first commit

serv-01-baselinux/tasks/addtoobservium.yml

@@ -0,0 +1,69 @@
+---
+- name: Extract SNMP community string from snmpd.conf using shell
+#  become: true
+  shell: |
+    awk '/^com2sec\s+readonly/ {print $4}' /etc/snmp/snmpd.conf | head -1
+  register: snmp_comm_out
+  changed_when: false
+
+- name: Set fact with SNMP community
+  set_fact:
+    snmp_community: "{{ snmp_comm_out.stdout | trim }}"
+
+- name: Debug found community
+  debug:
+    msg: "SNMP community: {{ snmp_community }}"
+
+# 2️⃣ Check if this host is already in Observium — runs on the Observium server
+- name: Check if host is already in Observium database
+  become: false
+  delegate_to: "{{ observium_server }}"
+  shell: |
+    docker exec {{ observium_container }} bash -c '
+      MYHOST={{ inventory_hostname }};
+      echo "SELECT device_id FROM devices WHERE hostname = '\''$MYHOST'\'';" | \
+      mysql -u"$OBSERVIUM_DB_USER" -p"$OBSERVIUM_DB_PASS" \
+        -h "$OBSERVIUM_DB_HOST" "$OBSERVIUM_DB_NAME"
+    '
+  register: observium_check
+  changed_when: false
+
+- name: Determine if host is already present in Observium
+  set_fact:
+    observium_device_id: >-
+      {{
+        observium_check.stdout_lines
+        | select('match', '^[0-9]+')
+        | list
+        | first
+        | default('')
+      }}
+
+- name: Show if host is already present
+  debug:
+    msg: "✅ Host {{ inventory_hostname }} is already in Observium (Device ID: {{ observium_device_id }})"
+  when: observium_device_id != ""
+
+# 3️⃣ Add the host to Observium if it does not exist
+- name: Add host to Observium
+  become: false
+  delegate_to: "{{ observium_server }}"
+  shell: |
+    docker exec {{ observium_container }} bash -c './add_device.php {{ inventory_hostname }} {{ snmp_community }} v2c'
+  register: add_result
+  when: observium_device_id == ""
+
+- name: Check if add_device.php output shows success
+  set_fact:
+    observium_add_success: "{{ add_result.stdout is search('Added device') }}"
+  when: observium_device_id == ""
+
+- name: Show result of Observium addition
+  debug:
+    msg: >-
+      {% if observium_add_success %}
+        ✅ Host {{ inventory_hostname }} was successfully added to Observium.
+      {% else %}
+        ⚠️ Host {{ inventory_hostname }} was NOT added to Observium. Check manually!
+      {% endif %}
+  when: observium_device_id == ""

serv-01-baselinux/tasks/ipchange.yml

@@ -0,0 +1,63 @@
+---
+- name: Configure static IP using Netplan (only if needed)
+  become: true
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_oldip is defined
+    - ansible_oldip != ansible_newip
+  block:
+
+    - name: Detect primary network interface
+      set_fact:
+        netplan_interface: "{{ ansible_default_ipv4.interface }}"
+
+    - name: Derive CIDR prefix from netmask (fallback to 24)
+      set_fact:
+        netmask_bits: "{{ ansible_default_ipv4.netmask | ansible.utils.ipaddr('prefix') | default('24', true) }}"
+
+    - name: Capture system DNS servers (fallback to 8.8.8.8)
+      set_fact:
+        current_dns_servers: "{{ ansible_dns.nameservers | default(['8.8.8.8']) }}"
+
+
+    - name: Generate Netplan config with static IP
+      ansible.builtin.copy:
+        dest: /etc/netplan/01-netcfg.yaml
+        mode: '0600'
+        content: |
+          network:
+            version: 2
+            renderer: networkd
+            ethernets:
+              {{ netplan_interface }}:
+                dhcp4: no
+                addresses: [{{ ansible_newip }}/{{ netmask_bits }}]
+                routes:
+                  - to: default
+                    via: {{ ansible_default_ipv4.gateway }}
+                nameservers:
+                  addresses: {{ current_dns_servers }}
+
+
+    - name: Remove default cloud-init netplan config
+      ansible.builtin.file:
+        path: /etc/netplan/50-cloud-init.yaml
+        state: absent
+      notify: Apply netplan
+
+    - name: Wait for network change to apply
+      ansible.builtin.pause:
+        seconds: 10
+
+    - name: Wait for host to become reachable on new IP
+      ansible.builtin.wait_for:
+        host: "{{ ansible_newip }}"
+        port: 22
+        delay: 5
+        timeout: 120
+        state: started
+
+    - name: Reassign ansible_host to the new static IP
+      set_fact:
+        ansible_host: "{{ ansible_newip }}"
+

