first commit

serv-01-baselinux/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

serv-01-baselinux/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

serv-01-baselinux/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+observium_server: observium  # your Observium host group
+observium_container: observium  # the Docker container name

serv-01-baselinux/files/etc/apt/sources.list

@@ -0,0 +1,10 @@
+deb http://deb.debian.org/debian bookworm main non-free contrib
+deb-src http://deb.debian.org/debian bookworm main non-free contrib
+
+deb http://security.debian.org/debian-security bookworm-security main contrib non-free
+deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free
+
+# bookworm-updates, to get updates before a point release is made;
+# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html # _updates_and_backports
+deb http://deb.debian.org/debian bookworm-updates main contrib non-free
+deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free

serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf

@@ -0,0 +1,90 @@
+
+# ===== Memory Management =====
+
+# Reduce swappiness to avoid swapping until really necessary
+vm.swappiness = 10
+
+# Increase max read/write I/O requests (helps with I/O-heavy VMs)
+vm.max_map_count = 262144
+
+# Don't overcommit memory aggressively
+vm.overcommit_memory = 1
+vm.overcommit_ratio = 80
+
+# Enable process memory reclaiming
+vm.dirty_ratio = 15
+vm.dirty_background_ratio = 5
+
+# ===== File System & Descriptors =====
+
+# Allow more open file handles (important for services handling many files/connections)
+fs.file-max = 2097152
+
+# ===== Networking: Buffers =====
+
+# Increase network buffer space (for high-throughput applications)
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+net.core.rmem_default = 262144
+net.core.wmem_default = 262144
+
+# Increase backlog queues
+net.core.netdev_max_backlog = 5000
+net.core.somaxconn = 1024
+
+# ===== Networking: TCP Tweaks =====
+
+# Enable TCP SYN cookies to prevent SYN flood DoS attacks
+net.ipv4.tcp_syncookies = 1
+
+# Reduce FIN timeout to clean up closed connections faster
+net.ipv4.tcp_fin_timeout = 15
+
+# Enable TCP keepalive probes more aggressively
+net.ipv4.tcp_keepalive_time = 300
+net.ipv4.tcp_keepalive_intvl = 60
+net.ipv4.tcp_keepalive_probes = 5
+
+# Reduce time-wait connections held
+net.ipv4.tcp_max_tw_buckets = 2000000
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_tw_recycle = 0
+
+# Increase TCP buffer limits
+net.ipv4.tcp_rmem = 4096 87380 16777216
+net.ipv4.tcp_wmem = 4096 65536 16777216
+
+# ===== Networking: Connection Tracking =====
+
+# (if conntrack is involved, increase bucket sizes – useful for iptables/nftables with many connections)
+net.netfilter.nf_conntrack_max = 262144
+
+# ===== Security & Routing =====
+
+# Disable IP source routing
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+
+# Disable ICMP redirects (security & performance)
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+
+# Do not send ICMP redirects (we are not a router)
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
+# Enable Reverse Path Filterin
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+
+# ===== Performance =====
+
+# Avoid using swap too eagerly under memory pressure
+vm.min_free_kbytes = 65536
+
+# ===== IPv6 Tuning (disable if unused) =====
+
+# Uncomment if IPv6 is not used
+# net.ipv6.conf.all.disable_ipv6 = 1
+# net.ipv6.conf.default.disable_ipv6 = 1
+

