From f7e76e9748ee346ab43212e560f80b598ad270c5 Mon Sep 17 00:00:00 2001 From: ansible user Date: Mon, 21 Jul 2025 10:47:59 +0200 Subject: [PATCH] first commit --- hosts | 19 +++ serv-01-baselinux.yml | 16 ++ serv-01-baselinux/.travis.yml | 29 ++++ serv-01-baselinux/README.md | 38 +++++ serv-01-baselinux/defaults/main.yml | 3 + serv-01-baselinux/files/etc/apt/sources.list | 10 ++ .../files/etc/sysctl.d/999-tweaks.conf | 90 +++++++++++ serv-01-baselinux/files/root/.bashrc | 86 +++++++++++ serv-01-baselinux/handlers/main.yml | 4 + serv-01-baselinux/meta/main.yml | 53 +++++++ serv-01-baselinux/tasks/addtoobservium.yml | 69 +++++++++ serv-01-baselinux/tasks/ipchange.yml | 63 ++++++++ serv-01-baselinux/tasks/main.yml | 146 ++++++++++++++++++ serv-01-baselinux/tasks/ntp2.yml | 27 ++++ serv-01-baselinux/tasks/rsyslog.yml | 25 +++ serv-01-baselinux/tasks/services.yml | 35 +++++ serv-01-baselinux/tasks/snmpd.yml | 25 +++ serv-01-baselinux/tasks/sshkey.yml | 10 ++ serv-01-baselinux/tasks/vlans.yml | 18 +++ serv-01-baselinux/templates/etc/ntp.conf.j2 | 11 ++ .../etc/rsyslog.d/rsyslog.remote.conf.j2 | 2 + .../templates/etc/snmp/snmpd.conf.j2 | 19 +++ .../templates/etc/sysctl.d/90-noipv6.conf.j2 | 3 + serv-01-baselinux/tests/inventory | 2 + serv-01-baselinux/vars/main.yml | 4 + serv-02-dockerbookworm.yml | 6 + serv-02-dockerbookworm/.travis.yml | 29 ++++ serv-02-dockerbookworm/README.md | 38 +++++ serv-02-dockerbookworm/defaults/main.yml | 2 + serv-02-dockerbookworm/handlers/main.yml | 2 + serv-02-dockerbookworm/meta/main.yml | 53 +++++++ serv-02-dockerbookworm/tasks/main.yml | 101 ++++++++++++ serv-02-dockerbookworm/tests/inventory | 2 + serv-02-dockerbookworm/tests/test.yml | 5 + serv-02-dockerbookworm/vars/main.yml | 6 + serv-02-dockerbullseye.yml | 6 + serv-02-dockerbullseye/.travis.yml | 29 ++++ serv-02-dockerbullseye/README.md | 38 +++++ serv-02-dockerbullseye/defaults/main.yml | 2 + serv-02-dockerbullseye/handlers/main.yml | 2 + serv-02-dockerbullseye/meta/main.yml | 53 +++++++ serv-02-dockerbullseye/tasks/main.yml | 61 ++++++++ serv-02-dockerbullseye/tests/inventory | 2 + serv-02-dockerbullseye/tests/test.yml | 5 + serv-02-dockerbullseye/vars/main.yml | 6 + serv-04-adduser.yml | 13 ++ serv-04-adduser/README | 6 + serv-04-adduser/README.md | 38 +++++ serv-04-adduser/defaults/main.yml | 3 + serv-04-adduser/files/sshkeys/adminas.pub | 1 + serv-04-adduser/files/sshkeys/cnms.pub | 1 + serv-04-adduser/files/sshkeys/marc.pub | 1 + .../files/sshkeys/mikrotik_key2.pub | 2 + serv-04-adduser/files/sshkeys/mindaugas.pub | 1 + serv-04-adduser/files/sshkeys/pavel.pub | 1 + serv-04-adduser/handlers/main.yml | 3 + serv-04-adduser/meta/main.yml | 35 +++++ serv-04-adduser/tasks/main.yml | 90 +++++++++++ serv-04-adduser/tests/inventory | 3 + serv-04-adduser/tests/test.yml | 6 + serv-04-adduser/vars/main.yml | 3 + serv-05-dockerubuntu24.yml | 16 ++ serv-05-dockerubuntu24/.travis.yml | 29 ++++ serv-05-dockerubuntu24/README.md | 38 +++++ serv-05-dockerubuntu24/defaults/main.yml | 2 + serv-05-dockerubuntu24/handlers/main.yml | 2 + serv-05-dockerubuntu24/meta/main.yml | 53 +++++++ serv-05-dockerubuntu24/tasks/main.yml | 112 ++++++++++++++ serv-05-dockerubuntu24/tests/inventory | 2 + serv-05-dockerubuntu24/tests/test.yml | 5 + serv-05-dockerubuntu24/vars/main.yml | 6 + 71 files changed, 1727 insertions(+) create mode 100644 hosts create mode 100644 serv-01-baselinux.yml create mode 100644 serv-01-baselinux/.travis.yml create mode 100644 serv-01-baselinux/README.md create mode 100644 serv-01-baselinux/defaults/main.yml create mode 100644 serv-01-baselinux/files/etc/apt/sources.list create mode 100644 serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf create mode 100644 serv-01-baselinux/files/root/.bashrc create mode 100644 serv-01-baselinux/handlers/main.yml create mode 100644 serv-01-baselinux/meta/main.yml create mode 100644 serv-01-baselinux/tasks/addtoobservium.yml create mode 100644 serv-01-baselinux/tasks/ipchange.yml create mode 100644 serv-01-baselinux/tasks/main.yml create mode 100644 serv-01-baselinux/tasks/ntp2.yml create mode 100644 serv-01-baselinux/tasks/rsyslog.yml create mode 100644 serv-01-baselinux/tasks/services.yml create mode 100644 serv-01-baselinux/tasks/snmpd.yml create mode 100644 serv-01-baselinux/tasks/sshkey.yml create mode 100644 serv-01-baselinux/tasks/vlans.yml create mode 100644 serv-01-baselinux/templates/etc/ntp.conf.j2 create mode 100644 serv-01-baselinux/templates/etc/rsyslog.d/rsyslog.remote.conf.j2 create mode 100644 serv-01-baselinux/templates/etc/snmp/snmpd.conf.j2 create mode 100644 serv-01-baselinux/templates/etc/sysctl.d/90-noipv6.conf.j2 create mode 100644 serv-01-baselinux/tests/inventory create mode 100644 serv-01-baselinux/vars/main.yml create mode 100644 serv-02-dockerbookworm.yml create mode 100644 serv-02-dockerbookworm/.travis.yml create mode 100644 serv-02-dockerbookworm/README.md create mode 100644 serv-02-dockerbookworm/defaults/main.yml create mode 100644 serv-02-dockerbookworm/handlers/main.yml create mode 100644 serv-02-dockerbookworm/meta/main.yml create mode 100644 serv-02-dockerbookworm/tasks/main.yml create mode 100644 serv-02-dockerbookworm/tests/inventory create mode 100644 serv-02-dockerbookworm/tests/test.yml create mode 100644 serv-02-dockerbookworm/vars/main.yml create mode 100644 serv-02-dockerbullseye.yml create mode 100644 serv-02-dockerbullseye/.travis.yml create mode 100644 serv-02-dockerbullseye/README.md create mode 100644 serv-02-dockerbullseye/defaults/main.yml create mode 100644 serv-02-dockerbullseye/handlers/main.yml create mode 100644 serv-02-dockerbullseye/meta/main.yml create mode 100644 serv-02-dockerbullseye/tasks/main.yml create mode 100644 serv-02-dockerbullseye/tests/inventory create mode 100644 serv-02-dockerbullseye/tests/test.yml create mode 100644 serv-02-dockerbullseye/vars/main.yml create mode 100644 serv-04-adduser.yml create mode 100644 serv-04-adduser/README create mode 100644 serv-04-adduser/README.md create mode 100644 serv-04-adduser/defaults/main.yml create mode 100644 serv-04-adduser/files/sshkeys/adminas.pub create mode 100644 serv-04-adduser/files/sshkeys/cnms.pub create mode 100644 serv-04-adduser/files/sshkeys/marc.pub create mode 100644 serv-04-adduser/files/sshkeys/mikrotik_key2.pub create mode 100644 serv-04-adduser/files/sshkeys/mindaugas.pub create mode 100644 serv-04-adduser/files/sshkeys/pavel.pub create mode 100644 serv-04-adduser/handlers/main.yml create mode 100644 serv-04-adduser/meta/main.yml create mode 100644 serv-04-adduser/tasks/main.yml create mode 100644 serv-04-adduser/tests/inventory create mode 100644 serv-04-adduser/tests/test.yml create mode 100644 serv-04-adduser/vars/main.yml