serv-01-baselinux/tasks/main.yml

@@ -0,0 +1,146 @@
+---
+  - name: Get current hostname
+    ansible.builtin.command: hostname
+    register: hostname_result
+
+
+
+  - name: Allow 'ansible' user passwordless sudo (temporary)
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) NOPASSWD:ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Regenerate machine-id if hostname contains 'template'
+    block:
+      - name: Remove /etc/machine-id
+        ansible.builtin.file:
+          path: /etc/machine-id
+          state: absent
+
+      - name: Remove legacy /var/lib/dbus/machine-id if exists
+        ansible.builtin.file:
+          path: /var/lib/dbus/machine-id
+          state: absent
+
+      - name: Regenerate machine-id
+        ansible.builtin.command: systemd-machine-id-setup
+        args:
+          creates: /etc/machine-id 
+    when: "'template' in hostname_result.stdout"
+
+  - name: Set hostname
+    ansible.builtin.hostname:
+      name: "{{ inventory_hostname }}"
+
+  - name: replace hostname
+    lineinfile:
+      path: /etc/hosts
+      regexp: '^127.0.1.1'
+      line: "127.0.1.1    {{ inventory_hostname }}.{{ dns_domain }} {{ inventory_hostname }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution_major_version }}"
+
+#  - import_tasks: ipchange.yml
+
+  - name: Copy /etc/apt/sources.list file with owner and permissions
+    ansible.builtin.copy:
+      src: etc/apt/sources.list
+      dest: /etc/apt/sources.list
+      owner: root
+      group: root
+      mode: '0644'
+    when: (ansible_distribution == "Debian") and (ansible_distribution_major_version == "12")
+
+  - name: Run the equivalent of "apt-get update" as a separate step
+    ansible.builtin.apt:
+      update_cache: yes
+
+  - name: disable ipv6
+    ansible.builtin.template:
+      src: ../templates/etc/sysctl.d/90-noipv6.conf.j2
+      dest: /etc/sysctl.d/90-noipv6.conf
+      owner: root
+      group: root
+      mode: '0644'
+
+
+  - name: install var packages
+    apt:
+      name: "{{ item }}"
+      state: present
+    loop:
+      - vim
+      - mc
+      - htop
+      - iotop
+      - net-tools
+      - moreutils
+      - tcpdump
+      - nmap
+      - nmon
+      - ethtool
+
+  - name: Ansible delete file glob
+    find:
+      paths: /var/crash
+      patterns: "*"
+    register: files_to_delete
+
+  - name: Ansible remove file glob
+    file:
+      path: "{{ item.path }}"
+      state: absent
+    with_items: "{{ files_to_delete.files }}"
+
+  - name: Copy .bashrc file with owner and permissions
+    ansible.builtin.copy:
+      src: root/.bashrc
+      dest: /root/.bashrc
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Copy sysctl tweak file
+    ansible.builtin.copy:
+      src: etc/sysctl.d/999-tweaks.conf
+      dest: /etc/sysctl.d/999-tweaks.conf
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Reload sysctl parameters
+    ansible.builtin.command: sysctl --system
+
+
+
+  - import_tasks: ntp2.yml
+  - import_tasks: rsyslog.yml
+  - import_tasks: snmpd.yml
+  - import_tasks: addtoobservium.yml
+  - import_tasks: services.yml
+  - import_tasks: vlans.yml
+
+  - name: Revert 'ansible' sudo to require password
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Set plaintext password for ansible user
+    ansible.builtin.user:
+      name: ansible
+      password: "{{ 'tOwnz8qhfn4CaLLSJ6XW' | password_hash('sha512') }}"
+      update_password: always