serv-01-baselinux/files/root/.bashrc

@@ -0,0 +1,86 @@
+##
+## Slightly nicer .bashrc
+## Makes pretty colors and stuff
+##
+
+## Set $PATH, which tells the computer where to search for commands
+export PATH="$PATH:/usr/sbin:/sbin:/bin:/usr/bin:/etc:/usr/ucb:/usr/local/bin:/usr/local/local_dfs/bin:/usr/bin/X11:/usr/local/sas"
+
+## Where to search for manual pages
+export MANPATH="/usr/share/man:/usr/local/man:/usr/local/local_dfs/man"
+
+## Which pager to use.
+export PAGER=less
+
+## Choose your weapon
+EDITOR=/usr/bin/vim
+#EDITOR=/usr/bin/emacs
+#EDITOR=/usr/bin/nano
+export EDITOR
+
+## The maximum number of lines in your history file
+export HISTFILESIZE=50
+
+## UVM!
+export ORGANIZATION="University of Vermont"
+
+## Enables displaying colors in the terminal
+export TERM=xterm-color
+
+# Uncomment the following lines if you are an ARC/INFO user
+#alias arc=/usr/local/bin/arc
+#alias arcdoc=/usr/local/bin/arcdoc
+#alias info=/usr/local/bin/arcinfo
+
+## Disable automatic mail checking
+unset MAILCHECK 
+
+## If this is an interactive console, disable messaging
+#tty -s && mesg n
+
+## Aliases from 'ol EMBA tcsh
+#alias bye=logout
+#alias h=history
+#alias jobs='jobs -l'
+#alias lf='ls -algF'
+#alias log=logout
+#alias cls=clear
+#alias edit=$EDITOR
+#alias restore=/usr/local/local_dfs/bin/restore
+
+## Automatically correct mistyped 'cd' directories
+#shopt -s cdspell
+
+## Append to history file; do not overwrite
+shopt -s histappend
+
+## Prevent accidental overwrites when using IO redirection
+set -o noclobber
+
+## Set the prompt to display the current git branch
+## and use pretty colors
+export PS1='$(git branch &>/dev/null; if [ $? -eq 0 ]; then \
+echo "\[\e[1m\]\u@\h\[\e[0m\]: \w [\[\e[34m\]$(git branch | grep ^* | sed s/\*\ //)\[\e[0m\]\
+$(echo `git status` | grep "nothing to commit" > /dev/null 2>&1; if [ "$?" -ne "0" ]; then \
+echo "\[\e[1;31m\]*\[\e[0m\]"; fi)] \$ "; else \
+echo "\[\e[1m\]\u@\h\[\e[0m\]: \w \$ "; fi )'
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+# Note: PS1 and umask are already set in /etc/profile. You should not
+# need this unless you want different defaults for root.
+# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
+# umask 022
+
+# You may uncomment the following lines if you want `ls' to be colorized:
+# export LS_OPTIONS='--color=auto'
+# eval "$(dircolors)"
+# alias ls='ls $LS_OPTIONS'
+# alias ll='ls $LS_OPTIONS -l'
+# alias l='ls $LS_OPTIONS -lA'
+#
+# Some more alias to avoid making mistakes:
+# alias rm='rm -i'
+# alias cp='cp -i'
+# alias mv='mv -i'
+alias pip=pip3
+PS1="\[\e[01;37m\][\[\e[0m\]\[\e[01;31m\]\u\[\e[0m\]\[\e[00;37m\]@\[\e[0m\]\[\e[01;34m\]\h\[\e[0m\]\[\e[00;37m\] \[\e[0m\]\[\e[00;37m\]\t\[\e[0m\]\[\e[01;37m\] \W]\\$ \[\e[0m\]"

serv-01-baselinux/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+# handlers file for 03baselinux
+- name: Apply netplan
+  ansible.builtin.shell: netplan apply

