first commit

hosts

@@ -0,0 +1,19 @@
+[servers:children]
+preprod
+prod
+
+[preprod]
+sterver01 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.71 ansible_python_interpreter=/usr/bin/python3
+sterver02 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.252 ansible_python_interpreter=/usr/bin/python3
+sterver03 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.251 ansible_python_interpreter=/usr/bin/python3
+sterver04 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.250 ansible_python_interpreter=/usr/bin/python3
+staging-cloud dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.25 ansible_python_interpreter=/usr/bin/python3
+
+
+[prod]
+jump01 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.2 ansible_python_interpreter=/usr/bin/python3
+observium dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.10 ansible_python_interpreter=/usr/bin/python3
+syslogger dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.11 ansible_python_interpreter=/usr/bin/python3
+gt-cache-srv1 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.13.5 ansible_python_interpreter=/usr/bin/python3
+production-cloud dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.13.7 ansible_python_interpreter=/usr/bin/python3
+unidocker1 dns_domain=gt-tiso.ikeja.co.za ansible_user=ansible ansible_host=10.210.12.12 ansible_python_interpreter=/usr/bin/python3

serv-01-baselinux.yml

@@ -0,0 +1,16 @@
+---
+# - name: Pre-IP override setup
+#   hosts: all
+#   gather_facts: false
+#   tasks:
+#     - name: Capture static IP and override ansible_host with ansible_oldip
+#       set_fact:
+#         ansible_newip: "{{ hostvars[inventory_hostname]['ansible_host'] }}"
+#         ansible_host: "{{ ansible_oldip }}"
+#       when: ansible_oldip is defined
+
+ - hosts: all 
+   become: true
+
+   roles:
+     - serv-01-baselinux

serv-01-baselinux/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

serv-01-baselinux/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

serv-01-baselinux/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+observium_server: observium  # your Observium host group
+observium_container: observium  # the Docker container name

serv-01-baselinux/files/etc/apt/sources.list

@@ -0,0 +1,10 @@
+deb http://deb.debian.org/debian bookworm main non-free contrib
+deb-src http://deb.debian.org/debian bookworm main non-free contrib
+
+deb http://security.debian.org/debian-security bookworm-security main contrib non-free
+deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free
+
+# bookworm-updates, to get updates before a point release is made;
+# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html # _updates_and_backports
+deb http://deb.debian.org/debian bookworm-updates main contrib non-free
+deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free

serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf

@@ -0,0 +1,90 @@
+
+# ===== Memory Management =====
+
+# Reduce swappiness to avoid swapping until really necessary
+vm.swappiness = 10
+
+# Increase max read/write I/O requests (helps with I/O-heavy VMs)
+vm.max_map_count = 262144
+
+# Don't overcommit memory aggressively
+vm.overcommit_memory = 1
+vm.overcommit_ratio = 80
+
+# Enable process memory reclaiming
+vm.dirty_ratio = 15
+vm.dirty_background_ratio = 5
+
+# ===== File System & Descriptors =====
+
+# Allow more open file handles (important for services handling many files/connections)
+fs.file-max = 2097152
+
+# ===== Networking: Buffers =====
+
+# Increase network buffer space (for high-throughput applications)
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+net.core.rmem_default = 262144
+net.core.wmem_default = 262144
+
+# Increase backlog queues
+net.core.netdev_max_backlog = 5000
+net.core.somaxconn = 1024
+
+# ===== Networking: TCP Tweaks =====
+
+# Enable TCP SYN cookies to prevent SYN flood DoS attacks
+net.ipv4.tcp_syncookies = 1
+
+# Reduce FIN timeout to clean up closed connections faster
+net.ipv4.tcp_fin_timeout = 15
+
+# Enable TCP keepalive probes more aggressively
+net.ipv4.tcp_keepalive_time = 300
+net.ipv4.tcp_keepalive_intvl = 60
+net.ipv4.tcp_keepalive_probes = 5
+
+# Reduce time-wait connections held
+net.ipv4.tcp_max_tw_buckets = 2000000
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_tw_recycle = 0
+
+# Increase TCP buffer limits
+net.ipv4.tcp_rmem = 4096 87380 16777216
+net.ipv4.tcp_wmem = 4096 65536 16777216
+
+# ===== Networking: Connection Tracking =====
+
+# (if conntrack is involved, increase bucket sizes – useful for iptables/nftables with many connections)
+net.netfilter.nf_conntrack_max = 262144
+
+# ===== Security & Routing =====
+
+# Disable IP source routing
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+
+# Disable ICMP redirects (security & performance)
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+
+# Do not send ICMP redirects (we are not a router)
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
+# Enable Reverse Path Filterin
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+
+# ===== Performance =====
+
+# Avoid using swap too eagerly under memory pressure
+vm.min_free_kbytes = 65536
+
+# ===== IPv6 Tuning (disable if unused) =====
+
+# Uncomment if IPv6 is not used
+# net.ipv6.conf.all.disable_ipv6 = 1
+# net.ipv6.conf.default.disable_ipv6 = 1
+

