From 896678c27c2cad7408164c8d854c58b02add5307 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Mon, 10 Mar 2025 12:09:58 +0100 Subject: [PATCH 01/41] added redirect service to rup_cluster --- .../first-level-nginx/configs/node.conf | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/dockerized/first-level-nginx/configs/node.conf b/dockerized/first-level-nginx/configs/node.conf index eaadf4e..909ae83 100644 --- a/dockerized/first-level-nginx/configs/node.conf +++ b/dockerized/first-level-nginx/configs/node.conf @@ -18,6 +18,9 @@ http { server swarm1w4.sselab.ddns.net; } + upstream rup_cluster { + server rup1.sselab.ddns.net; + } #TODO manage certs # server { @@ -81,6 +84,26 @@ http { } + server { + listen 80; + server_name reterup.it *.reterup.it; + + location /{ + + #Redirect to simple_app + proxy_pass http://rup_cluster; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_cache_bypass $http_upgrade; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + + } + + #Default Catch-all serving server { listen 80 default_server; From 7ac4137a6799be1285ecd6951dc821b730dd3988 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Mon, 10 Mar 2025 15:42:03 +0100 Subject: [PATCH 02/41] caddy config --- dockerized/nextcloud-aio/Caddyfile | 4 +++ dockerized/nextcloud-aio/certs/cert.pem | 27 +++++++++++++++++++ .../certs/origin_ca_rsa_root.pem | 24 +++++++++++++++++ 3 files changed, 55 insertions(+) create mode 100644 dockerized/nextcloud-aio/Caddyfile create mode 100644 dockerized/nextcloud-aio/certs/cert.pem create mode 100644 dockerized/nextcloud-aio/certs/origin_ca_rsa_root.pem diff --git a/dockerized/nextcloud-aio/Caddyfile b/dockerized/nextcloud-aio/Caddyfile new file mode 100644 index 0000000..199b102 --- /dev/null +++ b/dockerized/nextcloud-aio/Caddyfile @@ -0,0 +1,4 @@ +https://cloud.reterup.it:443 { + header Strict-Transport-Security max-age=31536000; + reverse_proxy localhost:11000 +} \ No newline at end of file diff --git a/dockerized/nextcloud-aio/certs/cert.pem b/dockerized/nextcloud-aio/certs/cert.pem new file mode 100644 index 0000000..90cef19 --- /dev/null +++ b/dockerized/nextcloud-aio/certs/cert.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIIEoDCCA4igAwIBAgIUaKFdbeWJZJZL8wTBpD2DwN+JVkUwDQYJKoZIhvcNAQEL +BQAwgYsxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTQw +MgYDVQQLEytDbG91ZEZsYXJlIE9yaWdpbiBTU0wgQ2VydGlmaWNhdGUgQXV0aG9y +aXR5MRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRMwEQYDVQQIEwpDYWxpZm9ybmlh +MB4XDTI1MDMxMDEzMjIwMFoXDTQwMDMwNjEzMjIwMFowYjEZMBcGA1UEChMQQ2xv +dWRGbGFyZSwgSW5jLjEdMBsGA1UECxMUQ2xvdWRGbGFyZSBPcmlnaW4gQ0ExJjAk +BgNVBAMTHUNsb3VkRmxhcmUgT3JpZ2luIENlcnRpZmljYXRlMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEApmRQ0ujY0sOsuOosqTURUSXeesuU2ZmPTecJ +BmtYRD6z2+0u/eryHke1J8+P8pK7EGV3/TVKCcxJr0NHZiMmysEJKszx5WLDWJgc +ct7uPWlb/Fsk+uep+WXJQwln1rpn2owu9fC8Umk7jvc7S9X3AbrpAjQg0e1oMwQY +OgrbqyWzxjN0KAx3+wNLwBOJt49FZrfL8IqoNu8Fd67kKVJgcw8e+kmRxIOVqJ6M +/GDW4PLsZInfhvcUnd1hbryaXjuIUL7+brV/h4O7AKVp2q8Y8HSsqSbBqlnCBJzw +HhhDJM0huacEmMWOAp95oXkNXcUhOq5XdlxbdYiCz5GLg/4OUwIDAQABo4IBIjCC +AR4wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD +ATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQnBKifvPJehekEum2O83LhMDsirDAf +BgNVHSMEGDAWgBQk6FNXXXw0QIep65TbuuEWePwppDBABggrBgEFBQcBAQQ0MDIw +MAYIKwYBBQUHMAGGJGh0dHA6Ly9vY3NwLmNsb3VkZmxhcmUuY29tL29yaWdpbl9j +YTAjBgNVHREEHDAaggwqLnJldGVydXAuaXSCCnJldGVydXAuaXQwOAYDVR0fBDEw +LzAtoCugKYYnaHR0cDovL2NybC5jbG91ZGZsYXJlLmNvbS9vcmlnaW5fY2EuY3Js +MA0GCSqGSIb3DQEBCwUAA4IBAQByz/7GAw13STwG/WdMCG7Pek2F3HPbsIDzvrQT +0eplFnec/xJCXF8Kb3wI2bQdSSOrFjPzI3a+pDJzxRFIfNWWTVLwcK2ET2jRV6/S +CZWrd9WOZ7Xd4V+irXyvKBOXiHbC35wk6vmTOUbT8BhBMiNRzWnF/bekeLRUPVPD +7en6zC/0/YXLyLogq/Cexr6MZj+oLHKA4hnKzcGQR5quLQPGfyF+YcVecbj3D8iM +VzmKMvIVtH38xfYjCvOHU9+ipl6MpqEjFw94ZRYzzZ5fpe/ObogvDMm4Igd/JiiJ +N/Kv2dPxeeMbJu4WEfjw2WeEJYaIBNy+tPB7gEUB2tLv7Ce1 +-----END CERTIFICATE----- diff --git a/dockerized/nextcloud-aio/certs/origin_ca_rsa_root.pem b/dockerized/nextcloud-aio/certs/origin_ca_rsa_root.pem new file mode 100644 index 0000000..7fbab5b --- /dev/null +++ b/dockerized/nextcloud-aio/certs/origin_ca_rsa_root.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIID+rOSdTGfGcwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNV +BAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTQwMgYDVQQLEytDbG91 +ZEZsYXJlIE9yaWdpbiBTU0wgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRYwFAYDVQQH +Ew1TYW4gRnJhbmNpc2NvMRMwEQYDVQQIEwpDYWxpZm9ybmlhMB4XDTE5MDgyMzIx +MDgwMFoXDTI5MDgxNTE3MDAwMFowgYsxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBD +bG91ZEZsYXJlLCBJbmMuMTQwMgYDVQQLEytDbG91ZEZsYXJlIE9yaWdpbiBTU0wg +Q2VydGlmaWNhdGUgQXV0aG9yaXR5MRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRMw +EQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +AQEAwEiVZ/UoQpHmFsHvk5isBxRehukP8DG9JhFev3WZtG76WoTthvLJFRKFCHXm +V6Z5/66Z4S09mgsUuFwvJzMnE6Ej6yIsYNCb9r9QORa8BdhrkNn6kdTly3mdnykb +OomnwbUfLlExVgNdlP0XoRoeMwbQ4598foiHblO2B/LKuNfJzAMfS7oZe34b+vLB +yrP/1bgCSLdc1AxQc1AC0EsQQhgcyTJNgnG4va1c7ogPlwKyhbDyZ4e59N5lbYPJ +SmXI/cAe3jXj1FBLJZkwnoDKe0v13xeF+nF32smSH0qB7aJX2tBMW4TWtFPmzs5I +lwrFSySWAdwYdgxw180yKU0dvwIDAQABo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD +VR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQUJOhTV118NECHqeuU27rhFnj8KaQw +HwYDVR0jBBgwFoAUJOhTV118NECHqeuU27rhFnj8KaQwDQYJKoZIhvcNAQELBQAD +ggEBAHwOf9Ur1l0Ar5vFE6PNrZWrDfQIMyEfdgSKofCdTckbqXNTiXdgbHs+TWoQ +wAB0pfJDAHJDXOTCWRyTeXOseeOi5Btj5CnEuw3P0oXqdqevM1/+uWp0CM35zgZ8 +VD4aITxity0djzE6Qnx3Syzz+ZkoBgTnNum7d9A66/V636x4vTeqbZFBr9erJzgz +hhurjcoacvRNhnjtDRM0dPeiCJ50CP3wEYuvUzDHUaowOsnLCjQIkWbR7Ni6KEIk +MOz2U0OBSif3FTkhCgZWQKOOLo1P42jHC3ssUZAtVNXrCk3fw9/E15k8NPkBazZ6 +0iykLhH1trywrKRMVw67F44IE8Y= +-----END CERTIFICATE----- From adf2150626fdbbacf96a8482b5cedc1f19abcf6e Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 11 Mar 2025 14:37:15 +0100 Subject: [PATCH 03/41] specified certs --- dockerized/nextcloud-aio/Caddyfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dockerized/nextcloud-aio/Caddyfile b/dockerized/nextcloud-aio/Caddyfile index 199b102..e2188ca 100644 --- a/dockerized/nextcloud-aio/Caddyfile +++ b/dockerized/nextcloud-aio/Caddyfile @@ -1,4 +1,9 @@ https://cloud.reterup.it:443 { + + tls cert.pem privkey.pem { + ca_root origin_ca_rsa_root.pem + } + header Strict-Transport-Security max-age=31536000; reverse_proxy localhost:11000 } \ No newline at end of file From 8cef1d5c17eb4fc474213b35690733dba247226f Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 11 Mar 2025 14:47:12 +0100 Subject: [PATCH 04/41] fixed certs path --- dockerized/nextcloud-aio/Caddyfile | 4 ++-- dockerized/nextcloud-aio/compose.