first commit

serv-01-baselinux/tasks/main.yml

@@ -0,0 +1,146 @@
+---
+  - name: Get current hostname
+    ansible.builtin.command: hostname
+    register: hostname_result
+
+
+
+  - name: Allow 'ansible' user passwordless sudo (temporary)
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) NOPASSWD:ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Regenerate machine-id if hostname contains 'template'
+    block:
+      - name: Remove /etc/machine-id
+        ansible.builtin.file:
+          path: /etc/machine-id
+          state: absent
+
+      - name: Remove legacy /var/lib/dbus/machine-id if exists
+        ansible.builtin.file:
+          path: /var/lib/dbus/machine-id
+          state: absent
+
+      - name: Regenerate machine-id
+        ansible.builtin.command: systemd-machine-id-setup
+        args:
+          creates: /etc/machine-id 
+    when: "'template' in hostname_result.stdout"
+
+  - name: Set hostname
+    ansible.builtin.hostname:
+      name: "{{ inventory_hostname }}"
+
+  - name: replace hostname
+    lineinfile:
+      path: /etc/hosts
+      regexp: '^127.0.1.1'
+      line: "127.0.1.1    {{ inventory_hostname }}.{{ dns_domain }} {{ inventory_hostname }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution_major_version }}"
+
+#  - import_tasks: ipchange.yml
+
+  - name: Copy /etc/apt/sources.list file with owner and permissions
+    ansible.builtin.copy:
+      src: etc/apt/sources.list
+      dest: /etc/apt/sources.list
+      owner: root
+      group: root
+      mode: '0644'
+    when: (ansible_distribution == "Debian") and (ansible_distribution_major_version == "12")
+
+  - name: Run the equivalent of "apt-get update" as a separate step
+    ansible.builtin.apt:
+      update_cache: yes
+
+  - name: disable ipv6
+    ansible.builtin.template:
+      src: ../templates/etc/sysctl.d/90-noipv6.conf.j2
+      dest: /etc/sysctl.d/90-noipv6.conf
+      owner: root
+      group: root
+      mode: '0644'
+
+
+  - name: install var packages
+    apt:
+      name: "{{ item }}"
+      state: present
+    loop:
+      - vim
+      - mc
+      - htop
+      - iotop
+      - net-tools
+      - moreutils
+      - tcpdump
+      - nmap
+      - nmon
+      - ethtool
+
+  - name: Ansible delete file glob
+    find:
+      paths: /var/crash
+      patterns: "*"
+    register: files_to_delete
+
+  - name: Ansible remove file glob
+    file:
+      path: "{{ item.path }}"
+      state: absent
+    with_items: "{{ files_to_delete.files }}"
+
+  - name: Copy .bashrc file with owner and permissions
+    ansible.builtin.copy:
+      src: root/.bashrc
+      dest: /root/.bashrc
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Copy sysctl tweak file
+    ansible.builtin.copy:
+      src: etc/sysctl.d/999-tweaks.conf
+      dest: /etc/sysctl.d/999-tweaks.conf
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Reload sysctl parameters
+    ansible.builtin.command: sysctl --system
+
+
+
+  - import_tasks: ntp2.yml
+  - import_tasks: rsyslog.yml
+  - import_tasks: snmpd.yml
+  - import_tasks: addtoobservium.yml
+  - import_tasks: services.yml
+  - import_tasks: vlans.yml
+
+  - name: Revert 'ansible' sudo to require password
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Set plaintext password for ansible user
+    ansible.builtin.user:
+      name: ansible
+      password: "{{ 'tOwnz8qhfn4CaLLSJ6XW' | password_hash('sha512') }}"
+      update_password: always