serv-01-baselinux/files/root/.bashrc

@@ -0,0 +1,86 @@
+##
+## Slightly nicer .bashrc
+## Makes pretty colors and stuff
+##
+
+## Set $PATH, which tells the computer where to search for commands
+export PATH="$PATH:/usr/sbin:/sbin:/bin:/usr/bin:/etc:/usr/ucb:/usr/local/bin:/usr/local/local_dfs/bin:/usr/bin/X11:/usr/local/sas"
+
+## Where to search for manual pages
+export MANPATH="/usr/share/man:/usr/local/man:/usr/local/local_dfs/man"
+
+## Which pager to use.
+export PAGER=less
+
+## Choose your weapon
+EDITOR=/usr/bin/vim
+#EDITOR=/usr/bin/emacs
+#EDITOR=/usr/bin/nano
+export EDITOR
+
+## The maximum number of lines in your history file
+export HISTFILESIZE=50
+
+## UVM!
+export ORGANIZATION="University of Vermont"
+
+## Enables displaying colors in the terminal
+export TERM=xterm-color
+
+# Uncomment the following lines if you are an ARC/INFO user
+#alias arc=/usr/local/bin/arc
+#alias arcdoc=/usr/local/bin/arcdoc
+#alias info=/usr/local/bin/arcinfo
+
+## Disable automatic mail checking
+unset MAILCHECK 
+
+## If this is an interactive console, disable messaging
+#tty -s && mesg n
+
+## Aliases from 'ol EMBA tcsh
+#alias bye=logout
+#alias h=history
+#alias jobs='jobs -l'
+#alias lf='ls -algF'
+#alias log=logout
+#alias cls=clear
+#alias edit=$EDITOR
+#alias restore=/usr/local/local_dfs/bin/restore
+
+## Automatically correct mistyped 'cd' directories
+#shopt -s cdspell
+
+## Append to history file; do not overwrite
+shopt -s histappend
+
+## Prevent accidental overwrites when using IO redirection
+set -o noclobber
+
+## Set the prompt to display the current git branch
+## and use pretty colors
+export PS1='$(git branch &>/dev/null; if [ $? -eq 0 ]; then \
+echo "\[\e[1m\]\u@\h\[\e[0m\]: \w [\[\e[34m\]$(git branch | grep ^* | sed s/\*\ //)\[\e[0m\]\
+$(echo `git status` | grep "nothing to commit" > /dev/null 2>&1; if [ "$?" -ne "0" ]; then \
+echo "\[\e[1;31m\]*\[\e[0m\]"; fi)] \$ "; else \
+echo "\[\e[1m\]\u@\h\[\e[0m\]: \w \$ "; fi )'
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+# Note: PS1 and umask are already set in /etc/profile. You should not
+# need this unless you want different defaults for root.
+# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
+# umask 022
+
+# You may uncomment the following lines if you want `ls' to be colorized:
+# export LS_OPTIONS='--color=auto'
+# eval "$(dircolors)"
+# alias ls='ls $LS_OPTIONS'
+# alias ll='ls $LS_OPTIONS -l'
+# alias l='ls $LS_OPTIONS -lA'
+#
+# Some more alias to avoid making mistakes:
+# alias rm='rm -i'
+# alias cp='cp -i'
+# alias mv='mv -i'
+alias pip=pip3
+PS1="\[\e[01;37m\][\[\e[0m\]\[\e[01;31m\]\u\[\e[0m\]\[\e[00;37m\]@\[\e[0m\]\[\e[01;34m\]\h\[\e[0m\]\[\e[00;37m\] \[\e[0m\]\[\e[00;37m\]\t\[\e[0m\]\[\e[01;37m\] \W]\\$ \[\e[0m\]"

serv-01-baselinux/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+# handlers file for 03baselinux
+- name: Apply netplan
+  ansible.builtin.shell: netplan apply

serv-01-baselinux/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

serv-01-baselinux/tasks/addtoobservium.yml

@@ -0,0 +1,69 @@
+---
+- name: Extract SNMP community string from snmpd.conf using shell
+#  become: true
+  shell: |
+    awk '/^com2sec\s+readonly/ {print $4}' /etc/snmp/snmpd.conf | head -1
+  register: snmp_comm_out
+  changed_when: false
+
+- name: Set fact with SNMP community
+  set_fact:
+    snmp_community: "{{ snmp_comm_out.stdout | trim }}"
+
+- name: Debug found community
+  debug:
+    msg: "SNMP community: {{ snmp_community }}"
+
+# 2️⃣ Check if this host is already in Observium — runs on the Observium server
+- name: Check if host is already in Observium database
+  become: false
+  delegate_to: "{{ observium_server }}"
+  shell: |
+    docker exec {{ observium_container }} bash -c '
+      MYHOST={{ inventory_hostname }};
+      echo "SELECT device_id FROM devices WHERE hostname = '\''$MYHOST'\'';" | \
+      mysql -u"$OBSERVIUM_DB_USER" -p"$OBSERVIUM_DB_PASS" \
+        -h "$OBSERVIUM_DB_HOST" "$OBSERVIUM_DB_NAME"
+    '
+  register: observium_check
+  changed_when: false
+
+- name: Determine if host is already present in Observium
+  set_fact:
+    observium_device_id: >-
+      {{
+        observium_check.stdout_lines
+        | select('match', '^[0-9]+')
+        | list
+        | first
+        | default('')
+      }}
+
+- name: Show if host is already present
+  debug:
+    msg: "✅ Host {{ inventory_hostname }} is already in Observium (Device ID: {{ observium_device_id }})"
+  when: observium_device_id != ""
+
+# 3️⃣ Add the host to Observium if it does not exist
+- name: Add host to Observium
+  become: false
+  delegate_to: "{{ observium_server }}"
+  shell: |
+    docker exec {{ observium_container }} bash -c './add_device.php {{ inventory_hostname }} {{ snmp_community }} v2c'
+  register: add_result
+  when: observium_device_id == ""
+
+- name: Check if add_device.php output shows success
+  set_fact:
+    observium_add_success: "{{ add_result.stdout is search('Added device') }}"
+  when: observium_device_id == ""
+
+- name: Show result of Observium addition
+  debug:
+    msg: >-
+      {% if observium_add_success %}
+        ✅ Host {{ inventory_hostname }} was successfully added to Observium.
+      {% else %}
+        ⚠️ Host {{ inventory_hostname }} was NOT added to Observium. Check manually!
+      {% endif %}
+  when: observium_device_id == ""