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dockerized/nextcloud-aio/Caddyfile b/dockerized/nextcloud-aio/Caddyfile index e2188ca..5f66352 100644 --- a/dockerized/nextcloud-aio/Caddyfile +++ b/dockerized/nextcloud-aio/Caddyfile @@ -1,7 +1,7 @@ https://cloud.reterup.it:443 { - tls cert.pem privkey.pem { - ca_root origin_ca_rsa_root.pem + tls /root/certs/cert.pem /root/certs/privkey.pem { + ca_root /root/certs/origin_ca_rsa_root.pem } header Strict-Transport-Security max-age=31536000; diff --git a/dockerized/nextcloud-aio/compose.yaml b/dockerized/nextcloud-aio/compose.yaml index a6b1454..07cf9cc 100644 --- a/dockerized/nextcloud-aio/compose.yaml +++ b/dockerized/nextcloud-aio/compose.yaml @@ -9,7 +9,7 @@ services: container_name: caddy volumes: - ./Caddyfile:/etc/caddy/Caddyfile - - ./certs:/certs + - ./certs:/root/certs - ./config:/config - ./data:/data - ./sites:/srv From cae2f9b433a826fd7b99bef93aa5e223dd155aee Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 12 Mar 2025 18:49:32 +0100 Subject: [PATCH 05/41] bare nextcloud aio --- dockerized/nextcloud-aio/compose.yaml | 34 +++++++++++++++------------ 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/dockerized/nextcloud-aio/compose.yaml b/dockerized/nextcloud-aio/compose.yaml index 07cf9cc..3341f79 100644 --- a/dockerized/nextcloud-aio/compose.yaml +++ b/dockerized/nextcloud-aio/compose.yaml @@ -3,17 +3,19 @@ version: "3.8" #Imported from https://github.com/nextcloud/all-in-one/discussions/575#discussion-4055615 services: - caddy: - image: caddy:alpine - restart: unless-stopped - container_name: caddy - volumes: - - ./Caddyfile:/etc/caddy/Caddyfile - - ./certs:/root/certs - - ./config:/config - - ./data:/data - - ./sites:/srv - network_mode: "host" + #caddy: + # image: caddy:alpine + # restart: unless-stopped + # container_name: caddy + # volumes: + # - ./Caddyfile:/etc/caddy/Caddyfile + # - ./certs:/root/certs + # - ./config:/config + # - ./data:/data + # - ./sites:/srv + # network_mode: "host" + + nextcloud: image: nextcloud/all-in-one:latest @@ -21,13 +23,15 @@ services: container_name: nextcloud-aio-mastercontainer ports: - "8080:8080" - environment: - - APACHE_PORT=11000 + - "80:80" + - "8443:8443" + #environment: + # - APACHE_PORT=11000 volumes: - nextcloud_aio_mastercontainer:/mnt/docker-aio-config - /var/run/docker.sock:/var/run/docker.sock:ro - depends_on: - - caddy + #depends_on: + # - caddy volumes: nextcloud_aio_mastercontainer: From bd28fb5fbbdebf59feef52000b0f5d567809327c Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Mon, 17 Mar 2025 14:52:51 +0100 Subject: [PATCH 06/41] first init --- ansible/main-lab/inventory.yaml | 17 +++++++++++++++++ ansible/main-lab/site.yaml | 1 + ansible/rup/site.yaml | 3 +++ 3 files changed, 21 insertions(+) create mode 100644 ansible/main-lab/inventory.yaml create mode 100644 ansible/main-lab/site.yaml create mode 100644 ansible/rup/site.yaml diff --git a/ansible/main-lab/inventory.yaml b/ansible/main-lab/inventory.yaml new file mode 100644 index 0000000..7cd497d --- /dev/null +++ b/ansible/main-lab/inventory.yaml @@ -0,0 +1,17 @@ +all: + children: + lan: + inspector.sselab.ddns.net + god.sselab.ddns.net + enabling: + enabling[1:3].sselab.ddns.net + swarm: + swarm1m[1:3].sselab.ddns.net + swarm1w[1:4].sselab.ddns.net + cluster: + worker[1:3].sselab.ddns.net + front: + edge.sselab.ddns.net + + + diff --git a/ansible/main-lab/site.yaml b/ansible/main-lab/site.yaml new file mode 100644 index 0000000..7903265 --- /dev/null +++ b/ansible/main-lab/site.yaml @@ -0,0 +1 @@ +site.yaml \ No newline at end of file diff --git a/ansible/rup/site.yaml b/ansible/rup/site.yaml new file mode 100644 index 0000000..bf539ca --- /dev/null +++ b/ansible/rup/site.yaml @@ -0,0 +1,3 @@ +all: + children: + rupfront.home.arpa From da6256f4351aa879303ae7db0e4ebcf86650c614 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Mon, 17 Mar 2025 14:56:46 +0100 Subject: [PATCH 07/41] updated base domain --- ansible/main-lab/inventory.yaml | 14 +++++++------- ansible/main-lab/site.yaml | 1 - dockerized/first-level-nginx/configs/node.conf | 10 +++++----- dockerized/simple_site/nginx/config.conf | 2 +- 4 files changed, 13 insertions(+), 14 deletions(-) diff --git a/ansible/main-lab/inventory.yaml b/ansible/main-lab/inventory.yaml index 7cd497d..4f482f3 100644 --- a/ansible/main-lab/inventory.yaml +++ b/ansible/main-lab/inventory.yaml @@ -1,17 +1,17 @@ all: children: lan: - inspector.sselab.ddns.net - god.sselab.ddns.net + inspector.home.arpa + god.home.arpa enabling: - enabling[1:3].sselab.ddns.net + enabling[1:3].home.arpa swarm: - swarm1m[1:3].sselab.ddns.net - swarm1w[1:4].sselab.ddns.net + swarm1m[1:3].home.arpa + swarm1w[1:4].home.arpa cluster: - worker[1:3].sselab.ddns.net + worker[1:3].home.arpa front: - edge.sselab.ddns.net + edge.home.arpa diff --git a/ansible/main-lab/site.yaml b/ansible/main-lab/site.yaml index 7903265..e69de29 100644 --- a/ansible/main-lab/site.yaml +++ b/ansible/main-lab/site.yaml @@ -1 +0,0 @@ -site.yaml \ No newline at end of file diff --git a/dockerized/first-level-nginx/configs/node.conf b/dockerized/first-level-nginx/configs/node.conf index 909ae83..ac5f19d 100644 --- a/dockerized/first-level-nginx/configs/node.conf +++ b/dockerized/first-level-nginx/configs/node.conf @@ -12,14 +12,14 @@ http { # Servers name come from compose definition upstream swarm1_cluster { - server swarm1w1.sselab.ddns.net; - server swarm1w2.sselab.ddns.net; - server swarm1w3.sselab.ddns.net; - server swarm1w4.sselab.ddns.net; + server swarm1w1.home.arpa; + server swarm1w2.home.arpa; + server swarm1w3.home.arpa; + server swarm1w4.home.arpa; } upstream rup_cluster { - server rup1.sselab.ddns.net; + server rup1.home.arpa; } #TODO manage certs diff --git a/dockerized/simple_site/nginx/config.conf b/dockerized/simple_site/nginx/config.conf index 92ccce2..20f0ad4 100644 --- a/dockerized/simple_site/nginx/config.conf +++ b/dockerized/simple_site/nginx/config.conf @@ -38,7 +38,7 @@ http { # Optional server block for HTTP to HTTPS redirection server { listen 80; # Listen on port 80 for HTTP - server_name *.sselab.ddns.net; + server_name *.home.arpa; location / { From 9181d3cce628602361c013fd412609b9731c3f2b Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 18 Mar 2025 18:34:04 +0100 Subject: [PATCH 08/41] First init --- ansible/ansible.cfg | 712 ++++++++++++++++++ ansible/main-lab/ensure-micro.yaml | 2 + ansible/main-lab/ensure-network-acess.yaml | 5 + .../main-lab/inventory/static_inventory.yaml | 29 + ansible/main-lab/roles/common/main.yaml | 0 .../non-infra/inventory/static-inventory.yaml | 0 ansible/readme.md | 31 + ansible/services/rup/site.yaml | 3 + 8 files changed, 782 insertions(+) create mode 100644 ansible/ansible.cfg create mode 100644 ansible/main-lab/ensure-micro.yaml create mode 100644 ansible/main-lab/ensure-network-acess.yaml create mode 100644 ansible/main-lab/inventory/static_inventory.yaml create mode 100644 ansible/main-lab/roles/common/main.yaml create mode 100644 ansible/non-infra/inventory/static-inventory.yaml create mode 100644 ansible/readme.md create mode 100644 ansible/services/rup/site.yaml diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg new file mode 100644 index 0000000..75405af --- /dev/null +++ b/ansible/ansible.cfg @@ -0,0 +1,712 @@ +[defaults] +# (boolean) By default, Ansible will issue a warning when received from a task action (module or action plugin). +# These warnings can be silenced by adjusting this setting to False. +;action_warnings=True + +# (list) Accept a list of cowsay templates that are 'safe' to use, set to an empty list if you want to enable all installed templates. +;cowsay_enabled_stencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www + +# (string) Specify a custom cowsay path or swap in your cowsay implementation of choice. +;cowpath= + +# (string) This allows you to choose a specific cowsay stencil for the banners or use 'random' to cycle through them. +;cow_selection=default + +# (boolean) This option forces color mode even when running without a TTY or the "nocolor" setting is True. +force_color=True + +# (path) The default root path for Ansible config files on the controller. +;home=~/.ansible + +# (boolean) This setting allows suppressing colorizing output, which is used to give a better indication of failure and status information. +;nocolor=False + +# (boolean) If you have cowsay installed but want to avoid the 'cows' (why????), use this. +;nocows=False + +# (boolean) Sets the default value for the any_errors_fatal keyword, if True, Task failures will be considered fatal errors. +;any_errors_fatal=False + +# (path) The password file to use for the become plugin. ``--become-password-file``. +# If executable, it will be run and the resulting stdout will be used as the password. +;become_password_file= + +# (pathspec) Colon-separated paths in which Ansible will search for Become Plugins. +;become_plugins=/Users/fabioisti/.ansible/plugins/become:/usr/share/ansible/plugins/become + +# (string) Chooses which cache plugin to use, the default 'memory' is ephemeral. +;fact_caching=memory + +# (string) Defines connection or path information for the cache plugin. +;fact_caching_connection= + +# (string) Prefix to use for cache plugin files/tables. +;fact_caching_prefix=ansible_facts + +# (integer) Expiration timeout for the cache plugin data. +;fact_caching_timeout=86400 + +# (list) List of enabled callbacks, not all callbacks need enabling, but many of those shipped with Ansible do as we don't want them activated by default. +;callbacks_enabled= + +# (string) When a collection is loaded that does not support the running Ansible version (with the collection metadata key `requires_ansible`). +;collections_on_ansible_version_mismatch=warning + +# (pathspec) Colon-separated paths in which Ansible will search for collections content. Collections must be in nested *subdirectories*, not directly in these directories. For example, if ``COLLECTIONS_PATHS`` includes ``'{{ ANSIBLE_HOME ~ "/collections" }}'``, and you want to add ``my.collection`` to that directory, it must be saved as ``'{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'``. + +;collections_path=/Users/fabioisti/.ansible/collections:/usr/share/ansible/collections + +# (boolean) A boolean to enable or disable scanning the sys.path for installed collections. +;collections_scan_sys_path=True + +# (path) The password file to use for the connection plugin. ``--connection-password-file``. +;connection_password_file= + +# (pathspec) Colon-separated paths in which Ansible will search for Action Plugins. +;action_plugins=/Users/fabioisti/.ansible/plugins/action:/usr/share/ansible/plugins/action + +# (boolean) When enabled, this option allows lookup plugins (whether used in variables as ``{{lookup('foo')}}`` or as a loop as with_foo) to return data that is not marked 'unsafe'. +# By default, such data is marked as unsafe to prevent the templating engine from evaluating any jinja2 templating language, as this could represent a security risk. This option is provided to allow for backward compatibility, however, users should first consider adding allow_unsafe=True to any lookups that may be expected to contain data that may be run through the templating engine late. +;allow_unsafe_lookups=False + +# (boolean) This controls whether an Ansible playbook should prompt for a login password. If using SSH keys for authentication, you probably do not need to change this setting. +;ask_pass=False + +# (boolean) This controls whether an Ansible playbook should prompt for a vault password. +;ask_vault_pass=False + +# (pathspec) Colon-separated paths in which Ansible will search for Cache Plugins. +;cache_plugins=/Users/fabioisti/.ansible/plugins/cache:/usr/share/ansible/plugins/cache + +# (pathspec) Colon-separated paths in which Ansible will search for Callback Plugins. +;callback_plugins=/Users/fabioisti/.ansible/plugins/callback:/usr/share/ansible/plugins/callback + +# (pathspec) Colon-separated paths in which Ansible will search for Cliconf Plugins. +;cliconf_plugins=/Users/fabioisti/.ansible/plugins/cliconf:/usr/share/ansible/plugins/cliconf + +# (pathspec) Colon-separated paths in which Ansible will search for Connection Plugins. +;connection_plugins=/Users/fabioisti/.ansible/plugins/connection:/usr/share/ansible/plugins/connection + +# (boolean) Toggles debug output in Ansible. This is *very* verbose and can hinder multiprocessing. Debug output can also include secret information despite no_log settings being enabled, which means debug mode should not be used in production. +;debug=False + +# (string) This indicates the command to use to spawn a shell under, which is required for Ansible's execution needs on a target. Users may need to change this in rare instances when shell usage is constrained, but in most cases, it may be left as is. +;executable=/bin/sh + +# (pathspec) Colon-separated paths in which Ansible will search for Jinja2 Filter Plugins. +;filter_plugins=/Users/fabioisti/.ansible/plugins/filter:/usr/share/ansible/plugins/filter + +# (boolean) This option controls if notified handlers run on a host even if a failure occurs on that host. +# When false, the handlers will not run if a failure has occurred on a host. +# This can also be set per play or on the command line. See Handlers and Failure for more details. +;force_handlers=False + +# (integer) Maximum number of forks Ansible will use to execute tasks on target hosts. +;forks=5 + +# (string) This setting controls the default policy of fact gathering (facts discovered about remote systems). +# This option can be useful for those wishing to save fact gathering time. Both 'smart' and 'explicit' will use the cache plugin. +;gathering=implicit + +# (string) This setting controls how duplicate definitions of dictionary variables (aka hash, map, associative array) are handled in Ansible. +# This does not affect variables whose values are scalars (integers, strings) or arrays. +# **WARNING**, changing this setting is not recommended as this is fragile and makes your content (plays, roles, collections) nonportable, leading to continual confusion and misuse. Don't change this setting unless you think you have an absolute need for it. +# We recommend avoiding reusing variable names and relying on the ``combine`` filter and ``vars`` and ``varnames`` lookups to create merged versions of the individual variables. In our experience, this is rarely needed and is a sign that too much complexity has been introduced into the data structures and plays. +# For some uses you can also look into custom vars_plugins to merge on input, even substituting the default ``host_group_vars`` that is in charge of parsing the ``host_vars/`` and ``group_vars/`` directories. Most users of this setting are only interested in inventory scope, but the setting itself affects all sources and makes debugging even harder. +# All playbooks and roles in the official examples repos assume the default for this setting. +# Changing the setting to ``merge`` applies across variable sources, but many sources will internally still overwrite the variables. For example ``include_vars`` will dedupe variables internally before updating Ansible, with 'last defined' overwriting previous definitions in same file. +# The Ansible project recommends you **avoid ``merge`` for new projects.