create mode 100644 serv-05-dockerubuntu24.yml create mode 100644 serv-05-dockerubuntu24/.travis.yml create mode 100644 serv-05-dockerubuntu24/README.md create mode 100644 serv-05-dockerubuntu24/defaults/main.yml create mode 100644 serv-05-dockerubuntu24/handlers/main.yml create mode 100644 serv-05-dockerubuntu24/meta/main.yml create mode 100644 serv-05-dockerubuntu24/tasks/main.yml create mode 100644 serv-05-dockerubuntu24/tests/inventory create mode 100644 serv-05-dockerubuntu24/tests/test.yml create mode 100644 serv-05-dockerubuntu24/vars/main.yml diff --git a/hosts b/hosts new file mode 100644 index 0000000..9cda53b --- /dev/null +++ b/hosts @@ -0,0 +1,19 @@ +[servers:children] +preprod +prod + +[preprod] +sterver01 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.71 ansible_python_interpreter=/usr/bin/python3 +sterver02 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.252 ansible_python_interpreter=/usr/bin/python3 +sterver03 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.251 ansible_python_interpreter=/usr/bin/python3 +sterver04 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.250 ansible_python_interpreter=/usr/bin/python3 +staging-cloud dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.25 ansible_python_interpreter=/usr/bin/python3 + + +[prod] +jump01 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.2 ansible_python_interpreter=/usr/bin/python3 +observium dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.10 ansible_python_interpreter=/usr/bin/python3 +syslogger dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.11 ansible_python_interpreter=/usr/bin/python3 +gt-cache-srv1 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.13.5 ansible_python_interpreter=/usr/bin/python3 +production-cloud dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.13.7 ansible_python_interpreter=/usr/bin/python3 +unidocker1 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.12 ansible_python_interpreter=/usr/bin/python3 diff --git a/serv-01-baselinux.yml b/serv-01-baselinux.yml new file mode 100644 index 0000000..3191f5f --- /dev/null +++ b/serv-01-baselinux.yml @@ -0,0 +1,16 @@ +--- +# - name: Pre-IP override setup +# hosts: all +# gather_facts: false +# tasks: +# - name: Capture static IP and override ansible_host with ansible_oldip +# set_fact: +# ansible_newip: "{{ hostvars[inventory_hostname]['ansible_host'] }}" +# ansible_host: "{{ ansible_oldip }}" +# when: ansible_oldip is defined + + - hosts: all + become: true + + roles: + - serv-01-baselinux diff --git a/serv-01-baselinux/.travis.yml b/serv-01-baselinux/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/serv-01-baselinux/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/serv-01-baselinux/README.md b/serv-01-baselinux/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/serv-01-baselinux/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/serv-01-baselinux/defaults/main.yml b/serv-01-baselinux/defaults/main.yml new file mode 100644 index 0000000..dbd9ba9 --- /dev/null +++ b/serv-01-baselinux/defaults/main.yml @@ -0,0 +1,3 @@ +--- +observium_server: observium # your Observium host group +observium_container: observium # the Docker container name \ No newline at end of file diff --git a/serv-01-baselinux/files/etc/apt/sources.list b/serv-01-baselinux/files/etc/apt/sources.list new file mode 100644 index 0000000..6d5871b --- /dev/null +++ b/serv-01-baselinux/files/etc/apt/sources.list @@ -0,0 +1,10 @@ +deb http://deb.debian.org/debian bookworm main non-free contrib +deb-src http://deb.debian.org/debian bookworm main non-free contrib + +deb http://security.debian.org/debian-security bookworm-security main contrib non-free +deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free + +# bookworm-updates, to get updates before a point release is made; +# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html # _updates_and_backports +deb http://deb.debian.org/debian bookworm-updates main contrib non-free +deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free diff --git a/serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf b/serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf new file mode 100644 index 0000000..bb4b0ab --- /dev/null +++ b/serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf @@ -0,0 +1,90 @@ + +# ===== Memory Management ===== + +# Reduce swappiness to avoid swapping until really necessary +vm.swappiness = 10 + +# Increase max read/write I/O requests (helps with I/O-heavy VMs) +vm.max_map_count = 262144 + +# Don't overcommit memory aggressively +vm.overcommit_memory = 1 +vm.overcommit_ratio = 80 + +# Enable process memory reclaiming +vm.dirty_ratio = 15 +vm.dirty_background_ratio = 5 + +# ===== File System & Descriptors ===== + +# Allow more open file handles (important for services handling many files/connections) +fs.file-max = 2097152 + +# ===== Networking: Buffers ===== + +# Increase network buffer space (for high-throughput applications) +net.core.rmem_max = 16777216 +net.core.wmem_max = 16777216 +net.core.rmem_default = 262144 +net.core.wmem_default = 262144 + +# Increase backlog queues +net.core.netdev_max_backlog = 5000 +net.core.somaxconn = 1024 + +# ===== Networking: TCP Tweaks ===== + +# Enable TCP SYN cookies to prevent SYN flood DoS attacks +net.ipv4.tcp_syncookies = 1 + +# Reduce FIN timeout to clean up closed connections faster +net.ipv4.tcp_fin_timeout = 15 + +# Enable TCP keepalive probes more aggressively +net.ipv4.tcp_keepalive_time = 300 +net.ipv4.tcp_keepalive_intvl = 60 +net.ipv4.tcp_keepalive_probes = 5 + +# Reduce time-wait connections held +net.ipv4.tcp_max_tw_buckets = 2000000 +net.ipv4.tcp_tw_reuse = 1 +net.ipv4.tcp_tw_recycle = 0 + +# Increase TCP buffer limits +net.ipv4.tcp_rmem = 4096 87380 16777216 +net.ipv4.tcp_wmem = 4096 65536 16777216 + +# ===== Networking: Connection Tracking ===== + +# (if conntrack is involved, increase bucket sizes – useful for iptables/nftables with many connections) +net.netfilter.nf_conntrack_max = 262144 + +# ===== Security & Routing ===== + +# Disable IP source routing +net.ipv4.conf.all.accept_source_route = 0 +net.ipv4.conf.default.accept_source_route = 0 + +# Disable ICMP redirects (security & performance) +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 + +# Do not send ICMP redirects (we are not a router) +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 + +# Enable Reverse Path Filterin +net.ipv4.conf.all.rp_filter = 1 +net.ipv4.conf.default.rp_filter = 1 + +# ===== Performance ===== + +# Avoid using swap too eagerly under memory pressure +vm.min_free_kbytes = 65536 + +# ===== IPv6 Tuning (disable if unused) ===== + +# Uncomment if IPv6 is not