serv-01-baselinux/tasks/ipchange.yml

@@ -0,0 +1,63 @@
+---
+- name: Configure static IP using Netplan (only if needed)
+  become: true
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_oldip is defined
+    - ansible_oldip != ansible_newip
+  block:
+
+    - name: Detect primary network interface
+      set_fact:
+        netplan_interface: "{{ ansible_default_ipv4.interface }}"
+
+    - name: Derive CIDR prefix from netmask (fallback to 24)
+      set_fact:
+        netmask_bits: "{{ ansible_default_ipv4.netmask | ansible.utils.ipaddr('prefix') | default('24', true) }}"
+
+    - name: Capture system DNS servers (fallback to 8.8.8.8)
+      set_fact:
+        current_dns_servers: "{{ ansible_dns.nameservers | default(['8.8.8.8']) }}"
+
+
+    - name: Generate Netplan config with static IP
+      ansible.builtin.copy:
+        dest: /etc/netplan/01-netcfg.yaml
+        mode: '0600'
+        content: |
+          network:
+            version: 2
+            renderer: networkd
+            ethernets:
+              {{ netplan_interface }}:
+                dhcp4: no
+                addresses: [{{ ansible_newip }}/{{ netmask_bits }}]
+                routes:
+                  - to: default
+                    via: {{ ansible_default_ipv4.gateway }}
+                nameservers:
+                  addresses: {{ current_dns_servers }}
+
+
+    - name: Remove default cloud-init netplan config
+      ansible.builtin.file:
+        path: /etc/netplan/50-cloud-init.yaml
+        state: absent
+      notify: Apply netplan
+
+    - name: Wait for network change to apply
+      ansible.builtin.pause:
+        seconds: 10
+
+    - name: Wait for host to become reachable on new IP
+      ansible.builtin.wait_for:
+        host: "{{ ansible_newip }}"
+        port: 22
+        delay: 5
+        timeout: 120
+        state: started
+
+    - name: Reassign ansible_host to the new static IP
+      set_fact:
+        ansible_host: "{{ ansible_newip }}"
+