** +# It is the intention of the Ansible developers to eventually deprecate and remove this setting, but it is being kept as some users do heavily rely on it. New projects should **avoid 'merge'**. +;hash_behaviour=replace + +# (pathlist) Comma-separated list of Ansible inventory sources +;inventory=/etc/ansible/hosts + +# (pathspec) Colon-separated paths in which Ansible will search for HttpApi Plugins. +;httpapi_plugins=/Users/fabioisti/.ansible/plugins/httpapi:/usr/share/ansible/plugins/httpapi + +# (float) This sets the interval (in seconds) of Ansible internal processes polling each other. Lower values improve performance with large playbooks at the expense of extra CPU load. Higher values are more suitable for Ansible usage in automation scenarios when UI responsiveness is not required but CPU usage might be a concern. +# The default corresponds to the value hardcoded in Ansible <= 2.1 +;internal_poll_interval=0.001 + +# (pathspec) Colon-separated paths in which Ansible will search for Inventory Plugins. +;inventory_plugins=/Users/fabioisti/.ansible/plugins/inventory:/usr/share/ansible/plugins/inventory + +# (string) This is a developer-specific feature that allows enabling additional Jinja2 extensions. +# See the Jinja2 documentation for details. If you do not know what these do, you probably don't need to change this setting :) +;jinja2_extensions=[] + +# (boolean) This option preserves variable types during template operations. +;jinja2_native=False + +# (boolean) Enables/disables the cleaning up of the temporary files Ansible used to execute the tasks on the remote. +# If this option is enabled it will disable ``ANSIBLE_PIPELINING``. +;keep_remote_files=False + +# (boolean) Controls whether callback plugins are loaded when running /usr/bin/ansible. This may be used to log activity from the command line, send notifications, and so on. Callback plugins are always loaded for ``ansible-playbook``. +;bin_ansible_callbacks=False + +# (tmppath) Temporary directory for Ansible to use on the controller. +;local_tmp=/Users/fabioisti/.ansible/tmp + +# (list) List of logger names to filter out of the log file. +;log_filter= + +# (path) File to which Ansible will log on the controller. +# When not set the logging is disabled. +;log_path= + +# (pathspec) Colon-separated paths in which Ansible will search for Lookup Plugins. +;lookup_plugins=/Users/fabioisti/.ansible/plugins/lookup:/usr/share/ansible/plugins/lookup + +# (string) Sets the macro for the 'ansible_managed' variable available for :ref:`ansible_collections.ansible.builtin.template_module` and :ref:`ansible_collections.ansible.windows.win_template_module`. This is only relevant to those two modules. +;ansible_managed=Ansible managed + +# (string) This sets the default arguments to pass to the ``ansible`` adhoc binary if no ``-a`` is specified. +;module_args= + +# (string) Compression scheme to use when transferring Python modules to the target. +;module_compression=ZIP_DEFLATED + +# (string) Module to use with the ``ansible`` AdHoc command, if none is specified via ``-m``. +;module_name=command + +# (pathspec) Colon-separated paths in which Ansible will search for Modules. +;library=/Users/fabioisti/.ansible/plugins/modules:/usr/share/ansible/plugins/modules + +# (pathspec) Colon-separated paths in which Ansible will search for Module utils files, which are shared by modules. +;module_utils=/Users/fabioisti/.ansible/plugins/module_utils:/usr/share/ansible/plugins/module_utils + +# (pathspec) Colon-separated paths in which Ansible will search for Netconf Plugins. +;netconf_plugins=/Users/fabioisti/.ansible/plugins/netconf:/usr/share/ansible/plugins/netconf + +# (boolean) Toggle Ansible's display and logging of task details, mainly used to avoid security disclosures. +;no_log=False + +# (boolean) Toggle Ansible logging to syslog on the target when it executes tasks. On Windows hosts, this will disable a newer style PowerShell modules from writing to the event log. +;no_target_syslog=False + +# (raw) What templating should return as a 'null' value. When not set it will let Jinja2 decide. +;null_representation= + +# (integer) For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how often to check back on the status of those tasks when an explicit poll interval is not supplied. The default is a reasonably moderate 15 seconds which is a tradeoff between checking in frequently and providing a quick turnaround when something may have completed. +;poll_interval=15 + +# (path) Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying ``--private-key`` with every invocation. +;private_key_file= + +# (boolean) By default, imported roles publish their variables to the play and other roles, this setting can avoid that. +# This was introduced as a way to reset role variables to default values if a role is used more than once in a playbook. +# Starting in version '2.17' M(ansible.builtin.include_roles) and M(ansible.builtin.import_roles) can individually override this via the C(public) parameter. +# Included roles only make their variables public at execution, unlike imported roles which happen at playbook compile time. +;private_role_vars=False + +# (integer) Port to use in remote connections, when blank it will use the connection plugin default. +;remote_port= + +# (string) Sets the login user for the target machines +# When blank it uses the connection plugin's default, normally the user currently executing Ansible. +;remote_user= + +# (pathspec) Colon-separated paths in which Ansible will search for Roles. +;roles_path=/Users/fabioisti/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles + +# (string) Set the main callback used to display Ansible output. You can only have one at a time. +# You can have many other callbacks, but just one can be in charge of stdout. +# See :ref:`callback_plugins` for a list of available options. +;stdout_callback=default + +# (string) Set the default strategy used for plays. +;strategy=linear + +# (pathspec) Colon-separated paths in which Ansible will search for Strategy Plugins. +;strategy_plugins=/Users/fabioisti/.ansible/plugins/strategy:/usr/share/ansible/plugins/strategy + +# (boolean) Toggle the use of "su" for tasks. +;su=False + +# (string) Syslog facility to use when Ansible logs to the remote target. +;syslog_facility=LOG_USER + +# (pathspec) Colon-separated paths in which Ansible will search for Terminal Plugins. +;terminal_plugins=/Users/fabioisti/.ansible/plugins/terminal:/usr/share/ansible/plugins/terminal + +# (pathspec) Colon-separated paths in which Ansible will search for Jinja2 Test Plugins. +;test_plugins=/Users/fabioisti/.ansible/plugins/test:/usr/share/ansible/plugins/test + +# (integer) This is the default timeout for connection plugins to use. +;timeout=10 + +# (string) Can be any connection plugin available to your ansible installation. +# There is also a (DEPRECATED) special 'smart' option, that will toggle between 'ssh' and 'paramiko' depending on controller OS and ssh versions. +;transport=ssh + +# (boolean) When True, this causes ansible templating to fail steps that reference variable names that are likely typoed. +# Otherwise, any '{{ template_expression }}' that contains undefined variables will be rendered in a template or ansible action line exactly as written. +;error_on_undefined_vars=True + +# (pathspec) Colon-separated paths in which Ansible will search for Vars Plugins. +;vars_plugins=/Users/fabioisti/.ansible/plugins/vars:/usr/share/ansible/plugins/vars + +# (string) The vault_id to use for encrypting by default. If multiple vault_ids are provided, this specifies which to use for encryption. The ``--encrypt-vault-id`` CLI option overrides the configured value. +;vault_encrypt_identity= + +# (string) The label to use for the default vault id label in cases where a vault id label is not provided. +;vault_identity=default + +# (list) A list of vault-ids to use by default. Equivalent to multiple ``--vault-id`` args. Vault-ids are tried in