Skip to content

Commit d884562

Browse files
hunleydhunleyd
committed
revert(setup-system.yml): revert to upstream in this PR
1 parent cfcca4a commit d884562

File tree

1 file changed

+207
-176
lines changed

1 file changed

+207
-176
lines changed

‎ansible/tasks/setup-system.yml‎

Lines changed: 207 additions & 176 deletions
Original file line numberDiff line numberDiff line change
@@ -1,185 +1,216 @@
1-
- name: execute (debpkg_mode or nixpkg_mode) tasks
2-
when:
3-
- (debpkg_mode or nixpkg_mode)
4-
block:
5-
- name: System - apt update and apt upgrade
6-
ansible.builtin.apt:
7-
update_cache: true
8-
upgrade: true
9-
# SEE http://archive.vn/DKJjs#parameter-upgrade
10-
11-
- name: Install desired packages
12-
ansible.builtin.apt:
13-
cache_valid_time: 3600
14-
pkg:
15-
- acl # SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
16-
- fail2ban
17-
- htop
18-
- less
19-
- linux-libc-dev
20-
- net-tools
21-
- nftables
22-
- ngrep
23-
- sysstat
24-
- tzdata
25-
- vim-tiny
26-
state: 'present'
27-
update_cache: true
28-
29-
- name: Use nftables backend
30-
community.general.alternatives:
31-
name: "{{ nft_alt_item['name'] }}"
32-
path: "{{ nft_alt_item['path'] }}"
33-
loop:
34-
- { name: 'arptables', path: '/usr/sbin/arptables-nft' }
35-
- { name: 'ebtables', path: '/usr/sbin/ebtables-nft' }
36-
- { name: 'iptables', path: '/usr/sbin/iptables-nft' }
37-
- { name: 'ip6tables', path: '/usr/sbin/ip6tables-nft' }
38-
loop_control:
39-
loop_var: 'nft_alt_item'
40-
41-
- name: Restart ufw
42-
ansible.builtin.systemd_service:
43-
name: 'ufw'
44-
state: 'restarted'
45-
46-
- name: Create Sysstat log directory
47-
ansible.builtin.file:
48-
path: '/var/log/sysstat'
49-
state: 'directory'
50-
51-
- bwm-ng
52-
53-
- name: Configure sysstat
54-
ansible.builtin.copy:
55-
dest: "/etc/{{ systat_item }}/sysstat"
56-
src: "files/{{ systat_item }}.sysstat"
57-
loop:
58-
- default
59-
- systat
60-
loop_control:
61-
loop_var: 'systat_item'
62-
63-
- name: Adjust APT update intervals
64-
ansible.builtin.copy:
65-
dest: '/etc/apt/apt.conf.d/10periodic'
66-
src: 'files/apt_periodic'
1+
- name: System - apt update and apt upgrade
2+
apt: update_cache=yes upgrade=yes
3+
when: debpkg_mode or nixpkg_mode
4+
# SEE http://archive.vn/DKJjs#parameter-upgrade
5+
6+
- name: Install required security updates
7+
apt:
8+
pkg:
9+
- tzdata
10+
- linux-libc-dev
11+
when: debpkg_mode or nixpkg_mode
12+
# SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
13+
# Without this, a similar error is faced
14+
- name: Install Ansible dependencies
15+
apt:
16+
pkg:
17+
- acl
18+
when: debpkg_mode or nixpkg_mode
19+
20+
- name: Install security tools
21+
apt:
22+
pkg:
23+
- nftables
24+
- fail2ban
25+
update_cache: yes
26+
cache_valid_time: 3600
27+
when: debpkg_mode or nixpkg_mode
28+
29+
- name: Use nftables backend
30+
shell: |
31+
update-alternatives --set iptables /usr/sbin/iptables-nft
32+
update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
33+
update-alternatives --set arptables /usr/sbin/arptables-nft
34+
update-alternatives --set ebtables /usr/sbin/ebtables-nft
35+
systemctl restart ufw
36+
when: debpkg_mode or nixpkg_mode
37+
38+
- name: Create Sysstat log directory
39+
file:
40+
path: /var/log/sysstat
41+
state: directory
42+
when: debpkg_mode or nixpkg_mode
43+
44+
- name: Install other useful tools
45+
apt:
46+
pkg:
47+
- bwm-ng
48+
- htop
49+
- net-tools
50+
- ngrep
51+
- sysstat
52+
- vim-tiny
53+
update_cache: yes
54+
when: debpkg_mode or nixpkg_mode
55+
56+
- name: Install other useful tools
57+
apt:
58+
pkg:
59+
- less
60+
update_cache: yes
61+
when: qemu_mode is defined
62+
63+
- name: Configure sysstat
64+
copy:
65+
src: files/sysstat.sysstat
66+
dest: /etc/sysstat/sysstat
67+
when: debpkg_mode or nixpkg_mode
68+
69+
- name: Configure default sysstat
70+
copy:
71+
src: files/default.sysstat
72+
dest: /etc/default/sysstat
73+
when: debpkg_mode or nixpkg_mode
74+
75+
76+
- name: Adjust APT update intervals
77+
copy:
78+
src: files/apt_periodic
79+
dest: /etc/apt/apt.conf.d/10periodic
80+
when: debpkg_mode or nixpkg_mode
6781