serv-01-baselinux/tasks/main.yml

@@ -0,0 +1,146 @@
+---
+  - name: Get current hostname
+    ansible.builtin.command: hostname
+    register: hostname_result
+
+
+
+  - name: Allow 'ansible' user passwordless sudo (temporary)
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) NOPASSWD:ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Regenerate machine-id if hostname contains 'template'
+    block:
+      - name: Remove /etc/machine-id
+        ansible.builtin.file:
+          path: /etc/machine-id
+          state: absent
+
+      - name: Remove legacy /var/lib/dbus/machine-id if exists
+        ansible.builtin.file:
+          path: /var/lib/dbus/machine-id
+          state: absent
+
+      - name: Regenerate machine-id
+        ansible.builtin.command: systemd-machine-id-setup
+        args:
+          creates: /etc/machine-id 
+    when: "'template' in hostname_result.stdout"
+
+  - name: Set hostname
+    ansible.builtin.hostname:
+      name: "{{ inventory_hostname }}"
+
+  - name: replace hostname
+    lineinfile:
+      path: /etc/hosts
+      regexp: '^127.0.1.1'
+      line: "127.0.1.1    {{ inventory_hostname }}.{{ dns_domain }} {{ inventory_hostname }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution }}"
+
+  - name: System details
+    debug:
+      msg: "{{ ansible_distribution_major_version }}"
+
+#  - import_tasks: ipchange.yml
+
+  - name: Copy /etc/apt/sources.list file with owner and permissions
+    ansible.builtin.copy:
+      src: etc/apt/sources.list
+      dest: /etc/apt/sources.list
+      owner: root
+      group: root
+      mode: '0644'
+    when: (ansible_distribution == "Debian") and (ansible_distribution_major_version == "12")
+
+  - name: Run the equivalent of "apt-get update" as a separate step
+    ansible.builtin.apt:
+      update_cache: yes
+
+  - name: disable ipv6
+    ansible.builtin.template:
+      src: ../templates/etc/sysctl.d/90-noipv6.conf.j2
+      dest: /etc/sysctl.d/90-noipv6.conf
+      owner: root
+      group: root
+      mode: '0644'
+
+
+  - name: install var packages
+    apt:
+      name: "{{ item }}"
+      state: present
+    loop:
+      - vim
+      - mc
+      - htop
+      - iotop
+      - net-tools
+      - moreutils
+      - tcpdump
+      - nmap
+      - nmon
+      - ethtool
+
+  - name: Ansible delete file glob
+    find:
+      paths: /var/crash
+      patterns: "*"
+    register: files_to_delete
+
+  - name: Ansible remove file glob
+    file:
+      path: "{{ item.path }}"
+      state: absent
+    with_items: "{{ files_to_delete.files }}"
+
+  - name: Copy .bashrc file with owner and permissions
+    ansible.builtin.copy:
+      src: root/.bashrc
+      dest: /root/.bashrc
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Copy sysctl tweak file
+    ansible.builtin.copy:
+      src: etc/sysctl.d/999-tweaks.conf
+      dest: /etc/sysctl.d/999-tweaks.conf
+      owner: root
+      group: root
+      mode: '0644'
+      follow: yes
+
+  - name: Reload sysctl parameters
+    ansible.builtin.command: sysctl --system
+
+
+
+  - import_tasks: ntp2.yml
+  - import_tasks: rsyslog.yml
+  - import_tasks: snmpd.yml
+  - import_tasks: addtoobservium.yml
+  - import_tasks: services.yml
+  - import_tasks: vlans.yml
+
+  - name: Revert 'ansible' sudo to require password
+    ansible.builtin.copy:
+      dest: /etc/sudoers.d/ansible
+      content: "ansible ALL=(ALL) ALL\n"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Set plaintext password for ansible user
+    ansible.builtin.user:
+      name: ansible
+      password: "{{ 'tOwnz8qhfn4CaLLSJ6XW' | password_hash('sha512') }}"
+      update_password: always

serv-01-baselinux/tasks/ntp2.yml

@@ -0,0 +1,27 @@
+---
+- name: Set timezone to Africa/Johannesburg
+  community.general.timezone:
+    name: Africa/Johannesburg
+
+- name: Use fallback NTP servers
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    regexp: '^#?FallbackNTP='
+    line: FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Insert NTP line before FallbackNTP in timesyncd.conf
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    line: "NTP=time.ikeja.co.za"
+    insertbefore: '^FallbackNTP'
+    state: present
+
+
+- name: Restart and enable systemd-timesyncd
+  ansible.builtin.service:
+    name: systemd-timesyncd
+    state: restarted
+    enabled: true

serv-01-baselinux/tasks/rsyslog.yml

@@ -0,0 +1,25 @@
+---
+- name: ensure package rsyslog is at the latest
+  apt:
+    name:
+    - rsyslog
+    state: latest
+
+
+- name: Template a file to /etc/rsyslog.d/rsyslog.remote.conf
+  ansible.builtin.template:
+    src: ../templates/etc/rsyslog.d/rsyslog.remote.conf.j2
+    dest: /etc/rsyslog.d/remote.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+
+- name: make sure ntpd is enabled/running 
+  ansible.builtin.systemd:
+    name: rsyslog
+    state: restarted
+    enabled: yes
+
+
+

serv-01-baselinux/tasks/services.yml

@@ -0,0 +1,35 @@
+---
+- name: Disable unnecessary services for headless datacenter VMs
+  vars:
+    unwanted_services:
+      - apport.service
+      - cloud-config.service
+      - cloud-final.service
+      - cloud-init-local.service
+      - cloud-init.service
+      - console-setup.service
+      - fwupd.service
+      - gpu-manager.service
+      - ModemManager.service
+      - multipathd.service
+      - packagekit.service
+      - polkit.service
+      - pollinate.service
+      - snapd.apparmor.service
+      - snapd.autoimport.service
+      - snapd.core-fixup.service
+      - snapd.recovery-chooser-trigger.service
+      - snapd.seeded.service
+      - snapd.service
+      - snapd.system-shutdown.service
+      - thermald.service
+      - udisks2.service
+      - unattended-upgrades.service
+      - vgauth.service
+
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: false
+    masked: true
+  loop: "{{ unwanted_services }}"
+  tags: disable_services

serv-01-baselinux/tasks/snmpd.yml

@@ -0,0 +1,25 @@
+---
+- name: ensure package snmpd is at the latest
+  apt:
+    name:
+    - snmpd
+    state: latest
+
+
+- name: Template a file to /etc/snmp/snmpd.conf
+  ansible.builtin.template:
+    src: ../templates/etc/snmp/snmpd.conf.j2
+    dest: /etc/snmp/snmpd.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+
+- name: make sure snmpd is enabled/running 
+  ansible.builtin.systemd:
+    name: snmpd
+    state: restarted
+    enabled: yes
+
+
+