order. +;vault_identity_list= + +# (string) If true, decrypting vaults with a vault id will only try the password from the matching vault-id. +;vault_id_match=False + +# (path) The vault password file to use. Equivalent to ``--vault-password-file`` or ``--vault-id``. +# If executable, it will be run and the resulting stdout will be used as the password. +;vault_password_file= + +# (integer) Sets the default verbosity, equivalent to the number of ``-v`` passed in the command line. +;verbosity=0 + +# (boolean) Toggle to control the showing of deprecation warnings +;deprecation_warnings=True + +# (boolean) Toggle to control showing warnings related to running devel. +;devel_warning=True + +# (boolean) Normally ``ansible-playbook`` will print a header for each task that is run. These headers will contain the name: field from the task if you specified one. If you didn't then ``ansible-playbook`` uses the task's action to help you tell which task is presently running. Sometimes you run many of the same action and so you want more information about the task to differentiate it from others of the same action. If you set this variable to True in the config then ``ansible-playbook`` will also include the task's arguments in the header. +# This setting defaults to False because there is a chance that you have sensitive values in your parameters and you do not want those to be printed. +# If you set this to True you should be sure that you have secured your environment's stdout (no one can shoulder surf your screen and you aren't saving stdout to an insecure file) or made sure that all of your playbooks explicitly added the ``no_log: True`` parameter to tasks that have sensitive values :ref:`keep_secret_data` for more information. +;display_args_to_stdout=False + +# (boolean) Toggle to control displaying skipped task/host entries in a task in the default callback. +;display_skipped_hosts=True + +# (string) Root docsite URL used to generate docs URLs in warning/error text; must be an absolute URL with a valid scheme and trailing slash. +;docsite_root_url=https://docs.ansible.com/ansible-core/ + +# (pathspec) Colon-separated paths in which Ansible will search for Documentation Fragments Plugins. +;doc_fragment_plugins=/Users/fabioisti/.ansible/plugins/doc_fragments:/usr/share/ansible/plugins/doc_fragments + +# (string) By default, Ansible will issue a warning when a duplicate dict key is encountered in YAML. +# These warnings can be silenced by adjusting this setting to False. +;duplicate_dict_key=warn + +# (string) for the cases in which Ansible needs to return a file within an editor, this chooses the application to use. +;editor=vi + +# (boolean) Whether or not to enable the task debugger, this previously was done as a strategy plugin. +# Now all strategy plugins can inherit this behavior. The debugger defaults to activating when +# a task is failed on unreachable. Use the debugger keyword for more flexibility. +;enable_task_debugger=False + +# (boolean) Toggle to allow missing handlers to become a warning instead of an error when notifying. +;error_on_missing_handler=True + +# (list) Which modules to run during a play's fact gathering stage, using the default of 'smart' will try to figure it out based on connection type. +# If adding your own modules but you still want to use the default Ansible facts, you will want to include 'setup' or corresponding network module to the list (if you add 'smart', Ansible will also figure it out). +# This does not affect explicit calls to the 'setup' module, but does always affect the 'gather_facts' action (implicit or explicit). +;facts_modules=smart + +# (boolean) Set this to "False" if you want to avoid host key checking by the underlying connection plugin Ansible uses to connect to the host. +# Please read the documentation of the specific connection plugin used for details. +host_key_checking=False + +# (boolean) Facts are available inside the `ansible_facts` variable, this setting also pushes them as their own vars in the main namespace. +# Unlike inside the `ansible_facts` dictionary where the prefix `ansible_` is removed from fact names, these will have the exact names that are returned by the module. +;inject_facts_as_vars=True + +# (string) Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are ``auto`` (the default), ``auto_silent``, ``auto_legacy``, and ``auto_legacy_silent``. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting ``auto_silent`` or ``auto_legacy_silent``. The value of ``auto_legacy`` provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to ``/usr/bin/python``, will use that interpreter if present. +;interpreter_python=auto + +# (boolean) If 'false', invalid attributes for a task will result in warnings instead of errors. +;invalid_task_attribute_failed=True + +# (boolean) By default, Ansible will issue a warning when there are no hosts in the inventory. +# These warnings can be silenced by adjusting this setting to False. +;localhost_warning=True + +# (int) This will set log verbosity if higher than the normal display verbosity, otherwise it will match that. +;log_verbosity= + +# (int) Maximum size of files to be considered for diff display. +;max_diff_size=104448 + +# (list) List of extensions to ignore when looking for modules to load. +# This is for rejecting script and binary module fallback extensions. +;module_ignore_exts=.pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, .rst, .yaml, .yml, .ini + +# (bool) Enables whether module responses are evaluated for containing non-UTF-8 data. +# Disabling this may result in unexpected behavior. +# Only ansible-core should evaluate this configuration. +;module_strict_utf8_response=True + +# (list) TODO: write it +;network_group_modules=eos, nxos, ios, iosxr, junos, enos, ce, vyos, sros, dellos9, dellos10, dellos6, asa, aruba, aireos, bigip, ironware, onyx, netconf, exos, voss, slxos + +# (boolean) Previously Ansible would only clear some of the plugin loading caches when loading new roles, this led to some behaviors in which a plugin loaded in previous plays would be unexpectedly 'sticky'. This setting allows the user to return to that behavior. +;old_plugin_cache_clear=False + +# (string) for the cases in which Ansible needs to return output in a pageable fashion, this chooses the application to use. +;pager=less + +# (path) A number of non-playbook CLIs have a ``--playbook-dir`` argument; this sets the default value for it. +;playbook_dir= + +# (string) This sets which playbook dirs will be used as a root to process vars plugins, which includes finding host_vars/group_vars. +;playbook_vars_root=top + +# (path) A path to configuration for filtering which plugins installed on the system are allowed to be used. +# See :ref:`plugin_filtering_config` for details of the filter file's format. +# The default is /etc/ansible/plugin_filters.yml +;plugin_filters_cfg= + +# (string) Attempts to set RLIMIT_NOFILE soft limit to the specified value when executing Python modules (can speed up subprocess usage on Python 2.x. See https://bugs.python.org/issue11284). The value will be limited by the existing hard limit. Default value of 0 does not attempt to adjust existing system-defined limits. +;python_module_rlimit_nofile=0 + +# (bool) This controls whether a failed Ansible playbook should create a .retry file. +;retry_files_enabled=False + +# (path) This sets the path in which Ansible will save .retry files when a playbook fails and retry files are enabled. +# This file will be overwritten