used +# net.ipv6.conf.all.disable_ipv6 = 1 +# net.ipv6.conf.default.disable_ipv6 = 1 + diff --git a/serv-01-baselinux/files/root/.bashrc b/serv-01-baselinux/files/root/.bashrc new file mode 100644 index 0000000..561818d --- /dev/null +++ b/serv-01-baselinux/files/root/.bashrc @@ -0,0 +1,86 @@ +## +## Slightly nicer .bashrc +## Makes pretty colors and stuff +## + +## Set $PATH, which tells the computer where to search for commands +export PATH="$PATH:/usr/sbin:/sbin:/bin:/usr/bin:/etc:/usr/ucb:/usr/local/bin:/usr/local/local_dfs/bin:/usr/bin/X11:/usr/local/sas" + +## Where to search for manual pages +export MANPATH="/usr/share/man:/usr/local/man:/usr/local/local_dfs/man" + +## Which pager to use. +export PAGER=less + +## Choose your weapon +EDITOR=/usr/bin/vim +#EDITOR=/usr/bin/emacs +#EDITOR=/usr/bin/nano +export EDITOR + +## The maximum number of lines in your history file +export HISTFILESIZE=50 + +## UVM! +export ORGANIZATION="University of Vermont" + +## Enables displaying colors in the terminal +export TERM=xterm-color + +# Uncomment the following lines if you are an ARC/INFO user +#alias arc=/usr/local/bin/arc +#alias arcdoc=/usr/local/bin/arcdoc +#alias info=/usr/local/bin/arcinfo + +## Disable automatic mail checking +unset MAILCHECK + +## If this is an interactive console, disable messaging +#tty -s && mesg n + +## Aliases from 'ol EMBA tcsh +#alias bye=logout +#alias h=history +#alias jobs='jobs -l' +#alias lf='ls -algF' +#alias log=logout +#alias cls=clear +#alias edit=$EDITOR +#alias restore=/usr/local/local_dfs/bin/restore + +## Automatically correct mistyped 'cd' directories +#shopt -s cdspell + +## Append to history file; do not overwrite +shopt -s histappend + +## Prevent accidental overwrites when using IO redirection +set -o noclobber + +## Set the prompt to display the current git branch +## and use pretty colors +export PS1='$(git branch &>/dev/null; if [ $? -eq 0 ]; then \ +echo "\[\e[1m\]\u@\h\[\e[0m\]: \w [\[\e[34m\]$(git branch | grep ^* | sed s/\*\ //)\[\e[0m\]\ +$(echo `git status` | grep "nothing to commit" > /dev/null 2>&1; if [ "$?" -ne "0" ]; then \ +echo "\[\e[1;31m\]*\[\e[0m\]"; fi)] \$ "; else \ +echo "\[\e[1m\]\u@\h\[\e[0m\]: \w \$ "; fi )' +# ~/.bashrc: executed by bash(1) for non-login shells. + +# Note: PS1 and umask are already set in /etc/profile. You should not +# need this unless you want different defaults for root. +# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ ' +# umask 022 + +# You may uncomment the following lines if you want `ls' to be colorized: +# export LS_OPTIONS='--color=auto' +# eval "$(dircolors)" +# alias ls='ls $LS_OPTIONS' +# alias ll='ls $LS_OPTIONS -l' +# alias l='ls $LS_OPTIONS -lA' +# +# Some more alias to avoid making mistakes: +# alias rm='rm -i' +# alias cp='cp -i' +# alias mv='mv -i' +alias pip=pip3 +PS1="\[\e[01;37m\][\[\e[0m\]\[\e[01;31m\]\u\[\e[0m\]\[\e[00;37m\]@\[\e[0m\]\[\e[01;34m\]\h\[\e[0m\]\[\e[00;37m\] \[\e[0m\]\[\e[00;37m\]\t\[\e[0m\]\[\e[01;37m\] \W]\\$ \[\e[0m\]" diff --git a/serv-01-baselinux/handlers/main.yml b/serv-01-baselinux/handlers/main.yml new file mode 100644 index 0000000..82e0b0d --- /dev/null +++ b/serv-01-baselinux/handlers/main.yml @@ -0,0 +1,4 @@ +--- +# handlers file for 03baselinux +- name: Apply netplan + ansible.builtin.shell: netplan apply \ No newline at end of file diff --git a/serv-01-baselinux/meta/main.yml b/serv-01-baselinux/meta/main.yml new file mode 100644 index 0000000..227ad9c --- /dev/null +++ b/serv-01-baselinux/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.9 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. + \ No newline at end of file diff --git a/serv-01-baselinux/tasks/addtoobservium.yml b/serv-01-baselinux/tasks/addtoobservium.yml new file mode 100644 index 0000000..017a52e --- /dev/null +++ b/serv-01-baselinux/tasks/addtoobservium.yml @@ -0,0 +1,69 @@ +--- +- name: Extract SNMP community string from snmpd.conf using shell +# become: true + shell: | + awk '/^com2sec\s+readonly/ {print $4}' /etc/snmp/snmpd.conf | head -1 + register: snmp_comm_out + changed_when: false + +- name: Set fact with SNMP community + set_fact: + snmp_community: "{{ snmp_comm_out.stdout | trim }}" + +- name: Debug found community + debug: + msg: "SNMP community: {{ snmp_community }}" + +# 2️⃣ Check if this host is already in Observium — runs on the Observium server +- name: Check if host is already in Observium database + become: false + delegate_to: "{{ observium_server }}" + shell: | + docker exec {{ observium_container }} bash -c ' + MYHOST={{ inventory_hostname }}; + echo "SELECT device_id FROM devices WHERE hostname = '\''$MYHOST'\'';" | \ + mysql -u"$OBSERVIUM_DB_USER" -p"$OBSERVIUM_DB_PASS" \ + -h "$OBSERVIUM_DB_HOST" "$OBSERVIUM_DB_NAME" + ' + register: observium_check + changed_when: false + +- name: Determine if host is already present in Observium + set_fact: + observium_device_id: >- + {{ + observium_check.stdout_lines + | select('match', '^[0-9]+') + | list + | first + | default('') + }} + +- name: Show if host is already present + debug: + msg: "✅ Host {{ inventory_hostname }} is already in Observium (Device ID: {{ observium_device_id }})" + when: observium_device_id != "" + +# 3️⃣ Add the host to Observium if it does not exist +- name: Add host to Observium + become: false + delegate_to: "{{ observium_server }}" + shell: | + docker exec {{ observium_container }} bash -c './add_device.php {{ inventory_hostname }} {{ snmp_community }} v2c' + register: add_result + when: observium_device_id == "" + +- name: Check if add_device.php output shows success + set_fact: + observium_add_success: "{{ add_result.stdout is search('Added device') }}" + when: observium_device_id == "" + +- name: Show result of Observium addition + debug: + msg: >- + {% if observium_add_success %} + ✅ Host {{ inventory_hostname }} was successfully added to Observium. + {% else %} + ⚠️ Host {{ inventory_hostname }} was NOT added to Observium. Check manually! + {% endif %} + when: observium_device_id == "" \ No newline at end of file diff --git a/serv-01-baselinux/tasks/ipchange.yml b/serv-01-baselinux/tasks/ipchange.yml new file mode 100644 index 0000000..cf26ad4 --- /dev/null +++ b/serv-01-baselinux/tasks/ipchange.yml @@ -0,0 +1,63 @@ +--- +- name: Configure static IP using Netplan (only if needed) + become: true + when: + - ansible_distribution == "Ubuntu" + - ansible_oldip is defined + - ansible_oldip != ansible_newip + block: + + - name: Detect primary network interface + set_fact: + netplan_interface: "{{ ansible_default_ipv4.interface }}" + + - name: Derive CIDR prefix from netmask (fallback to 24) + set_fact: + netmask_bits: "{{ ansible_default_ipv4.netmask | ansible.utils.ipaddr('prefix') | default('24', true) }}" + + - name: Capture system DNS servers (fallback to 8.8.8.8) + set_fact: + current_dns_servers: "{{ ansible_dns.nameservers | default(['8.8.8.8']) }}" + + + - name: Generate Netplan config with static IP + ansible.builtin.copy: + dest: /etc/netplan/01-netcfg.yaml + mode: '0600' + content: | + network: + version: 2 + renderer: networkd + ethernets: + {{ netplan_interface }}: + dhcp4: no + addresses: [{{ ansible_newip }}/{{ netmask_bits }}] + routes: + - to: default + via: {{ ansible_default_ipv4.gateway }} + nameservers: + addresses: {{ current_dns_servers }} + + + - name: Remove default cloud-init netplan config + ansible.builtin.file: + path: /etc/netplan/50-cloud-init.yaml + state: absent + notify: Apply netplan + + - name: Wait for network change to apply + ansible.builtin.pause: + seconds: 10 + + - name: Wait for host to become reachable on new IP + ansible.builtin.wait_for: + host: "{{ ansible_newip }}" + port: 22 + delay: 5 + timeout: 120 + state: started + + - name: Reassign ansible_host to the new static IP + set_fact: + ansible_host: "{{ ansible_newip }}" + diff --git a/serv-01-baselinux/tasks/main.yml b/serv-01-baselinux/tasks/main.yml new file mode 100644 index 0000000..36240ea --- /dev/null +++ b/serv-01-baselinux/tasks/main.yml @@ -0,0 +1,146 @@ +--- + - name: Get current hostname + ansible.builtin.command: hostname + register: hostname_result + + + + - name: Allow 'ansible' user passwordless sudo (temporary) + ansible.builtin.copy: + dest: /etc/sudoers.d/ansible + content: "ansible ALL=(ALL) NOPASSWD:ALL\n" + owner: root + group: root + mode: '0440' + + - name: Regenerate machine-id if hostname contains 'template' + block: + - name: Remove /etc/machine-id + ansible.builtin.file: + path: /etc/machine-id + state: absent + + - name: Remove legacy /var/lib/dbus/machine-id if exists + ansible.builtin.file: + path: /var/lib/dbus/machine-id + state: absent + + - name: Regenerate machine-id + ansible.builtin.command: systemd-machine-id-setup + args: + creates: /etc/machine-id + when: "'template' in hostname_result.stdout" + + - name: Set hostname + ansible.builtin.hostname: + name: "{{ inventory_hostname }}" + + - name: replace hostname + lineinfile: + path: /etc/hosts + regexp: '^127.0.1.1' + line: "127.0.1.1 {{ inventory_hostname }}.{{ dns_domain }} {{ inventory_hostname }}" + + - name: System details + debug: + msg: "{{ ansible_distribution }}" + + - name: System details + debug: + msg: "{{ ansible_distribution_major_version }}" + +# - import_tasks: ipchange.yml + + - name: Copy /etc/apt/sources.list file with owner and permissions + ansible.builtin.copy: + src: etc/apt/sources.list + dest: /etc/apt/sources.list + owner: root + group: root + mode: '0644' + when: (ansible_distribution == "Debian") and (ansible_distribution_major_version == "12") + + - name: Run the equivalent of "apt-get update" as a separate step + ansible.builtin.apt: + update_cache: yes + + - name: disable ipv6 + ansible.builtin.template: + src: ../templates/etc/sysctl.d/90-noipv6.conf.j2 + dest: /etc/sysctl.d/90-noipv6.conf + owner: root + group: root + mode: '0644' + + + - name: install var packages + apt: + name: "{{ item }}" + state: present + loop: + - vim + - mc + - htop + - iotop + - net-tools + - moreutils + - tcpdump + - nmap + - nmon + - ethtool + + - name: Ansible delete file glob + find: + paths: /var/crash + patterns: "*" + register: files_to_delete + + - name: Ansible remove file glob + file: + path: "{{ item.path }}" + state: absent + with_items: "{{ files_to_delete.files }}" + + - name: Copy .bashrc file with owner and permissions + ansible.builtin.copy: + src: root/.bashrc + dest: /root/.bashrc + owner: root + group: root + mode: '0644' + follow: yes + + - name: Copy sysctl tweak file + ansible.builtin.copy: + src: etc/sysctl.d/999-tweaks.conf + dest: /etc/sysctl.d/999-tweaks.conf + owner: root + group: root + mode: '0644' + follow: yes + + - name: Reload sysctl parameters + ansible.builtin.command: sysctl --system + + + + - import_tasks: ntp2.yml + - import_tasks: rsyslog.yml + - import_tasks: snmpd.yml + - import_tasks: addtoobservium.yml + - import_tasks: services.yml + - import_tasks: vlans.yml + + - name: Revert 'ansible' sudo to require password + ansible.builtin.copy: + dest: /etc/sudoers.d/ansible + content: "ansible ALL=(ALL) ALL\n" + owner: root + group: root + mode: '0440' + + - name: Set plaintext password for ansible user + ansible.builtin.user: + name: ansible + password: "{{ 'tOwnz8qhfn4CaLLSJ6XW' | password_hash('sha512') }}" + update_password: always diff --git a/serv-01-baselinux/tasks/ntp2.yml b/serv-01-baselinux/tasks/ntp2.yml new file mode 100644 index 0000000..33224c2 --- /dev/null +++ b/serv-01-baselinux/tasks/ntp2.yml @@ -0,0 +1,27 @@ +--- +- name: Set timezone to Africa/Johannesburg + community.general.timezone: + name: Africa/Johannesburg + +- name: Use fallback NTP servers + ansible.builtin.lineinfile: + path: /etc/systemd/timesyncd.conf + regexp: '^#?FallbackNTP=' + line: FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org + owner: root + group: root + mode: '0644' + +- name: Insert NTP line before FallbackNTP in timesyncd.conf + ansible.builtin.lineinfile: + path: /etc/systemd/timesyncd.conf + line: "NTP=time.ikeja.co.za" + insertbefore: '^FallbackNTP' + state: present + + +- name: Restart and enable systemd-timesyncd + ansible.builtin.service: + name: systemd-timesyncd + state: restarted + enabled: true diff --git a/serv-01-baselinux/tasks/rsyslog.yml b/serv-01-baselinux/tasks/rsyslog.yml new file mode 100644 index 0000000..61cb755 --- /dev/null +++ b/serv-01-baselinux/tasks/rsyslog.yml @@ -0,0 +1,25 @@ +--- +- name: ensure package rsyslog is at the latest + apt: + name: + - rsyslog + state: latest + + +- name: Template a file to /etc/rsyslog.d/rsyslog.remote.conf + ansible.builtin.template: + src: ../templates/etc/rsyslog.d/rsyslog.remote.conf.j2 + dest: /etc/rsyslog.d/remote.conf + owner: root + group: root + mode: '0644' + + +- name: make sure ntpd is enabled/running + ansible.builtin.systemd: + name: rsyslog + state: restarted + enabled: yes + + + diff --git a/serv-01-baselinux/tasks/services.yml b/serv-01-baselinux/tasks/services.yml new file mode 100644 index 0000000..00d7961 --- /dev/null +++ b/serv-01-baselinux/tasks/services.yml @@ -0,0 +1,35 @@ +--- +- name: Disable unnecessary services for headless datacenter VMs + vars: + unwanted_services: + - apport.service + - cloud-config.service + - cloud-final.service + - cloud-init-local.service + - cloud-init.service + - console-setup.service + - fwupd.service + - gpu-manager.service + - ModemManager.service + - multipathd.service + - packagekit.service + - polkit.service + - pollinate.service + - snapd.apparmor.service + - snapd.autoimport.service + - snapd.core-fixup.service + - snapd.recovery-chooser-trigger.service + - snapd.seeded.service + - snapd.service + - snapd.system-shutdown.service + - thermald.service + - udisks2.service + - unattended-upgrades.service + - vgauth.service + + ansible.builtin.systemd: + name: "{{ item }}" + enabled: false + masked: true + loop: "{{ unwanted_services }}" + tags: disable_services diff --git a/serv-01-baselinux/tasks/snmpd.yml b/serv-01-baselinux/tasks/snmpd.yml new file mode 100644 index 0000000..498aa40 --- /dev/null +++ b/serv-01-baselinux/tasks/snmpd.yml @@ -0,0 +1,25 @@ +--- +- name: ensure package snmpd is at the latest + apt: + name: + - snmpd + state: latest + + +- name: Template a file to /etc/snmp/snmpd.conf + ansible.builtin.template: + src: ../templates/etc/snmp/snmpd.conf.j2 + dest: /etc/snmp/snmpd.conf + owner: root + group: root + mode: '0644' + + +- name: make sure snmpd is enabled/running + ansible.builtin.systemd: + name: snmpd + state: restarted + enabled: yes + + + diff --git a/serv-01-baselinux/tasks/sshkey.yml b/serv-01-baselinux/tasks/sshkey.yml new file mode 100644 index 0000000..2ffcc77 --- /dev/null +++ b/serv-01-baselinux/tasks/sshkey.yml @@ -0,0 +1,10 @@ +--- +- name: Set authorized key taken from file + ansible.posix.authorized_key: + user: ansible + state: present + key: "{{ lookup('file', '/home/ansible/.ssh/mikrotik_key2.pub') }}" + + + + diff --git a/serv-01-baselinux/tasks/vlans.yml b/serv-01-baselinux/tasks/vlans.yml new file mode 100644 index 0000000..561ca0a --- /dev/null +++ b/serv-01-baselinux/tasks/vlans.yml @@ -0,0 +1,18 @@ +--- +- name: Install vlan + apt: + name: + - vlan + state: latest + +- name: modprobe 8021q + command: modprobe 8021q + become: yes + +- name: adding 8021q to /etc/modules + lineinfile: + path: /etc/modules + line: 8021q + state: present + create: true + become: yes diff --git a/serv-01-baselinux/templates/etc/ntp.conf.j2 b/serv-01-baselinux/templates/etc/ntp.conf.j2 new file mode 100644 index 0000000..b519866 --- /dev/null +++ b/serv-01-baselinux/templates/etc/ntp.conf.j2 @@ -0,0 +1,11 @@ +driftfile /var/lib/ntp/ntp.drift +statistics loopstats peerstats clockstats +filegen loopstats file loopstats type day enable +filegen peerstats file peerstats type day enable +filegen clockstats file clockstats type day enable +server {{ ntpserver }} iburst +restrict -4 default kod notrap nomodify nopeer noquery limited +restrict -6 default kod notrap nomodify nopeer noquery limited +restrict 127.0.0.1 +restrict ::1 +restrict source notrap nomodify noquery diff --git a/serv-01-baselinux/templates/etc/rsyslog.d/rsyslog.remote.conf.j2 b/serv-01-baselinux/templates/etc/rsyslog.d/rsyslog.remote.conf.j2 new file mode 100644 index 0000000..6f08bb5 --- /dev/null +++ b/serv-01-baselinux/templates/etc/rsyslog.d/rsyslog.remote.conf.j2 @@ -0,0 +1,2 @@ +*.* @{{rsyslogserver}}:514 + diff --git a/serv-01-baselinux/templates/etc/snmp/snmpd.conf.j2 b/serv-01-baselinux/templates/etc/snmp/snmpd.conf.j2 new file mode 100644 index 0000000..f7d3331 --- /dev/null +++ b/serv-01-baselinux/templates/etc/snmp/snmpd.conf.j2 @@ -0,0 +1,19 @@ +com2sec readonly default community_string + + group MyROGroup v1 readonly + group MyROGroup v2c readonly + group MyROGroup usm readonly + view all included .1 80 + access MyROGroup "" any noauth exact all none none + syslocation homesite, Vilnius, LT + syscontact Contact Person + + # This line allows Observium to detect the host OS if the distro script is installed + extend .1.3.6.1.4.1.2021.7890.1 distro /usr/bin/distro + + # This line allows Observium to collect an accurate uptime + extend uptime /bin/cat /proc/uptime + + # This line enables Observium's ifAlias description injection + pass_persist .1.3.6.1.2.1.31.1.1.1.18 /usr/bin/ifAlias_persist + diff --git a/serv-01-baselinux/templates/etc/sysctl.d/90-noipv6.conf.j2 b/serv-01-baselinux/templates/etc/sysctl.d/90-noipv6.conf.j2 new file mode 100644 index 0000000..8c41d94 --- /dev/null +++ b/serv-01-baselinux/templates/etc/sysctl.d/90-noipv6.conf.j2 @@ -0,0 +1,3 @@ +net.ipv6.conf.all.disable_ipv6 = 1 +net.ipv6.conf.default.disable_ipv6 = 1 +net.ipv6.conf.lo.disable_ipv6 = 1 diff --git a/serv-01-baselinux/tests/inventory b/serv-01-baselinux/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/serv-01-baselinux/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/serv-01-baselinux/vars/main.yml b/serv-01-baselinux/vars/main.yml new file mode 100644 index 0000000..516e08b --- /dev/null +++ b/serv-01-baselinux/vars/main.yml @@ -0,0 +1,4 @@ +--- +# vars file for baselinux +ntpserver: time.ikeja.co.za +rsyslogserver: 102.38.125.161 \ No newline at end of file diff --git a/serv-02-dockerbookworm.yml b/serv-02-dockerbookworm.yml new file mode 100644 index 0000000..39419d6 --- /dev/null +++ b/serv-02-dockerbookworm.yml @@ -0,0 +1,6 @@ +--- + - hosts: all + become: true + + roles: + - serv-02-dockerbookworm diff --git a/serv-02-dockerbookworm/.travis.yml b/serv-02-dockerbookworm/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/serv-02-dockerbookworm/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/serv-02-dockerbookworm/README.md b/serv-02-dockerbookworm/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/serv-02-dockerbookworm/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/serv-02-dockerbookworm/defaults/main.yml b/serv-02-dockerbookworm/defaults/main.yml new file mode 100644 index 0000000..1ac3ed5 --- /dev/null +++ b/serv-02-dockerbookworm/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for 07docker \ No newline at end of file diff --git a/serv-02-dockerbookworm/handlers/main.yml b/serv-02-dockerbookworm/handlers/main.yml new file mode 100644 index 0000000..7c02494 --- /dev/null +++ b/serv-02-dockerbookworm/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for 07docker \ No newline at end of file diff --git a/serv-02-dockerbookworm/meta/main.yml b/serv-02-dockerbookworm/meta/main.yml new file mode 100644 index 0000000..227ad9c --- /dev/null +++ b/serv-02-dockerbookworm/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.9 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. + \ No newline at end of file diff --git a/serv-02-dockerbookworm/tasks/main.yml b/serv-02-dockerbookworm/tasks/main.yml new file mode 100644 index 0000000..e204f28 --- /dev/null +++ b/serv-02-dockerbookworm/tasks/main.yml @@ -0,0 +1,101 @@ +--- + - name: Install aptitude using apt + apt: name=aptitude state=latest update_cache=yes force_apt_get=yes + + - name: Install required system packages + apt: name={{ item }} state=latest update_cache=yes + loop: [ 