineinfile:
126+
create: true
127+
group: 'root'
128+
line: "export HISTTIMEFORMAT='%d/%m/%y %T '"
129+
mode: '0644'
130+
owner: 'root'
131+
path: '/etc/profile.d/09-history-timestamps.sh'
132+
state: 'present'
133+
134+
- name: configure systemd's pager
135+
ansible.builtin.lineinfile:
136+
create: true
137+
dest: '/etc/profile.d/10-systemd-pager.sh'
138+
line: 'export SYSTEMD_LESS=FRXMK'
139+
mode: '0644'
140+
owner: 'root'
141+
group: 'root'
142+
state: 'present'
143+
144+
- name: set hosts file
145+
ansible.builtin.lineinfile:
146+
dest: '/etc/hosts'
147+
group: 'root'
148+
line: "{{ localhost_item }}"
149+
mode: '0644'
150+
owner: 'root'
151+
state: 'present'
152+
loop:
153+
- '127.0.0.1 localhost'
154+
- '::1 localhost'
155+
loop_control:
156+
loop_var: 'localhost_item'
157+
158+
# Set Sysctl params for restarting the OS on oom after 10
159+
- name: Set {{ sysctl_item['name'] }}={{ sysctl_item['value'] }}
160+
ansible.posix.sysctl:
161+
name: "{{ sysctl_item['name'] }}"
162+
reload: true
163+
state: 'present'
164+
value: "{{ sysctl_item['value'] }}"
165+
loop:
166+
- { name: 'kernel.panic', value: 10 }
167+
- { name: 'net.ipv4.tcp_keepalive_intvl', value: 60 }
168+
- { name: 'net.ipv4.tcp_keepalive_time', value 1800 }
169+
- { name: 'vm.panic_on_oom', value: 1 }
170+
loop_control:
171+
loop_var: 'sysctl_item'
186172

187173
- name: configure system
188174
ansible.posix.sysctl:
189-
name: 'net.core.somaxconn'
190-
value: 16834
175+
name: "{{ sysctl_item['name'] }}"
176+
reload: true
177+
state: 'present'
178+
value: "{{ sysctl_item['value'] }}"
179+
loop:
180+
- { name: 'net.ipv4.ip_local_port_range', value: '1025 65000' }
181+
- { name: 'net.core.somaxconn', value: 16834 }
182+
loop_control:
183+
loop_var: 'sysctl_item'
191184

192-
- name: configure system
193-
ansible.posix.sysctl:
194-
name: 'net.ipv4.ip_local_port_range'
195-
value: '1025 65000'
196-
197-
#Set Sysctl params specific to keepalives
198-
- name: Set net.ipv4.tcp_keepalive_time=1800
199-
ansible.builtin.sysctl:
200-
name: net.ipv4.tcp_keepalive_time
201-
value: 1800
202-
state: present
203-
when: debpkg_mode or nixpkg_mode
204-
- name: Set net.ipv4.tcp_keepalive_intvl=60
205-
ansible.builtin.sysctl:
206-
name: net.ipv4.tcp_keepalive_intvl
207-
value: 60
208-
state: present
209-
when: debpkg_mode or nixpkg_mode

0 commit comments

Comments
 (0)