after each run with the list of failed hosts from all plays. +;retry_files_save_path= + +# (str) This setting can be used to optimize vars_plugin usage depending on the user's inventory size and play selection. +;run_vars_plugins=demand + +# (bool) This adds the custom stats set via the set_stats plugin to the default output. +;show_custom_stats=False + +# (string) Action to take when a module parameter value is converted to a string (this does not affect variables). For string parameters, values such as '1.00', "['a', 'b',]", and 'yes', 'y', etc. will be converted by the YAML parser unless fully quoted. +# Valid options are 'error', 'warn', and 'ignore'. +# Since 2.8, this option defaults to 'warn' but will change to 'error' in 2.12. +;string_conversion_action=warn + +# (boolean) Allows disabling of warnings related to potential issues on the system running Ansible itself (not on the managed hosts). +# These may include warnings about third-party packages or other conditions that should be resolved if possible. +;system_warnings=True + +# (string) A string to insert into target logging for tracking purposes +;target_log_info= + +# (boolean) This option defines whether the task debugger will be invoked on a failed task when ignore_errors=True is specified. +# True specifies that the debugger will honor ignore_errors, and False will not honor ignore_errors. +;task_debugger_ignore_errors=True + +# (integer) Set the maximum time (in seconds) for a task action to execute in. +# Timeout runs independently from templating or looping. It applies per each attempt of executing the task's action and remains unchanged by the total time spent on a task. +# When the action execution exceeds the timeout, Ansible interrupts the process. This is registered as a failure due to outside circumstances, not a task failure, to receive appropriate response and recovery process. +# If set to 0 (the default) there is no timeout. +;task_timeout=0 + +# (string) Make ansible transform invalid characters in group names supplied by inventory sources. +;force_valid_group_names=never + +# (boolean) Toggles the use of persistence for connections. +;use_persistent_connections=False + +# (bool) A toggle to disable validating a collection's 'metadata' entry for a module_defaults action group. Metadata containing unexpected fields or value types will produce a warning when this is True. +;validate_action_group_metadata=True + +# (list) Accept list for variable plugins that require it. +;vars_plugins_enabled=host_group_vars + +# (list) Allows to change the group variable precedence merge order. +;precedence=all_inventory, groups_inventory, all_plugins_inventory, all_plugins_play, groups_plugins_inventory, groups_plugins_play + +# (string) The salt to use for the vault encryption. If it is not provided, a random salt will be used. +;vault_encrypt_salt= + +# (bool) Force 'verbose' option to use stderr instead of stdout +;verbose_to_stderr=False + +# (integer) For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how long, in seconds, to wait for the task spawned by Ansible to connect back to the named pipe used on Windows systems. The default is 5 seconds. This can be too low on slower systems, or systems under heavy load. +# This is not the total time an async command can run for, but is a separate timeout to wait for an async command to start. The task will only start to be timed against its async_timeout once it has connected to the pipe, so the overall maximum duration the task can take will be extended by the amount specified here. +;win_async_startup_timeout=5 + +# (list) Check all of these extensions when looking for 'variable' files which should be YAML or JSON or vaulted versions of these. +# This affects vars_files, include_vars, inventory and vars plugins among others. +;yaml_valid_extensions=.yml, .yaml, .json + + +[privilege_escalation] +# (boolean) Display an agnostic become prompt instead of displaying a prompt containing the command line supplied become method. +;agnostic_become_prompt=True + +# (boolean) When ``False``(default), Ansible will skip using become if the remote user is the same as the become user, as this is normally a redundant operation. In other words root sudo to root. +# If ``True``, this forces Ansible to use the become plugin anyways as there are cases in which this is needed. +;become_allow_same_user=False + +# (boolean) Toggles the use of privilege escalation, allowing you to 'become' another user after login. +;become=False + +# (boolean) Toggle to prompt for privilege escalation password. +;become_ask_pass=False + +# (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH. +;become_exe= + +# (string) Flags to pass to the privilege escalation executable. +;become_flags= + +# (string) Privilege escalation method to use when `become` is enabled. +;become_method=sudo + +# (string) The user your login/remote user 'becomes' when using privilege escalation, most systems will use 'root' when no user is specified. +;become_user=root + + +[persistent_connection] +# (path) Specify where to look for the ansible-connection script. This location will be checked before searching $PATH. +# If null, ansible will start with the same directory as the ansible script. +;ansible_connection_path= + +# (int) This controls the amount of time to wait for a response from a remote device before timing out a persistent connection. +;command_timeout=30 + +# (integer) This controls the retry timeout for persistent connection to connect to the local domain socket. +;connect_retry_timeout=15 + +# (integer) This controls how long the persistent connection will remain idle before it is destroyed. +;connect_timeout=30 + +# (path) Path to the socket to be used by the connection persistence system. +;control_path_dir=/Users/fabioisti/.ansible/pc + + +[connection] +# (boolean) This is a global option, each connection plugin can override either by having more specific options or not supporting pipelining at all. +# Pipelining, if supported by the connection plugin, reduces the number of network operations required to execute a module on the remote server, by executing many Ansible modules without actual file transfer. +# It can result in a very significant performance improvement when enabled. +# However this conflicts with privilege escalation (become). For example, when using 'sudo:' operations you must first disable 'requiretty' in /etc/sudoers on all managed hosts, which is why it is disabled by default. +# This setting will be disabled if ``ANSIBLE_KEEP_REMOTE_FILES`` is enabled. +;pipelining=False + + +[colors] +# (string) Defines the color to use on 'Changed' task status. +;changed=yellow + +# (string) Defines the default color to use for ansible-console. +;console_prompt=white + +# (string) Defines the color to use when emitting debug messages. +;debug=dark gray + +# (string) Defines the color to use when emitting deprecation messages. +;deprecate=purple + +# (string) Defines the color to use when showing added lines in diffs. +;diff_add=green + +# (string) Defines the color to use when showing diffs. +;diff_lines=cyan + +# (string) Defines the color to use when showing removed lines in diffs. +;diff_remove=red + +# (string) Defines the color to use when emitting a constant in the ansible-doc output. +;doc_constant=dark gray + +# (string) Defines the color to use when emitting a deprecated value in the ansible-doc output. +;doc_deprecated=magenta + +# (string) Defines the color to use when emitting a