serv-01-baselinux/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

serv-01-baselinux/tasks/addtoobservium.yml

@@ -0,0 +1,69 @@
+---
+- name: Extract SNMP community string from snmpd.conf using shell
+#  become: true
+  shell: |
+    awk '/^com2sec\s+readonly/ {print $4}' /etc/snmp/snmpd.conf | head -1
+  register: snmp_comm_out
+  changed_when: false
+
+- name: Set fact with SNMP community
+  set_fact:
+    snmp_community: "{{ snmp_comm_out.stdout | trim }}"
+
+- name: Debug found community
+  debug:
+    msg: "SNMP community: {{ snmp_community }}"
+
+# 2️⃣ Check if this host is already in Observium — runs on the Observium server
+- name: Check if host is already in Observium database
+  become: false
+  delegate_to: "{{ observium_server }}"
+  shell: |
+    docker exec {{ observium_container }} bash -c '
+      MYHOST={{ inventory_hostname }};
+      echo "SELECT device_id FROM devices WHERE hostname = '\''$MYHOST'\'';" | \
+      mysql -u"$OBSERVIUM_DB_USER" -p"$OBSERVIUM_DB_PASS" \
+        -h "$OBSERVIUM_DB_HOST" "$OBSERVIUM_DB_NAME"
+    '
+  register: observium_check
+  changed_when: false
+
+- name: Determine if host is already present in Observium
+  set_fact:
+    observium_device_id: >-
+      {{
+        observium_check.stdout_lines
+        | select('match', '^[0-9]+')
+        | list
+        | first
+        | default('')
+      }}
+
+- name: Show if host is already present
+  debug:
+    msg: "✅ Host {{ inventory_hostname }} is already in Observium (Device ID: {{ observium_device_id }})"
+  when: observium_device_id != ""
+
+# 3️⃣ Add the host to Observium if it does not exist
+- name: Add host to Observium
+  become: false
+  delegate_to: "{{ observium_server }}"
+  shell: |
+    docker exec {{ observium_container }} bash -c './add_device.php {{ inventory_hostname }} {{ snmp_community }} v2c'
+  register: add_result
+  when: observium_device_id == ""
+
+- name: Check if add_device.php output shows success
+  set_fact:
+    observium_add_success: "{{ add_result.stdout is search('Added device') }}"
+  when: observium_device_id == ""
+
+- name: Show result of Observium addition
+  debug:
+    msg: >-
+      {% if observium_add_success %}
+        ✅ Host {{ inventory_hostname }} was successfully added to Observium.
+      {% else %}
+        ⚠️ Host {{ inventory_hostname }} was NOT added to Observium. Check manually!
+      {% endif %}
+  when: observium_device_id == ""

serv-01-baselinux/tasks/ipchange.yml

@@ -0,0 +1,63 @@
+---
+- name: Configure static IP using Netplan (only if needed)
+  become: true
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_oldip is defined
+    - ansible_oldip != ansible_newip
+  block:
+
+    - name: Detect primary network interface
+      set_fact:
+        netplan_interface: "{{ ansible_default_ipv4.interface }}"
+
+    - name: Derive CIDR prefix from netmask (fallback to 24)
+      set_fact:
+        netmask_bits: "{{ ansible_default_ipv4.netmask | ansible.utils.ipaddr('prefix') | default('24', true) }}"
+
+    - name: Capture system DNS servers (fallback to 8.8.8.8)
+      set_fact:
+        current_dns_servers: "{{ ansible_dns.nameservers | default(['8.8.8.8']) }}"
+
+
+    - name: Generate Netplan config with static IP
+      ansible.builtin.copy:
+        dest: /etc/netplan/01-netcfg.yaml
+        mode: '0600'
+        content: |
+          network:
+            version: 2
+            renderer: networkd
+            ethernets:
+              {{ netplan_interface }}:
+                dhcp4: no
+                addresses: [{{ ansible_newip }}/{{ netmask_bits }}]
+                routes:
+                  - to: default
+                    via: {{ ansible_default_ipv4.gateway }}
+                nameservers:
+                  addresses: {{ current_dns_servers }}
+
+
+    - name: Remove default cloud-init netplan config
+      ansible.builtin.file:
+        path: /etc/netplan/50-cloud-init.yaml
+        state: absent
+      notify: Apply netplan
+
+    - name: Wait for network change to apply
+      ansible.builtin.pause:
+        seconds: 10
+
+    - name: Wait for host to become reachable on new IP
+      ansible.builtin.wait_for:
+        host: "{{ ansible_newip }}"
+        port: 22
+        delay: 5
+        timeout: 120
+        state: started
+
+    - name: Reassign ansible_host to the new static IP
+      set_fact:
+        ansible_host: "{{ ansible_newip }}"
+