serv-01-baselinux/tasks/sshkey.yml

@@ -0,0 +1,10 @@
+---
+- name: Set authorized key taken from file
+  ansible.posix.authorized_key:
+    user: ansible
+    state: present
+    key: "{{ lookup('file', '/home/ansible/.ssh/mikrotik_key2.pub') }}"
+
+
+
+

serv-01-baselinux/tasks/vlans.yml

@@ -0,0 +1,18 @@
+---
+- name: Install vlan
+  apt:
+    name:
+    - vlan
+    state: latest
+
+- name: modprobe 8021q
+  command: modprobe 8021q
+  become: yes
+
+- name: adding 8021q to /etc/modules
+  lineinfile:
+    path: /etc/modules
+    line: 8021q
+    state: present
+    create: true
+  become: yes

serv-01-baselinux/templates/etc/ntp.conf.j2

@@ -0,0 +1,11 @@
+driftfile /var/lib/ntp/ntp.drift
+statistics loopstats peerstats clockstats
+filegen loopstats file loopstats type day enable
+filegen peerstats file peerstats type day enable
+filegen clockstats file clockstats type day enable
+server {{ ntpserver }} iburst
+restrict -4 default kod notrap nomodify nopeer noquery limited
+restrict -6 default kod notrap nomodify nopeer noquery limited
+restrict 127.0.0.1
+restrict ::1
+restrict source notrap nomodify noquery

serv-01-baselinux/templates/etc/rsyslog.d/rsyslog.remote.conf.j2

@@ -0,0 +1,2 @@
+*.*     @{{rsyslogserver}}:514
+

serv-01-baselinux/templates/etc/snmp/snmpd.conf.j2

@@ -0,0 +1,19 @@
+com2sec readonly  default         community_string
+
+   group MyROGroup v1         readonly
+   group MyROGroup v2c        readonly
+   group MyROGroup usm        readonly
+   view all    included  .1                               80
+   access MyROGroup ""      any       noauth    exact  all    none   none
+   syslocation homesite, Vilnius, LT
+   syscontact Contact Person <user@domain.com>
+
+   # This line allows Observium to detect the host OS if the distro script is installed
+   extend .1.3.6.1.4.1.2021.7890.1 distro /usr/bin/distro
+
+   # This line allows Observium to collect an accurate uptime
+   extend uptime /bin/cat /proc/uptime
+
+   # This line enables Observium's ifAlias description injection
+   pass_persist .1.3.6.1.2.1.31.1.1.1.18 /usr/bin/ifAlias_persist
+

serv-01-baselinux/templates/etc/sysctl.d/90-noipv6.conf.j2

@@ -0,0 +1,3 @@
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1

serv-01-baselinux/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

serv-01-baselinux/vars/main.yml

@@ -0,0 +1,4 @@
+---
+# vars file for baselinux
+ntpserver: time.ikeja.co.za
+rsyslogserver: 102.38.125.161

serv-02-dockerbookworm.yml

@@ -0,0 +1,6 @@
+---
+ - hosts: all
+   become: true
+
+   roles:
+     - serv-02-dockerbookworm

serv-02-dockerbookworm/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

serv-02-dockerbookworm/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

serv-02-dockerbookworm/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for 07docker

serv-02-dockerbookworm/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for 07docker

serv-02-dockerbookworm/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

serv-02-dockerbookworm/tasks/main.yml

@@ -0,0 +1,101 @@
+---
+  - name: Install aptitude using apt
+    apt: name=aptitude state=latest update_cache=yes force_apt_get=yes
+
+  - name: Install required system packages
+    apt: name={{ item }} state=latest update_cache=yes
+    loop: [ 'apt-transport-https', 'ca-certificates', 'curl', 'software-properties-common', 'python3-pip', 'virtualenv', 'python3-setuptools', 'python3-pkg-resources']
+
+  - name: creating alias
+    shell: echo alias pip=pip3 >> ~/.bashrc
+
+  - name: Add Docker GPG apt Key
+    apt_key:
+      url: https://download.docker.com/linux/debian/gpg
+      state: present
+
+  - name: Add Docker Repository
+    apt_repository:
+      repo: deb [arch=amd64] https://download.docker.com/linux/debian bookworm stable
+      state: present
+
+  - name: Update apt and install docker-ce
+    apt: 
+      name: "{{item}}"
+      state: present
+      update_cache: yes
+    with_items:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+
+  - name: Create docker group
+    group:
+      name: "docker"
+      state: present
+
+
+  - name: Add docker user with specific attributes
+    user:
+      name: docker
+      system: yes
+      createhome: yes
+      home: /home/docker
+      shell: /usr/sbin/nologin
+
+  - name: Adding user docker to docker group
+    user:
+      name: docker
+      groups: "docker"
+      append: "yes"
+
+  - name: Adding user ansible to docker group
+    user:
+      name: ansible
+      groups: "docker"
+      append: "yes"
+
+  - name: Get Python 3.X version
+    ansible.builtin.command: python3 --version
+    register: pyver
+    changed_when: false
+    failed_when: pyver.rc != 0
+
+  - name: Remove Python 3.X EXTERNALLY-MANAGED file
+    ansible.builtin.file:
+      state: absent
+      path: "/usr/lib/python{{ pyver.stdout.split()[1] | regex_search('([0-9]+\\.[0-9]+)') }}/EXTERNALLY-MANAGED"
+    when: pyver.stdout | regex_search('3\.[0-9]+')
+
+  - name: Install and upgrade pip
+    pip:
+      name: pip
+      extra_args: --upgrade
+      executable: pip3
+
+  - name: Install setuptools Module for Python
+    pip:
+      name: setuptools
+
+  - name: Install Docker Module for Python
+    pip:
+      name: docker
+
+  - name: Install requests for Python
+    pip:
+      name: requests
+      version: 2.32.3
+  - name: Create /opt/containers directory
+    file:
+      path: /opt/containers
+      state: directory
+      owner: docker
+      group: docker
+      mode: '0750'
+
+
+
+#  - name: Install Docker compose for Python
+#    pip:
+#      name: docker-compose
+