6882
# Find platform architecture and set as a variable
69-
- name: set the arch as a fact
70-
ansible.builtin.set_fact:
71-
platform: "{{ 'arm64' if ansible_facts['architecture'] == 'aarch64' else 'amd64' }}"
83+
- name: finding platform architecture
84+
shell: if [ $(uname -m) = "aarch64" ]; then echo "arm64"; else echo "amd64"; fi
85+
register: platform_output
7286
tags:
7387
- update
7488
- update-only
75-
when:
76-
- (debpkg_mode or nixpkg_mode or stage2_nix)
77-
78-
- name: execute tasks when )debpkg_mode or nixpkg_mode)
79-
when:
80-
- (debpkg_mode or nixpkg_mode)
81-
block:
82-
- name: create overrides dir
83-
ansible.builtin.file:
84-
group: 'root'
85-
mode: '0700'
86-
owner: 'root'
87-
path: '/etc/systemd/system/systemd-resolved.service.d'
88-
state: 'directory'
89-
90-
- name: Custom systemd overrides for resolved
91-
ansible.builtin.copy:
92-
dest: '/etc/systemd/system/systemd-resolved.service.d/override.conf'
93-
src: 'files/systemd-resolved.conf'
94-
95-
- name: System - Create services.slice
96-
ansible.builtin.template:
97-
dest: '/etc/systemd/system/services.slice'
98-
src: 'files/services.slice.j2'
99-
100-
101-
- name: System - systemd reload
102-
ansible.builtin.systemd_service:
103-
daemon_reload: true
104-
105-
- name: Configure journald
106-
ansible.builtin.copy:
107-
dest: '/etc/systemd/journald.conf'
108-
src: 'files/journald.conf'
109-
110-
- name: reload systemd-journald
111-
ansible.builtin.systemd_service:
112-
name: 'systemd-journald'
113-
state: 'restarted'
114-
115-
- name: Configure logind
116-
ansible.builtin.copy:
117-
dest: '/etc/systemd/logind.conf'
118-
src: 'files/logind.conf'
119-
120-
- name: reload systemd-logind
121-
ansible.builtin.systemd_service:
122-
name: 'systemd-logind'
123-
state: 'restarted'
124-
125-
- name: enable timestamps for shell history
126-
ansible.builtin.lineinfile:
127-
create: true
128-
group: 'root'
129-
line: "export HISTTIMEFORMAT='%d/%m/%y %T '"
130-
mode: '0644'
131-
owner: 'root'
132-
path: '/etc/profile.d/09-history-timestamps.sh'
133-
state: 'present'
134-
135-
- name: configure systemd's pager
136-
ansible.builtin.lineinfile:
137-
create: true
138-
dest: '/etc/profile.d/10-systemd-pager.sh'
139-
line: 'export SYSTEMD_LESS=FRXMK'
140-
mode: '0644'
141-
owner: 'root'
142-
group: 'root'
143-
state: 'present'
144-
145-
- name: set hosts file
146-
ansible.builtin.lineinfile:
147-
dest: '/etc/hosts'
148-
group: 'root'
149-
line: "{{ localhost_item }}"
150-
mode: '0644'
151-
owner: 'root'
152-
state: 'present'
153-
loop:
154-
- '127.0.0.1 localhost'
155-
- '::1 localhost'
156-
loop_control:
157-
loop_var: 'localhost_item'
158-
159-
# Set Sysctl params for restarting the OS on oom after 10
160-
- name: Set {{ sysctl_item['name'] }}={{ sysctl_item['value'] }}
161-
ansible.posix.sysctl:
162-
name: "{{ sysctl_item['name'] }}"
163-
reload: true
164-
state: 'present'
165-
value: "{{ sysctl_item['value'] }}"
166-
loop:
167-
- { name: 'kernel.panic', value: 10 }
168-
- { name: 'net.ipv4.tcp_keepalive_intvl', value: 60 }
169-
- { name: 'net.ipv4.tcp_keepalive_time', value 1800 }
170-
- { name: 'vm.panic_on_oom', value: 1 }
171-
loop_control:
172-
loop_var: 'sysctl_item'
89+
- set_fact:
90+
platform: "{{ platform_output.stdout }}"
91+
tags:
92+
- update
93+
- update-only
94+
when: debpkg_mode or nixpkg_mode or stage2_nix
95+
96+
- name: create overrides dir
97+
file:
98+
state: directory
99+
owner: root
100+
group: root
101+
path: /etc/systemd/system/systemd-resolved.service.d
102+
mode: '0700'
103+
when: debpkg_mode or nixpkg_mode
104+
105+
- name: Custom systemd overrides for resolved
106+
copy:
107+
src: files/systemd-resolved.conf
108+
dest: /etc/systemd/system/systemd-resolved.service.d/override.conf
109+
when: debpkg_mode or nixpkg_mode
110+
111+
- name: System - Create services.slice
112+
template:
113+
src: files/services.slice.j2
114+
dest: /etc/systemd/system/services.slice
115+
when: debpkg_mode or nixpkg_mode
116+
117+
118+
- name: System - systemd reload
119+
systemd: daemon_reload=yes
120+
when: debpkg_mode or nixpkg_mode
121+
122+
- name: Configure journald
123+
copy:
124+
src: files/journald.conf
125+
dest: /etc/systemd/journald.conf
126+
when: debpkg_mode or nixpkg_mode
127+
128+
- name: reload systemd-journald
129+
systemd:
130+
name: systemd-journald
131+
state: restarted
132+
when: debpkg_mode or nixpkg_mode
133+
134+
- name: Configure logind
135+
copy:
136+
src: files/logind.conf
137+
dest: /etc/systemd/logind.conf
138+
when: debpkg_mode or nixpkg_mode
139+
140+
- name: reload systemd-logind
141+
systemd:
142+
name: systemd-logind
143+
state: restarted
144+
when: debpkg_mode or nixpkg_mode
145+
146+
- name: enable timestamps for shell history
147+
copy:
148+
content: |
149+
export HISTTIMEFORMAT='%d/%m/%y %T '
150+
dest: /etc/profile.d/09-history-timestamps.sh
151+
mode: 0644
152+
owner: root
153+
group: root
154+
when: debpkg_mode or nixpkg_mode
155+
156+
- name: configure systemd's pager
157+
copy:
158+
content: |
159+
export SYSTEMD_LESS=FRXMK
160+
dest: /etc/profile.d/10-systemd-pager.sh
161+
mode: 0644
162+
owner: root
163+
group: root
164+
when: debpkg_mode or nixpkg_mode
165+
166+
- name: set hosts file
167+
copy:
168+
content: |
169+
127.0.0.1 localhost
170+
::1 localhost
171+
dest: /etc/hosts
172+
mode: 0644
173+
owner: root
174+
group: root
175+
when: debpkg_mode or stage2_nix
176+
177+
#Set Sysctl params for restarting the OS on oom after 10
178+
- name: Set vm.panic_on_oom=1
179+
ansible.builtin.sysctl:
180+
name: vm.panic_on_oom
181+
value: '1'
182+
state: present
183+
reload: yes
184+
when: debpkg_mode or nixpkg_mode
185+
186+
- name: Set kernel.panic=10
187+
ansible.builtin.sysctl:
188+
name: kernel.panic
189+
value: '10'
190+
state: present
191+
reload: yes
192+
when: debpkg_mode or nixpkg_mode
173193