serv-01-baselinux/tasks/main.yml

@@ -0,0 +1,146 @@
+---
+  - name: Get current hostname
+    ansible.builtin.command: hostname
+    register: hostname_result
+
+
+
+  - name: Allow 'ansible' user passwordless sudo (temporary)
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) NOPASSWD:ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Regenerate machine-id if hostname contains 'template'
+    block:
+      - name: Remove /etc/machine-id
+        ansible.builtin.file:
+          path: /etc/machine-id
+          state: absent
+
+      - name: Remove legacy /var/lib/dbus/machine-id if exists
+        ansible.builtin.file:
+          path: /var/lib/dbus/machine-id
+          state: absent
+
+      - name: Regenerate machine-id
+        ansible.builtin.command: systemd-machine-id-setup
+        args:
+          creates: /etc/machine-id 
+    when: "'template' in hostname_result.stdout"
+
+  - name: Set hostname
+    ansible.builtin.hostname:
+      name: "{{ inventory_hostname }}"
+
+  - name: replace hostname
+    lineinfile:
+      path: /etc/hosts
+      regexp: '^127.0.1.1'
+      line: "127.0.1.1    {{ inventory_hostname }}.{{ dns_domain }} {{ inventory_hostname }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution_major_version }}"
+
+#  - import_tasks: ipchange.yml
+
+  - name: Copy /etc/apt/sources.list file with owner and permissions
+    ansible.builtin.copy:
+      src: etc/apt/sources.list
+      dest: /etc/apt/sources.list
+      owner: root
+      group: root
+      mode: '0644'
+    when: (ansible_distribution == "Debian") and (ansible_distribution_major_version == "12")
+
+  - name: Run the equivalent of "apt-get update" as a separate step
+    ansible.builtin.apt:
+      update_cache: yes
+
+  - name: disable ipv6
+    ansible.builtin.template:
+      src: ../templates/etc/sysctl.d/90-noipv6.conf.j2
+      dest: /etc/sysctl.d/90-noipv6.conf
+      owner: root
+      group: root
+      mode: '0644'
+
+
+  - name: install var packages
+    apt:
+      name: "{{ item }}"
+      state: present
+    loop:
+      - vim
+      - mc
+      - htop
+      - iotop
+      - net-tools
+      - moreutils
+      - tcpdump
+      - nmap
+      - nmon
+      - ethtool
+
+  - name: Ansible delete file glob
+    find:
+      paths: /var/crash
+      patterns: "*"
+    register: files_to_delete
+
+  - name: Ansible remove file glob
+    file:
+      path: "{{ item.path }}"
+      state: absent
+    with_items: "{{ files_to_delete.files }}"
+
+  - name: Copy .bashrc file with owner and permissions
+    ansible.builtin.copy:
+      src: root/.bashrc
+      dest: /root/.bashrc
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Copy sysctl tweak file
+    ansible.builtin.copy:
+      src: etc/sysctl.d/999-tweaks.conf
+      dest: /etc/sysctl.d/999-tweaks.conf
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Reload sysctl parameters
+    ansible.builtin.command: sysctl --system
+
+
+
+  - import_tasks: ntp2.yml
+  - import_tasks: rsyslog.yml
+  - import_tasks: snmpd.yml
+  - import_tasks: addtoobservium.yml
+  - import_tasks: services.yml
+  - import_tasks: vlans.yml
+
+  - name: Revert 'ansible' sudo to require password
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Set plaintext password for ansible user
+    ansible.builtin.user:
+      name: ansible
+      password: "{{ 'tOwnz8qhfn4CaLLSJ6XW' | password_hash('sha512') }}"
+      update_password: always

serv-01-baselinux/tasks/ntp2.yml

@@ -0,0 +1,27 @@
+---
+- name: Set timezone to Africa/Johannesburg
+  community.general.timezone:
+    name: Africa/Johannesburg
+
+- name: Use fallback NTP servers
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    regexp: '^#?FallbackNTP='
+    line: FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Insert NTP line before FallbackNTP in timesyncd.conf
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    line: "NTP=time.ikeja.co.za"
+    insertbefore: '^FallbackNTP'
+    state: present
+
+
+- name: Restart and enable systemd-timesyncd
+  ansible.builtin.service:
+    name: systemd-timesyncd
+    state: restarted
+    enabled: true

serv-01-baselinux/tasks/rsyslog.yml

@@ -0,0 +1,25 @@
+---
+- name: ensure package rsyslog is at the latest
+  apt:
+    name:
+    - rsyslog
+    state: latest
+
+
+- name: Template a file to /etc/rsyslog.d/rsyslog.remote.conf
+  ansible.builtin.template:
+    src: ../templates/etc/rsyslog.d/rsyslog.remote.conf.j2
+    dest: /etc/rsyslog.d/remote.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+
+- name: make sure ntpd is enabled/running 
+  ansible.builtin.systemd:
+    name: rsyslog
+    state: restarted
+    enabled: yes
+
+
+