serv-02-dockerbookworm/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

serv-02-dockerbookworm/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - 07docker

serv-02-dockerbookworm/vars/main.yml

@@ -0,0 +1,6 @@
+---
+# vars file for 07docker
+  create_containers: 4
+  default_container_name: docker
+  default_container_image: ubuntu
+  default_container_command: sleep 1d

serv-02-dockerbullseye.yml

@@ -0,0 +1,6 @@
+---
+ - hosts: all
+   become: true
+
+   roles:
+     - serv-02-dockerbullseye

serv-02-dockerbullseye/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

serv-02-dockerbullseye/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

serv-02-dockerbullseye/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for 07docker

serv-02-dockerbullseye/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for 07docker

serv-02-dockerbullseye/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

serv-02-dockerbullseye/tasks/main.yml

@@ -0,0 +1,61 @@
+---
+  - name: Install aptitude using apt
+    apt: name=aptitude state=latest update_cache=yes force_apt_get=yes
+
+  - name: Install required system packages
+    apt: name={{ item }} state=latest update_cache=yes
+    loop: [ 'apt-transport-https', 'ca-certificates', 'curl', 'software-properties-common', 'python3-pip', 'virtualenv', 'python3-setuptools', 'python-pkg-resources']
+
+
+  - name: creating alias
+    shell: echo alias pip=pip3 >> ~/.bashrc
+
+  - name: Add Docker GPG apt Key
+    apt_key:
+      url: https://download.docker.com/linux/debian/gpg
+      state: present
+
+  - name: Add Docker Repository
+    apt_repository:
+      repo: deb [arch=amd64] https://download.docker.com/linux/debian bullseye stable
+      state: present
+
+  - name: Update apt and install docker-ce
+    apt: 
+      name: "{{item}}"
+      state: present
+      update_cache: yes
+    with_items:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+
+  - name: Create docker group
+    group:
+      name: "docker"
+      state: present
+
+  - name: Adding user pavel to docker group
+    user:
+      name: pavel
+      groups: "docker"
+      append: "yes"
+
+  - name: Install and upgrade pip
+    pip:
+      name: pip
+      extra_args: --upgrade
+      executable: pip3
+
+  - name: Install setuptools Module for Python
+    pip3:
+      name: setuptools
+
+  - name: Install Docker Module for Python
+    pip3:
+      name: docker
+
+  - name: Install Docker compose for Python
+    pip3:
+      name: docker-compose
+

serv-02-dockerbullseye/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

serv-02-dockerbullseye/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - 07docker

serv-02-dockerbullseye/vars/main.yml

@@ -0,0 +1,6 @@
+---
+# vars file for 07docker
+  create_containers: 4
+  default_container_name: docker
+  default_container_image: ubuntu
+  default_container_command: sleep 1d

serv-04-adduser.yml

@@ -0,0 +1,13 @@
+---
+
+ - hosts: all 
+   become: true
+
+   vars_prompt:
+     - name: "userpass"
+       prompt: "Enter password for the new user (ignore if not adding a user)"
+       private: yes
+
+
+   roles:
+     - serv-04-adduser

serv-04-adduser/README

@@ -0,0 +1,6 @@
+1. WE DO NOT create users w/o their SSH key
+2. This is to create user:
+~/ansible-venv/bin/ansible-playbook  -i hosts serv-04-adduser.yml -eusername=pavel -euserkey=pavel.pub -euseraction=add --limit=sterver01 -K
+3. This is to remove user
+~/ansible-venv/bin/ansible-playbook  -i hosts serv-04-adduser.yml -eusername=pavel -euseraction=remove --limit=sterver01 -K
+

serv-04-adduser/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

serv-04-adduser/defaults/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# defaults file for serv-04-adduser