'apt-transport-https', 'ca-certificates', 'curl', 'software-properties-common', 'python3-pip', 'virtualenv', 'python3-setuptools', 'python3-pkg-resources'] + + - name: creating alias + shell: echo alias pip=pip3 >> ~/.bashrc + + - name: Add Docker GPG apt Key + apt_key: + url: https://download.docker.com/linux/debian/gpg + state: present + + - name: Add Docker Repository + apt_repository: + repo: deb [arch=amd64] https://download.docker.com/linux/debian bookworm stable + state: present + + - name: Update apt and install docker-ce + apt: + name: "{{item}}" + state: present + update_cache: yes + with_items: + - docker-ce + - docker-ce-cli + - containerd.io + + - name: Create docker group + group: + name: "docker" + state: present + + + - name: Add docker user with specific attributes + user: + name: docker + system: yes + createhome: yes + home: /home/docker + shell: /usr/sbin/nologin + + - name: Adding user docker to docker group + user: + name: docker + groups: "docker" + append: "yes" + + - name: Adding user ansible to docker group + user: + name: ansible + groups: "docker" + append: "yes" + + - name: Get Python 3.X version + ansible.builtin.command: python3 --version + register: pyver + changed_when: false + failed_when: pyver.rc != 0 + + - name: Remove Python 3.X EXTERNALLY-MANAGED file + ansible.builtin.file: + state: absent + path: "/usr/lib/python{{ pyver.stdout.split()[1] | regex_search('([0-9]+\\.[0-9]+)') }}/EXTERNALLY-MANAGED" + when: pyver.stdout | regex_search('3\.[0-9]+') + + - name: Install and upgrade pip + pip: + name: pip + extra_args: --upgrade + executable: pip3 + + - name: Install setuptools Module for Python + pip: + name: setuptools + + - name: Install Docker Module for Python + pip: + name: docker + + - name: Install requests for Python + pip: + name: requests + version: 2.32.3 + - name: Create /opt/containers directory + file: + path: /opt/containers + state: directory + owner: docker + group: docker + mode: '0750' + + + +# - name: Install Docker compose for Python +# pip: +# name: docker-compose + diff --git a/serv-02-dockerbookworm/tests/inventory b/serv-02-dockerbookworm/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/serv-02-dockerbookworm/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/serv-02-dockerbookworm/tests/test.yml b/serv-02-dockerbookworm/tests/test.yml new file mode 100644 index 0000000..14b6b39 --- /dev/null +++ b/serv-02-dockerbookworm/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - 07docker \ No newline at end of file diff --git a/serv-02-dockerbookworm/vars/main.yml b/serv-02-dockerbookworm/vars/main.yml new file mode 100644 index 0000000..df8d135 --- /dev/null +++ b/serv-02-dockerbookworm/vars/main.yml @@ -0,0 +1,6 @@ +--- +# vars file for 07docker + create_containers: 4 + default_container_name: docker + default_container_image: ubuntu + default_container_command: sleep 1d diff --git a/serv-02-dockerbullseye.yml b/serv-02-dockerbullseye.yml new file mode 100644 index 0000000..09b99f0 --- /dev/null +++ b/serv-02-dockerbullseye.yml @@ -0,0 +1,6 @@ +--- + - hosts: all + become: true + + roles: + - serv-02-dockerbullseye diff --git a/serv-02-dockerbullseye/.travis.yml b/serv-02-dockerbullseye/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/serv-02-dockerbullseye/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/serv-02-dockerbullseye/README.md b/serv-02-dockerbullseye/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/serv-02-dockerbullseye/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/serv-02-dockerbullseye/defaults/main.yml b/serv-02-dockerbullseye/defaults/main.yml new file mode 100644 index 0000000..1ac3ed5 --- /dev/null +++ b/serv-02-dockerbullseye/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for 07docker \ No newline at end of file diff --git a/serv-02-dockerbullseye/handlers/main.yml b/serv-02-dockerbullseye/handlers/main.yml new file mode 100644 index 0000000..7c02494 --- /dev/null +++ b/serv-02-dockerbullseye/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for 07docker \ No newline at end of file diff --git a/serv-02-dockerbullseye/meta/main.yml b/serv-02-dockerbullseye/meta/main.yml new file mode 100644 index 0000000..227ad9c --- /dev/null +++ b/serv-02-dockerbullseye/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.9 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. + \ No newline at end of file diff --git a/serv-02-dockerbullseye/tasks/main.yml b/serv-02-dockerbullseye/tasks/main.yml new file mode 100644 index 0000000..1b3b48f --- /dev/null +++ b/serv-02-dockerbullseye/tasks/main.yml @@ -0,0 +1,61 @@ +--- + - name: Install aptitude using apt + apt: name=aptitude state=latest update_cache=yes force_apt_get=yes + + - name: Install required system packages + apt: name={{ item }} state=latest update_cache=yes + loop: [ 'apt-transport-https', 'ca-certificates', 'curl', 'software-properties-common', 'python3-pip', 'virtualenv', 'python3-setuptools', 'python-pkg-resources'] + + + - name: creating alias + shell: echo alias pip=pip3 >> ~/.bashrc + + - name: Add Docker GPG apt Key + apt_key: + url: https://download.docker.com/linux/debian/gpg + state: present + + - name: Add Docker Repository + apt_repository: + repo: deb [arch=amd64] https://download.docker.com/linux/debian bullseye stable + state: present + + - name: Update apt and install docker-ce + apt: + name: "{{item}}" + state: present + update_cache: yes + with_items: + - docker-ce + - docker-ce-cli + - containerd.io + + - name: Create docker group + group: + name: "docker" + state: present + + - name: Adding user pavel to docker group + user: + name: pavel + groups: "docker" + append: "yes" + + - name: Install and upgrade pip + pip: + name: pip + extra_args: --upgrade + executable: pip3 + + - name: Install setuptools Module for Python + pip3: + name: setuptools + + - name: Install Docker Module for Python + pip3: + name: docker + + - name: Install Docker compose for Python + pip3: + name: docker-compose + diff --git a/serv-02-dockerbullseye/tests/inventory b/serv-02-dockerbullseye/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/serv-02-dockerbullseye/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/serv-02-dockerbullseye/tests/test.yml b/serv-02-dockerbullseye/tests/test.yml new file mode 100644 index 0000000..14b6b39 --- /dev/null +++ b/serv-02-dockerbullseye/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - 07docker \ No newline at end of file diff --git a/serv-02-dockerbullseye/vars/main.yml b/serv-02-dockerbullseye/vars/main.yml new file mode 100644 index 0000000..df8d135 --- /dev/null +++ b/serv-02-dockerbullseye/vars/main.yml @@ -0,0 +1,6 @@ +--- +# vars file for 07docker + create_containers: 4 + default_container_name: docker + default_container_image: ubuntu + default_container_command: sleep 1d diff --git a/serv-04-adduser.yml b/serv-04-adduser.yml new file mode 100644 index 0000000..ed14720 --- /dev/null +++ b/serv-04-adduser.yml @@ -0,0 +1,13 @@ +--- + + - hosts: all + become: true + + vars_prompt: + - name: "userpass" + prompt: "Enter password for the new user (ignore if not adding a user)" + private: yes + + + roles: + - serv-04-adduser diff --git a/serv-04-adduser/README b/serv-04-adduser/README new file mode 100644 index 0000000..ce74201 --- /dev/null +++ b/serv-04-adduser/README @@ -0,0 +1,6 @@ +1. WE DO NOT create users w/o their SSH key +2. This is to create user: +~/ansible-venv/bin/ansible-playbook -i hosts serv-04-adduser.yml -eusername=pavel -euserkey=pavel.pub -euseraction=add --limit=sterver01 -K +3. This is to remove user +~/ansible-venv/bin/ansible-playbook -i hosts serv-04-adduser.yml -eusername=pavel -euseraction=remove --limit=sterver01 -K + diff --git a/serv-04-adduser/README.md b/serv-04-adduser/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/serv-04-adduser/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/serv-04-adduser/defaults/main.yml b/serv-04-adduser/defaults/main.yml new file mode 100644 index 0000000..ef5b190 --- /dev/null +++ b/serv-04-adduser/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for serv-04-adduser diff --git a/serv-04-adduser/files/sshkeys/adminas.pub b/serv-04-adduser/files/sshkeys/adminas.pub new file mode 100644 index 0000000..01723ec --- /dev/null +++ b/serv-04-adduser/files/sshkeys/adminas.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCF3hyP//3VBrF+tr/uF3pTzIvUd8YkPkdnBk9+0kmbKqeYgApMUCqaOezrQHIczBSgrLk8ygY5mjD7Sxs9JpMuxqtnWLK5rZukd5+m4lVe0HmmtaLZLrEYhO9w0WKVl660m3tCuma8pVTLD/WQiiqUQ6HhccWs8L3IhG7tujbMhdc3PYmXPGUGvVny5DFLW7N99nYYO4K43YXHp+u6ofPuxuqjZkpYaDilIKXsXUdq8HOSNz1qVWnYZCfOYqmc2l5AKhACqAbvMexnGMVek1cXw4uA+IHu/fVnjmPTUJrPQf0n29LMMygoZg74Dqnnd8jhdk24vavwF4lumszJ9kGayWEKk0Jf3q5ceet8Q6QgYKU8nXuiGWtDg/WtU2PMJT5Cd4BXbfaKdH1ZKelZbKw6p4Il+XB5pHHwQ8LDbHIAQCbj3514VpvibkhEERYym6nr1Jr9lLMieqOupGPDCIHOW1XwkXNDvxuB4ZOJ5wNrBUka1jexEGHtwbIisvehYTnrnRS5Nkv2gHcDleN0zAyd09w752y1kk7V5M4NLh4PTORO/yKmE+ZdeEiyIu1pirjSab4HbvhF3gnSXqWzq4pTG3JofPgFfMveKyUEwtnTiSPtEpjz6q6Haxg3Lgt2ciO1cX58M5EkAUxU2+qqBvDk/1TsvwZDo65gDRJxISuHCw== ansible@labjump diff --git a/serv-04-adduser/files/sshkeys/cnms.pub b/serv-04-adduser/files/sshkeys/cnms.pub new file mode 100644 index 0000000..45b7ba0 --- /dev/null +++ b/serv-04-adduser/files/sshkeys/cnms.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC+5WJErVzuukfXzOL/KCi27oQ+RL2wLCZEi+i3OLSou cnms@8devices.com diff --git a/serv-04-adduser/files/sshkeys/marc.pub b/serv-04-adduser/files/sshkeys/marc.pub new file mode 100644 index 0000000..a73ad98 --- /dev/null +++ b/serv-04-adduser/files/sshkeys/marc.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINRnOcWyYgWQZcZBPvVNzkcfsta+k5kSLRebVL/F86+k marc@ikeja.co.za diff --git a/serv-04-adduser/files/sshkeys/mikrotik_key2.pub b/serv-04-adduser/files/sshkeys/mikrotik_key2.pub new file mode 100644 index 0000000..f2c24ca --- /dev/null +++ b/serv-04-adduser/files/sshkeys/mikrotik_key2.pub @@ -0,0 +1,2 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7ut7tytWiBJp8pzYxuDmfiz6pnm+UuYG9xYUFjqAcbYdCvRJHRDwZjj+CIKgjGmh4Lu6OouNgXxWsj/3vtJJvR97hdropEbg9eYyu3YKIn7VJGK/c1Kasoqy0mhRjhoVdQVlE4KEL3h6dXN+dmDD9fvPIARguuJwlayktl1OcfLE0BGMHBwLg9wDzTt2ngWXWdGo+LsH683zKI0m7/N92W+Ryx7d58KC4F9ce4p8mYDtiwhig0fNXenLLVkG033WqfsfpZQVe+hW8C5yketWRZlXCT9KFs0x3Q9J7+itvzRqlDvZy/UNtSj5BAKDIeM9cW/JSRJ3CQD55SjqERd4Z admin + diff --git a/serv-04-adduser/files/sshkeys/mindaugas.pub b/serv-04-adduser/files/sshkeys/mindaugas.pub new file mode 100644 index 0000000..9c20ad5 --- /dev/null +++ b/serv-04-adduser/files/sshkeys/mindaugas.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAuOyqS81+IuvvkCn/yfFr6NXxrBxHxkeQ7S3x6SRh81 mindaugas@8devices.com diff --git a/serv-04-adduser/files/sshkeys/pavel.pub b/serv-04-adduser/files/sshkeys/pavel.pub new file mode 100644 index 0000000..26a56e3 --- /dev/null +++ b/serv-04-adduser/files/sshkeys/pavel.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOyPSe6XOJxzdsr77HU6nZgyGOdI3w16kaxs1Ozq6beY pavel diff --git a/serv-04-adduser/handlers/main.yml b/serv-04-adduser/handlers/main.yml new file mode 100644 index 0000000..f0534fb --- /dev/null +++ b/serv-04-adduser/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for serv-04-adduser diff --git a/serv-04-adduser/meta/main.yml b/serv-04-adduser/meta/main.yml new file mode 100644 index 0000000..36b9858 --- /dev/null +++ b/serv-04-adduser/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/serv-04-adduser/tasks/main.yml b/serv-04-adduser/tasks/main.yml new file mode 100644 index 0000000..617d81d --- /dev/null +++ b/serv-04-adduser/tasks/main.yml @@ -0,0 +1,90 @@ +--- +- name: Ensure user exists + ansible.builtin.user: + name: "{{ username }}" + password: "{{ userpass | password_hash('sha512') }}" + shell: /bin/bash + state: present + create_home: yes + when: useraction == "add" + +- name: Create .ssh directory + ansible.builtin.file: + path: "/home/{{ username }}/.ssh" + state: directory + owner: "{{ username }}" + group: "{{ username }}" + mode: '0700' + when: useraction == "add" + +- name: Upload authorized SSH key + ansible.builtin.copy: + src: "files/sshkeys/{{ userkey }}" + dest: "/home/{{ username }}/.ssh/authorized_keys" + owner: "{{ username }}" + group: "{{ username }}" + mode: '0600' + when: useraction == "add" + +# REMOVE USER +#- name: Remove user and home directory +# ansible.builtin.user: +# name: "{{ username }}" +# state: absent +# remove: yes +# when: useraction == "remove" + +- name: Allow {{ username }} to switch to 'docker' user without password + ansible.builtin.copy: + dest: "/etc/sudoers.d/{{ username }}-su-docker" + content: "{{ username }} ALL=(ALL) NOPASSWD: /bin/su - docker" + owner: root + group: root + mode: '0440' + when: useraction == "add" + +- name: Find processes owned by the user (initial) + ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true" + register: user_process_list + changed_when: false + when: useraction == "remove" + +- name: Display processes owned by user before killing + ansible.builtin.debug: + msg: "{{ item }}" + loop: "{{ user_process_list.stdout_lines }}" + when: useraction == "remove" + + +- name: Extract PIDs of user processes + ansible.builtin.shell: "pgrep -u {{ username }} || true" + register: user_pids + changed_when: false + when: useraction == "remove" + +- name: Kill user processes (if any) + ansible.builtin.shell: "kill -9 {{ user_pids.stdout_lines | join(' ') }}" + when: + - useraction == "remove" + - user_pids.stdout != "" + +- name: Remove user and home directory + ansible.builtin.user: + name: "{{ username }}" + state: absent + remove: yes + when: useraction == "remove" + +- name: List remaining processes for the user (after kill) + ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true" + register: remaining_procs + changed_when: false + when: useraction == "remove" + +- name: Display remaining processes (manual check) + ansible.builtin.debug: + msg: | + Remaining processes for '{{ username }}' after kill: + {{ remaining_procs.stdout | default('None') }} + when: useraction == "remove" + diff --git a/serv-04-adduser/tests/inventory b/serv-04-adduser/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/serv-04-adduser/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/serv-04-adduser/tests/test.yml b/serv-04-adduser/tests/test.yml new file mode 100644 index 0000000..ab2526f --- /dev/null +++ b/serv-04-adduser/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - serv-04-adduser diff --git a/serv-04-adduser/vars/main.yml b/serv-04-adduser/vars/main.yml new file mode 100644 index 0000000..b998f17 --- /dev/null +++ b/serv-04-adduser/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for serv-04-adduser diff --git a/serv-05-dockerubuntu24.yml b/serv-05-dockerubuntu24.yml new file mode 100644 index 0000000..2aa05bb --- /dev/null +++ b/serv-05-dockerubuntu24.yml @@ -0,0 +1,16 @@ +--- +# - name: Pre-IP override setup +# hosts: all +# gather_facts: false +# tasks: +# - name: Capture static IP and override ansible_host with ansible_oldip +# set_fact: +# ansible_newip: "{{ hostvars[inventory_hostname]['ansible_host'] }}" +# ansible_host: "{{ ansible_oldip }}" +# when: ansible_oldip is defined + + - hosts: all + become: true + + roles: + - serv-05-dockerubuntu24 diff --git a/serv-05-dockerubuntu24/.travis.yml b/serv-05-dockerubuntu24/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/serv-05-dockerubuntu24/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/serv-05-dockerubuntu24/README.md b/serv-05-dockerubuntu24/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/serv-05-dockerubuntu24/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/serv-05-dockerubuntu24/defaults/main.yml b/serv-05-dockerubuntu24/defaults/main.yml new file mode 100644 index 0000000..1ac3ed5 --- /dev/null +++ b/serv-05-dockerubuntu24/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for 07docker \ No newline at end of file diff --git a/serv-05-dockerubuntu24/handlers/main.yml b/serv-05-dockerubuntu24/handlers/main.yml new file mode 100644 index 0000000..7c02494 --- /dev/null +++ b/serv-05-dockerubuntu24/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for 07docker \ No newline at end of file diff --git a/serv-05-dockerubuntu24/meta/main.yml b/serv-05-dockerubuntu24/meta/main.yml new file mode 100644 index 0000000..227ad9c --- /dev/null +++ b/serv-05-dockerubuntu24/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.9 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. + \ No newline at end of file diff --git a/serv-05-dockerubuntu24/tasks/main.yml b/serv-05-dockerubuntu24/tasks/main.yml new file mode 100644 index 0000000..39faa46 --- /dev/null +++ b/serv-05-dockerubuntu24/tasks/main.yml @@ -0,0 +1,112 @@ +--- + - name: Allow user ansible to switch to 'docker' user without password + ansible.builtin.copy: + dest: "/etc/sudoers.d/ansible-su-docker" + content: "ansible ALL=(ALL) NOPASSWD: /bin/su - docker" + owner: root + group: root + mode: '0440' + + - name: Install required system packages + apt: name={{ item }} state=latest update_cache=yes + loop: [ 'apt-transport-https', 'ca-certificates', 'curl', 'software-properties-common', 'python3-pip', 'virtualenv', 'python3-setuptools', 'python3-pkg-resources'] + + - name: Add Docker GPG apt Key + apt_key: + url: https://download.docker.com/linux/ubuntu/gpg + state: present + + - name: Add Docker Repository + apt_repository: + repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu noble stable + state: present + + - name: Update apt and install docker-ce + apt: + name: "{{item}}" + state: present + update_cache: yes + with_items: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-buildx-plugin + - docker-compose-plugin + + - name: Create docker group + group: + name: "docker" + state: present + + - name: Add docker user with specific attributes + user: + name: docker + system: yes + createhome: yes + home: /home/docker + shell: /usr/sbin/nologin + + - name: Adding user docker to docker group + user: + name: docker + groups: "docker" + append: "yes" + + - name: Adding user ansible to docker group + user: + name: ansible + groups: "docker" + append: "yes" + + - name: Get Python 3.X version + ansible.builtin.command: python3 --version + register: pyver + changed_when: false + failed_when: pyver.rc != 0 + + - name: Remove Python 3.X EXTERNALLY-MANAGED file + ansible.builtin.file: + state: absent + path: "/usr/lib/python{{ pyver.stdout.split()[1] | regex_search('([0-9]+\\.[0-9]+)') }}/EXTERNALLY-MANAGED" + when: pyver.stdout | regex_search('3\.[0-9]+') + +### Keeping it for future ansible control of docker. now it's not needed. +# - name: Install and upgrade pip +# pip: +# name: pip +# extra_args: --upgrade +# executable: pip3 + +# - name: Install setuptools Module for Python +# pip: +# name: setuptools + +# - name: Install Docker Module for Python +# pip: +# name: docker + +# - name: Install requests for Python +# pip: +# name: requests +# version: latest + + - name: Ensure Docker is started and enabled + ansible.builtin.service: + name: docker + state: started + enabled: true + + - name: Create /opt/containers directory + file: + path: /opt/containers + state: directory + owner: docker + group: docker + mode: '0770' + + + +# - name: Install Docker compose for Python +# pip: +# name: docker-compose + diff --git a/serv-05-dockerubuntu24/tests/inventory b/serv-05-dockerubuntu24/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/serv-05-dockerubuntu24/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/serv-05-dockerubuntu24/tests/test.yml b/serv-05-dockerubuntu24/tests/test.yml new file mode 100644 index 0000000..14b6b39 --- /dev/null +++ b/serv-05-dockerubuntu24/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - 07docker \ No newline at end of file diff --git a/serv-05-dockerubuntu24/vars/main.yml b/serv-05-dockerubuntu24/vars/main.yml new file mode 100644 index 0000000..df8d135 --- /dev/null +++ b/serv-05-dockerubuntu24/vars/main.yml @@ -0,0 +1,6 @@ +--- +# vars file for 07docker + create_containers: 4 + default_container_name: docker + default_container_image: ubuntu + default_container_command: sleep 1d