serv-01-baselinux/tasks/ntp2.yml

@@ -0,0 +1,27 @@
+---
+- name: Set timezone to Africa/Johannesburg
+  community.general.timezone:
+    name: Africa/Johannesburg
+
+- name: Use fallback NTP servers
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    regexp: '^#?FallbackNTP='
+    line: FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Insert NTP line before FallbackNTP in timesyncd.conf
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    line: "NTP=time.ikeja.co.za"
+    insertbefore: '^FallbackNTP'
+    state: present
+
+
+- name: Restart and enable systemd-timesyncd
+  ansible.builtin.service:
+    name: systemd-timesyncd
+    state: restarted
+    enabled: true

serv-01-baselinux/tasks/rsyslog.yml

@@ -0,0 +1,25 @@
+---
+- name: ensure package rsyslog is at the latest
+  apt:
+    name:
+    - rsyslog
+    state: latest
+
+
+- name: Template a file to /etc/rsyslog.d/rsyslog.remote.conf
+  ansible.builtin.template:
+    src: ../templates/etc/rsyslog.d/rsyslog.remote.conf.j2
+    dest: /etc/rsyslog.d/remote.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+
+- name: make sure ntpd is enabled/running 
+  ansible.builtin.systemd:
+    name: rsyslog
+    state: restarted
+    enabled: yes
+
+
+

serv-01-baselinux/tasks/services.yml

@@ -0,0 +1,35 @@
+---
+- name: Disable unnecessary services for headless datacenter VMs
+  vars:
+    unwanted_services:
+      - apport.service
+      - cloud-config.service
+      - cloud-final.service
+      - cloud-init-local.service
+      - cloud-init.service
+      - console-setup.service
+      - fwupd.service
+      - gpu-manager.service
+      - ModemManager.service
+      - multipathd.service
+      - packagekit.service
+      - polkit.service
+      - pollinate.service
+      - snapd.apparmor.service
+      - snapd.autoimport.service
+      - snapd.core-fixup.service
+      - snapd.recovery-chooser-trigger.service
+      - snapd.seeded.service
+      - snapd.service
+      - snapd.system-shutdown.service
+      - thermald.service
+      - udisks2.service
+      - unattended-upgrades.service
+      - vgauth.service
+
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: false
+    masked: true
+  loop: "{{ unwanted_services }}"
+  tags: disable_services

serv-01-baselinux/tasks/snmpd.yml

@@ -0,0 +1,25 @@
+---
+- name: ensure package snmpd is at the latest
+  apt:
+    name:
+    - snmpd
+    state: latest
+
+
+- name: Template a file to /etc/snmp/snmpd.conf
+  ansible.builtin.template:
+    src: ../templates/etc/snmp/snmpd.conf.j2
+    dest: /etc/snmp/snmpd.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+
+- name: make sure snmpd is enabled/running 
+  ansible.builtin.systemd:
+    name: snmpd
+    state: restarted
+    enabled: yes
+
+
+

serv-01-baselinux/tasks/sshkey.yml

@@ -0,0 +1,10 @@
+---
+- name: Set authorized key taken from file
+  ansible.posix.authorized_key:
+    user: ansible
+    state: present
+    key: "{{ lookup('file', '/home/ansible/.ssh/mikrotik_key2.pub') }}"
+
+
+
+

serv-01-baselinux/tasks/vlans.yml

@@ -0,0 +1,18 @@
+---
+- name: Install vlan
+  apt:
+    name:
+    - vlan
+    state: latest
+
+- name: modprobe 8021q
+  command: modprobe 8021q
+  become: yes
+
+- name: adding 8021q to /etc/modules
+  lineinfile:
+    path: /etc/modules
+    line: 8021q
+    state: present
+    create: true
+  become: yes