174194
- name: configure system
175195
ansible.posix.sysctl:
176-
name: "{{ sysctl_item['name'] }}"
177-
reload: true
178-
state: 'present'
179-
value: "{{ sysctl_item['value'] }}"
180-
loop:
181-
- { name: 'net.ipv4.ip_local_port_range', value: '1025 65000' }
182-
- { name: 'net.core.somaxconn', value: 16834 }
183-
loop_control:
184-
loop_var: 'sysctl_item'
196+
name: 'net.core.somaxconn'
197+
value: 16834
185198

199+
- name: configure system
200+
ansible.posix.sysctl:
201+
name: 'net.ipv4.ip_local_port_range'
202+
value: '1025 65000'
203+
204+
#Set Sysctl params specific to keepalives
205+
- name: Set net.ipv4.tcp_keepalive_time=1800
206+
ansible.builtin.sysctl:
207+
name: net.ipv4.tcp_keepalive_time
208+
value: 1800
209+
state: present
210+
when: debpkg_mode or nixpkg_mode
211+
- name: Set net.ipv4.tcp_keepalive_intvl=60
212+
ansible.builtin.sysctl:
213+
name: net.ipv4.tcp_keepalive_intvl
214+
value: 60
215+
state: present
216+
when: debpkg_mode or nixpkg_mode

0 commit comments

Comments
 (0)