serv-04-adduser/files/sshkeys/adminas.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCF3hyP//3VBrF+tr/uF3pTzIvUd8YkPkdnBk9+0kmbKqeYgApMUCqaOezrQHIczBSgrLk8ygY5mjD7Sxs9JpMuxqtnWLK5rZukd5+m4lVe0HmmtaLZLrEYhO9w0WKVl660m3tCuma8pVTLD/WQiiqUQ6HhccWs8L3IhG7tujbMhdc3PYmXPGUGvVny5DFLW7N99nYYO4K43YXHp+u6ofPuxuqjZkpYaDilIKXsXUdq8HOSNz1qVWnYZCfOYqmc2l5AKhACqAbvMexnGMVek1cXw4uA+IHu/fVnjmPTUJrPQf0n29LMMygoZg74Dqnnd8jhdk24vavwF4lumszJ9kGayWEKk0Jf3q5ceet8Q6QgYKU8nXuiGWtDg/WtU2PMJT5Cd4BXbfaKdH1ZKelZbKw6p4Il+XB5pHHwQ8LDbHIAQCbj3514VpvibkhEERYym6nr1Jr9lLMieqOupGPDCIHOW1XwkXNDvxuB4ZOJ5wNrBUka1jexEGHtwbIisvehYTnrnRS5Nkv2gHcDleN0zAyd09w752y1kk7V5M4NLh4PTORO/yKmE+ZdeEiyIu1pirjSab4HbvhF3gnSXqWzq4pTG3JofPgFfMveKyUEwtnTiSPtEpjz6q6Haxg3Lgt2ciO1cX58M5EkAUxU2+qqBvDk/1TsvwZDo65gDRJxISuHCw== ansible@labjump

serv-04-adduser/files/sshkeys/cnms.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC+5WJErVzuukfXzOL/KCi27oQ+RL2wLCZEi+i3OLSou cnms@8devices.com

serv-04-adduser/files/sshkeys/marc.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINRnOcWyYgWQZcZBPvVNzkcfsta+k5kSLRebVL/F86+k marc@ikeja.co.za

serv-04-adduser/files/sshkeys/mikrotik_key2.pub

@@ -0,0 +1,2 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7ut7tytWiBJp8pzYxuDmfiz6pnm+UuYG9xYUFjqAcbYdCvRJHRDwZjj+CIKgjGmh4Lu6OouNgXxWsj/3vtJJvR97hdropEbg9eYyu3YKIn7VJGK/c1Kasoqy0mhRjhoVdQVlE4KEL3h6dXN+dmDD9fvPIARguuJwlayktl1OcfLE0BGMHBwLg9wDzTt2ngWXWdGo+LsH683zKI0m7/N92W+Ryx7d58KC4F9ce4p8mYDtiwhig0fNXenLLVkG033WqfsfpZQVe+hW8C5yketWRZlXCT9KFs0x3Q9J7+itvzRqlDvZy/UNtSj5BAKDIeM9cW/JSRJ3CQD55SjqERd4Z admin
+

serv-04-adduser/files/sshkeys/mindaugas.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAuOyqS81+IuvvkCn/yfFr6NXxrBxHxkeQ7S3x6SRh81 mindaugas@8devices.com

serv-04-adduser/files/sshkeys/pavel.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOyPSe6XOJxzdsr77HU6nZgyGOdI3w16kaxs1Ozq6beY pavel

serv-04-adduser/handlers/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# handlers file for serv-04-adduser

serv-04-adduser/meta/main.yml

@@ -0,0 +1,35 @@
+#SPDX-License-Identifier: MIT-0
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

serv-04-adduser/tasks/main.yml

@@ -0,0 +1,90 @@
+---
+- name: Ensure user exists
+  ansible.builtin.user:
+    name: "{{ username }}"
+    password: "{{ userpass | password_hash('sha512') }}"
+    shell: /bin/bash
+    state: present
+    create_home: yes
+  when: useraction == "add"
+
+- name: Create .ssh directory
+  ansible.builtin.file:
+    path: "/home/{{ username }}/.ssh"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ username }}"
+    mode: '0700'
+  when: useraction == "add"
+
+- name: Upload authorized SSH key
+  ansible.builtin.copy:
+    src: "files/sshkeys/{{ userkey }}"
+    dest: "/home/{{ username }}/.ssh/authorized_keys"
+    owner: "{{ username }}"
+    group: "{{ username }}"
+    mode: '0600'
+  when: useraction == "add"
+
+# REMOVE USER
+#- name: Remove user and home directory
+#  ansible.builtin.user:
+#    name: "{{ username }}"
+#    state: absent
+#    remove: yes
+#  when: useraction == "remove"
+
+- name: Allow {{ username }} to switch to 'docker' user without password
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ username }}-su-docker"
+    content: "{{ username }} ALL=(ALL) NOPASSWD: /bin/su - docker"
+    owner: root
+    group: root
+    mode: '0440'
+  when: useraction == "add"
+
+- name: Find processes owned by the user (initial)
+  ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true"
+  register: user_process_list
+  changed_when: false
+  when: useraction == "remove"
+
+- name: Display processes owned by user before killing
+  ansible.builtin.debug:
+    msg: "{{ item }}"
+  loop: "{{ user_process_list.stdout_lines }}"
+  when: useraction == "remove"
+
+
+- name: Extract PIDs of user processes
+  ansible.builtin.shell: "pgrep -u {{ username }} || true"
+  register: user_pids
+  changed_when: false
+  when: useraction == "remove"
+
+- name: Kill user processes (if any)
+  ansible.builtin.shell: "kill -9 {{ user_pids.stdout_lines | join(' ') }}"
+  when:
+    - useraction == "remove"
+    - user_pids.stdout != ""
+
+- name: Remove user and home directory
+  ansible.builtin.user:
+    name: "{{ username }}"
+    state: absent
+    remove: yes
+  when: useraction == "remove"
+
+- name: List remaining processes for the user (after kill)
+  ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true"
+  register: remaining_procs
+  changed_when: false
+  when: useraction == "remove"
+
+- name: Display remaining processes (manual check)
+  ansible.builtin.debug:
+    msg: |
+      Remaining processes for '{{ username }}' after kill:
+      {{ remaining_procs.stdout | default('None') }}
+  when: useraction == "remove"
+