serv-01-baselinux/tasks/services.yml

@@ -0,0 +1,35 @@
+---
+- name: Disable unnecessary services for headless datacenter VMs
+  vars:
+    unwanted_services:
+      - apport.service
+      - cloud-config.service
+      - cloud-final.service
+      - cloud-init-local.service
+      - cloud-init.service
+      - console-setup.service
+      - fwupd.service
+      - gpu-manager.service
+      - ModemManager.service
+      - multipathd.service
+      - packagekit.service
+      - polkit.service
+      - pollinate.service
+      - snapd.apparmor.service
+      - snapd.autoimport.service
+      - snapd.core-fixup.service
+      - snapd.recovery-chooser-trigger.service
+      - snapd.seeded.service
+      - snapd.service
+      - snapd.system-shutdown.service
+      - thermald.service
+      - udisks2.service
+      - unattended-upgrades.service
+      - vgauth.service
+
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: false
+    masked: true
+  loop: "{{ unwanted_services }}"
+  tags: disable_services

serv-01-baselinux/tasks/snmpd.yml

@@ -0,0 +1,25 @@
+---
+- name: ensure package snmpd is at the latest
+  apt:
+    name:
+    - snmpd
+    state: latest
+
+
+- name: Template a file to /etc/snmp/snmpd.conf
+  ansible.builtin.template:
+    src: ../templates/etc/snmp/snmpd.conf.j2
+    dest: /etc/snmp/snmpd.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+
+- name: make sure snmpd is enabled/running 
+  ansible.builtin.systemd:
+    name: snmpd
+    state: restarted
+    enabled: yes
+
+
+

serv-01-baselinux/tasks/sshkey.yml

@@ -0,0 +1,10 @@
+---
+- name: Set authorized key taken from file
+  ansible.posix.authorized_key:
+    user: ansible
+    state: present
+    key: "{{ lookup('file', '/home/ansible/.ssh/mikrotik_key2.pub') }}"
+
+
+
+

serv-01-baselinux/tasks/vlans.yml

@@ -0,0 +1,18 @@
+---
+- name: Install vlan
+  apt:
+    name:
+    - vlan
+    state: latest
+
+- name: modprobe 8021q
+  command: modprobe 8021q
+  become: yes
+
+- name: adding 8021q to /etc/modules
+  lineinfile:
+    path: /etc/modules
+    line: 8021q
+    state: present
+    create: true
+  become: yes

serv-01-baselinux/templates/etc/ntp.conf.j2

@@ -0,0 +1,11 @@
+driftfile /var/lib/ntp/ntp.drift
+statistics loopstats peerstats clockstats
+filegen loopstats file loopstats type day enable
+filegen peerstats file peerstats type day enable
+filegen clockstats file clockstats type day enable
+server {{ ntpserver }} iburst
+restrict -4 default kod notrap nomodify nopeer noquery limited
+restrict -6 default kod notrap nomodify nopeer noquery limited
+restrict 127.0.0.1
+restrict ::1
+restrict source notrap nomodify noquery

serv-01-baselinux/templates/etc/rsyslog.d/rsyslog.remote.conf.j2

@@ -0,0 +1,2 @@
+*.*     @{{rsyslogserver}}:514
+

serv-01-baselinux/templates/etc/snmp/snmpd.conf.j2

@@ -0,0 +1,19 @@
+com2sec readonly  default         community_string
+
+   group MyROGroup v1         readonly
+   group MyROGroup v2c        readonly
+   group MyROGroup usm        readonly
+   view all    included  .1                               80
+   access MyROGroup ""      any       noauth    exact  all    none   none
+   syslocation homesite, Vilnius, LT
+   syscontact Contact Person <user@domain.com>
+
+   # This line allows Observium to detect the host OS if the distro script is installed
+   extend .1.3.6.1.4.1.2021.7890.1 distro /usr/bin/distro
+
+   # This line allows Observium to collect an accurate uptime
+   extend uptime /bin/cat /proc/uptime
+
+   # This line enables Observium's ifAlias description injection
+   pass_persist .1.3.6.1.2.1.31.1.1.1.18 /usr/bin/ifAlias_persist
+

serv-01-baselinux/templates/etc/sysctl.d/90-noipv6.conf.j2

@@ -0,0 +1,3 @@
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1

serv-01-baselinux/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

serv-01-baselinux/vars/main.yml

@@ -0,0 +1,4 @@
+---
+# vars file for baselinux
+ntpserver: time.ikeja.co.za
+rsyslogserver: 102.38.125.161