serv-04-adduser/tests/inventory

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+localhost
+

serv-04-adduser/tests/test.yml

@@ -0,0 +1,6 @@
+#SPDX-License-Identifier: MIT-0
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - serv-04-adduser

serv-04-adduser/vars/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# vars file for serv-04-adduser

serv-05-dockerubuntu24.yml

@@ -0,0 +1,16 @@
+---
+# - name: Pre-IP override setup
+#   hosts: all
+#   gather_facts: false
+#   tasks:
+#     - name: Capture static IP and override ansible_host with ansible_oldip
+#       set_fact:
+#         ansible_newip: "{{ hostvars[inventory_hostname]['ansible_host'] }}"
+#         ansible_host: "{{ ansible_oldip }}"
+#       when: ansible_oldip is defined
+
+ - hosts: all 
+   become: true
+
+   roles:
+     - serv-05-dockerubuntu24

serv-05-dockerubuntu24/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

serv-05-dockerubuntu24/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

serv-05-dockerubuntu24/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for 07docker

serv-05-dockerubuntu24/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for 07docker

serv-05-dockerubuntu24/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

serv-05-dockerubuntu24/tasks/main.yml

@@ -0,0 +1,112 @@
+---
+  - name: Allow user ansible to switch to 'docker' user without password
+    ansible.builtin.copy:
+      dest: "/etc/sudoers.d/ansible-su-docker"
+      content: "ansible ALL=(ALL) NOPASSWD: /bin/su - docker"
+      owner: root
+      group: root
+      mode: '0440'
+
+  - name: Install required system packages
+    apt: name={{ item }} state=latest update_cache=yes
+    loop: [ 'apt-transport-https', 'ca-certificates', 'curl', 'software-properties-common', 'python3-pip', 'virtualenv', 'python3-setuptools', 'python3-pkg-resources']
+
+  - name: Add Docker GPG apt Key
+    apt_key:
+      url: https://download.docker.com/linux/ubuntu/gpg
+      state: present
+
+  - name: Add Docker Repository
+    apt_repository:
+      repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu noble stable
+      state: present
+
+  - name: Update apt and install docker-ce
+    apt: 
+      name: "{{item}}"
+      state: present
+      update_cache: yes
+    with_items:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-buildx-plugin
+      - docker-compose-plugin
+
+  - name: Create docker group
+    group:
+      name: "docker"
+      state: present
+
+  - name: Add docker user with specific attributes
+    user:
+      name: docker
+      system: yes
+      createhome: yes
+      home: /home/docker
+      shell: /usr/sbin/nologin
+
+  - name: Adding user docker to docker group
+    user:
+      name: docker
+      groups: "docker"
+      append: "yes"
+
+  - name: Adding user ansible to docker group
+    user:
+      name: ansible
+      groups: "docker"
+      append: "yes"
+
+  - name: Get Python 3.X version
+    ansible.builtin.command: python3 --version
+    register: pyver
+    changed_when: false
+    failed_when: pyver.rc != 0
+
+  - name: Remove Python 3.X EXTERNALLY-MANAGED file
+    ansible.builtin.file:
+      state: absent
+      path: "/usr/lib/python{{ pyver.stdout.split()[1] | regex_search('([0-9]+\\.[0-9]+)') }}/EXTERNALLY-MANAGED"
+    when: pyver.stdout | regex_search('3\.[0-9]+')
+
+### Keeping it for future ansible control of docker. now it's not needed.
+#  - name: Install and upgrade pip
+#    pip:
+#      name: pip
+#      extra_args: --upgrade
+#      executable: pip3
+
+#  - name: Install setuptools Module for Python
+#    pip:
+#      name: setuptools
+
+#  - name: Install Docker Module for Python
+#    pip:
+#      name: docker
+
+#  - name: Install requests for Python
+#    pip:
+#      name: requests
+#      version: latest
+
+  - name: Ensure Docker is started and enabled
+    ansible.builtin.service:
+      name: docker
+      state: started
+      enabled: true
+
+  - name: Create /opt/containers directory
+    file:
+      path: /opt/containers
+      state: directory
+      owner: docker
+      group: docker
+      mode: '0770'
+
+
+
+#  - name: Install Docker compose for Python
+#    pip:
+#      name: docker-compose
+

serv-05-dockerubuntu24/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

serv-05-dockerubuntu24/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - 07docker

serv-05-dockerubuntu24/vars/main.yml

@@ -0,0 +1,6 @@
+---
+# vars file for 07docker
+  create_containers: 4
+  default_container_name: docker
+  default_container_image: ubuntu
+  default_container_command: sleep 1d