link in the ansible-doc output. +;doc_link=cyan + +# (string) Defines the color to use when emitting a module name in the ansible-doc output. +;doc_module=yellow + +# (string) Defines the color to use when emitting a plugin name in the ansible-doc output. +;doc_plugin=yellow + +# (string) Defines the color to use when emitting cross-reference in the ansible-doc output. +;doc_reference=magenta + +# (string) Defines the color to use when emitting error messages. +;error=red + +# (string) Defines the color to use for highlighting. +;highlight=white + +# (string) Defines the color to use when showing 'Included' task status. +;included=cyan + +# (string) Defines the color to use when showing 'OK' task status. +;ok=green + +# (string) Defines the color to use when showing 'Skipped' task status. +;skip=cyan + +# (string) Defines the color to use on 'Unreachable' status. +;unreachable=bright red + +# (string) Defines the color to use when emitting verbose messages. In other words, those that show with '-v's. +;verbose=blue + +# (string) Defines the color to use when emitting warning messages. +;warn=bright purple + + +[selinux] +# (boolean) This setting causes libvirt to connect to LXC containers by passing ``--noseclabel`` parameter to ``virsh`` command. This is necessary when running on systems which do not have SELinux. +;libvirt_lxc_noseclabel=False + +# (list) Some filesystems do not support safe operations and/or return inconsistent errors, this setting makes Ansible 'tolerate' those in the list without causing fatal errors. +# Data corruption may occur and writes are not always verified when a filesystem is in the list. +;special_context_filesystems=fuse, nfs, vboxsf, ramfs, 9p, vfat + + +[diff] +# (bool) Configuration toggle to tell modules to show differences when in 'changed' status, equivalent to ``--diff``. +;always=False + +# (integer) Number of lines of context to show when displaying the differences between files. +;context=3 + + +[galaxy] +# (path) The directory that stores cached responses from a Galaxy server. +# This is only used by the ``ansible-galaxy collection install`` and ``download`` commands. +# Cache files inside this dir will be ignored if they are world writable. +;cache_dir=/Users/fabioisti/.ansible/galaxy_cache + +# (bool) whether ``ansible-galaxy collection install`` should warn about ``--collections-path`` missing from configured :ref:`collections_paths`. +;collections_path_warning=True + +# (path) Collection skeleton directory to use as a template for the ``init`` action in ``ansible-galaxy collection``, same as ``--collection-skeleton``. +;collection_skeleton= + +# (list) patterns of files to ignore inside a Galaxy collection skeleton directory. +;collection_skeleton_ignore=^.git$, ^.*/.git_keep$ + +# (bool) Disable GPG signature verification during collection installation. +;disable_gpg_verify=False + +# (bool) Some steps in ``ansible-galaxy`` display a progress wheel which can cause issues on certain displays or when outputting the stdout to a file. +# This config option controls whether the display wheel is shown or not. +# The default is to show the display wheel if stdout has a tty. +;display_progress= + +# (path) Configure the keyring used for GPG signature verification during collection installation and verification. +;gpg_keyring= + +# (boolean) If set to yes, ansible-galaxy will not validate TLS certificates. This can be useful for testing against a server with a self-signed certificate. +;ignore_certs= + +# (list) A list of GPG status codes to ignore during GPG signature verification. See L(https://github.com/gpg/gnupg/blob/master/doc/DETAILS#general-status-codes) for status code descriptions. +# If fewer signatures successfully verify the collection than `GALAXY_REQUIRED_VALID_SIGNATURE_COUNT`, signature verification will fail even if all error codes are ignored. +;ignore_signature_status_codes= + +# (str) The number of signatures that must be successful during GPG signature verification while installing or verifying collections. +# This should be a positive integer or all to indicate all signatures must successfully validate the collection. +# Prepend + to the value to fail if no valid signatures are found for the collection. +;required_valid_signature_count=1 + +# (path) Role skeleton directory to use as a template for the ``init`` action in ``ansible-galaxy``/``ansible-galaxy role``, same as ``--role-skeleton``. +;role_skeleton= + +# (list) patterns of files to ignore inside a Galaxy role or collection skeleton directory. +;role_skeleton_ignore=^.git$, ^.*/.git_keep$ + +# (string) URL to prepend when roles don't specify the full URI, assume they are referencing this server as the source. +;server=https://galaxy.ansible.com + +# (list) A list of Galaxy servers to use when installing a collection. +# The value corresponds to the config ini header ``[galaxy_server.{{item}}]`` which defines the server details. +# See :ref:`galaxy_server_config` for more details on how to define a Galaxy server. +# The order of servers in this list is used as the order in which a collection is resolved. +# Setting this config option will ignore the :ref:`galaxy_server` config option. +;server_list= + +# (int) The default timeout for Galaxy API calls. Galaxy servers that don't configure a specific timeout will fall back to this value. +;server_timeout=60 + +# (path) Local path to galaxy access token file +;token_path=/Users/fabioisti/.ansible/galaxy_token + + +[inventory] +# (string) This setting changes the behaviour of mismatched host patterns, it allows you to force a fatal error, a warning or just ignore it. +;host_pattern_mismatch=warning + +# (boolean) If 'true', it is a fatal error when any given inventory source cannot be successfully parsed by any available inventory plugin; otherwise, this situation only attracts a warning. + +;any_unparsed_is_failed=False + +# (bool) Toggle to turn on inventory caching. +# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`. +# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory configuration. +# This message will be removed in 2.16. +;cache=False + +# (string) The plugin for caching inventory. +# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`. +# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. +# This message will be removed in 2.16. +;cache_plugin= + +# (string) The inventory cache connection. +# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`. +# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. +# This message will be removed in 2.16. +;cache_connection= + +# (string) The table prefix for the cache plugin. +# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`. +# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. +# This message will be removed in 2.16. +;cache_prefix=ansible_inventory_ + +# (string) Expiration timeout for the inventory cache plugin data. +# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`. +# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. +# This message will be removed in 2.16. +;cache_timeout=3600 + +# (list) List of enabled inventory plugins, it also determines the order in which they are used. +;enable_plugins=host_list, script, auto, yaml, ini, toml + +# (bool) Controls if ansible-inventory will accurately reflect Ansible's view into inventory or its optimized for exporting. +;export=False + +# (list) List of extensions to ignore when using a directory as an inventory source. +;ignore_extensions=.pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, .rst, .orig, .ini, .cfg, .retry + +# (list) List of patterns to ignore when using a directory as an inventory source. +;ignore_patterns= + +# (bool) If 'true' it is a fatal error if every single potential inventory source fails to parse, otherwise, this situation will only attract a warning. + +;unparsed_is_failed=False + +# (boolean) By default, Ansible will issue a warning when no inventory was loaded and notes that it will use an implicit localhost-only inventory. +# These warnings can be silenced by adjusting this setting to False. +;inventory_unparsed_warning=True + + +[netconf_connection] +# (string) This variable is used to enable bastion/jump host with netconf connection. If set to True the bastion/jump host ssh settings should be present in ~/.ssh/config file, alternatively it can be set to custom ssh configuration file path to read the bastion/jump host settings. +;ssh_config= + + +[paramiko_connection] +# (boolean) TODO: write it +;host_key_auto_add=False + +# (boolean) TODO: write it +;look_for_keys=True + + +[jinja2] +# (list) This list of filters avoids 'type conversion' when templating variables. +# Useful when you want to avoid conversion into lists or dictionaries for JSON strings, for example. +;dont_type_filters=string, to_json, to_nice_json, to_yaml, to_nice_yaml, ppretty, json + + +[tags] +# (list) default list of tags to run in your plays, Skip Tags has precedence. +;run= + +# (list) default list of tags to skip in your plays, has precedence over Run Tags +;skip= + diff --git a/ansible/main-lab/ensure-micro.yaml b/ansible/main-lab/ensure-micro.yaml new file mode 100644 index 0000000..1744035 --- /dev/null +++ b/ansible/main-lab/ensure-micro.yaml @@ -0,0 +1,2 @@ +--- +- hosts: operators \ No newline at end of file diff --git a/ansible/main-lab/ensure-network-acess.yaml b/ansible/main-lab/ensure-network-acess.yaml new file mode 100644 index 0000000..93bbac2 --- /dev/null +++ b/ansible/main-lab/ensure-network-acess.yaml @@ -0,0 +1,5 @@ +--- +- hosts: all + tasks: + - name: Example from an Ansible Playbook + ansible.builtin.ping: \ No newline at end of file diff --git a/ansible/main-lab/inventory/static_inventory.yaml b/ansible/main-lab/inventory/static_inventory.yaml new file mode 100644 index 0000000..3a21880 --- /dev/null +++ b/ansible/main-lab/inventory/static_inventory.yaml @@ -0,0 +1,29 @@ +all: + children: + lan: + hosts: + inspector.home.arpa: + god.home.arpa: + enabling: + hosts: + enabling[1:3].home.arpa: + swarm: + hosts: + swarm1m[1:3].home.arpa: + swarm1w[1:4].home.arpa: + cluster: + hosts: + worker[1:3].home.arpa: + front: + hosts: + edge.home.arpa: + frontrup.home.arpa: + labs: + hosts: + prox1.home.arpa: + operators: + children: + lan: + enabling: + + diff --git a/ansible/main-lab/roles/common/main.yaml b/ansible/main-lab/roles/common/main.yaml new file mode 100644 index 0000000..e69de29 diff --git a/ansible/non-infra/inventory/static-inventory.yaml b/ansible/non-infra/inventory/static-inventory.yaml new file mode 100644 index 0000000..e69de29 diff --git a/ansible/readme.md b/ansible/readme.md new file mode 100644 index 0000000..405d51c --- /dev/null +++ b/ansible/readme.md @@ -0,0 +1,31 @@ +# Ansible Playbooks + +## Main Lab +Main lab used for experimenting and development [check](main-lab) + +## Non Infra +Management of extra infra nodes [check](non-infra) + +## Templating Lab +Used for final templating [check](templating-lab) + +## Services +Management of infrastructures / services fo third parties [check](services) + + +## TODO +* K8s cluster +* Ensure micro on operating nodes +* Swarm clusters + * Enabling + * Bind + * CEPH storage + * Monitoring + * Nagios + * Swarm 1 + +* GOD + * terraform + * ansible + * puppetmaster + * ... diff --git a/ansible/services/rup/site.yaml b/ansible/services/rup/site.yaml new file mode 100644 index 0000000..bf539ca --- /dev/null +++ b/ansible/services/rup/site.yaml @@ -0,0 +1,3 @@ +all: + children: + rupfront.home.arpa From 5a922524ddc2f1b3e9016a05c842f32fd571b0c3 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 18 Mar 2025 18:37:19 +0100 Subject: [PATCH 09/41] Fixed rupfront hostname --- ansible/main-lab/inventory/static_inventory.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/main-lab/inventory/static_inventory.yaml b/ansible/main-lab/inventory/static_inventory.yaml index 3a21880..9cc5263 100644 --- a/ansible/main-lab/inventory/static_inventory.yaml +++ b/ansible/main-lab/inventory/static_inventory.yaml @@ -17,7 +17,7 @@ all: front: hosts: edge.home.arpa: - frontrup.home.arpa: + rupfront.home.arpa: labs: hosts: prox1.home.arpa: From 961096d1aa21afe45874dabc54636f40b751a5bf Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 4 Apr 2025 12:54:29 +0200 Subject: [PATCH 10/41] First init --- ansible/main-lab/ensure-micro.yaml | 2 - ansible/main-lab/ensure-network-acess.yaml | 5 --- ansible/main-lab/inventory.yaml | 17 --------- .../main-lab/inventory/static_inventory.yaml | 4 +- ansible/main-lab/nodes.yml | 5 +++ .../main-lab/roles/common/defaults/main.yml | 2 + .../roles/common/tasks/basic-check-node.yml | 7 ++++ ansible/main-lab/roles/common/tasks/main.yml | 11 ++++++ ansible/main-lab/roles/docker/README.md | 38 +++++++++++++++++++ .../main-lab/roles/docker/defaults/main.yml | 3 ++ .../main-lab/roles/docker/handlers/main.yml | 3 ++ ansible/main-lab/roles/docker/meta/main.yml | 35 +++++++++++++++++ ansible/main-lab/roles/docker/tasks/main.yml | 3 ++ ansible/main-lab/roles/docker/tests/inventory | 3 ++ ansible/main-lab/roles/docker/tests/test.yml | 6 +++ ansible/main-lab/roles/docker/vars/main.yml | 3 ++ ansible/rup/site.yaml | 3 -- 17 files changed, 122 insertions(+), 28 deletions(-) delete mode 100644 ansible/main-lab/ensure-micro.yaml delete mode 100644 ansible/main-lab/ensure-network-acess.yaml delete mode 100644 ansible/main-lab/inventory.yaml create mode 100644 ansible/main-lab/nodes.yml create mode 100644 ansible/main-lab/roles/common/defaults/main.yml create mode 100644 ansible/main-lab/roles/common/tasks/basic-check-node.yml create mode 100644 ansible/main-lab/roles/common/tasks/main.yml create mode 100644 ansible/main-lab/roles/docker/README.md create mode 100644 ansible/main-lab/roles/docker/defaults/main.yml create mode 100644 ansible/main-lab/roles/docker/handlers/main.yml create mode 100644 ansible/main-lab/roles/docker/meta/main.yml create mode 100644 ansible/main-lab/roles/docker/tasks/main.yml create mode 100644 ansible/main-lab/roles/docker/tests/inventory create mode 100644 ansible/main-lab/roles/docker/tests/test.yml create mode 100644 ansible/main-lab/roles/docker/vars/main.yml delete mode 100644 ansible/rup/site.yaml diff --git a/ansible/main-lab/ensure-micro.yaml b/ansible/main-lab/ensure-micro.yaml deleted file mode 100644 index 1744035..0000000 --- a/ansible/main-lab/ensure-micro.yaml +++ /dev/null @@ -1,2 +0,0 @@ ---- -- hosts: operators \ No newline at end of file diff --git a/ansible/main-lab/ensure-network-acess.yaml b/ansible/main-lab/ensure-network-acess.yaml deleted file mode 100644 index 93bbac2..0000000 --- a/ansible/main-lab/ensure-network-acess.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- hosts: all - tasks: - - name: Example from an Ansible Playbook - ansible.builtin.ping: \ No newline at end of file diff --git a/ansible/main-lab/inventory.yaml b/ansible/main-lab/inventory.yaml deleted file mode 100644 index 4f482f3..0000000 --- a/ansible/main-lab/inventory.yaml +++ /dev/null @@ -1,17 +0,0 @@ -all: - children: - lan: - inspector.home.arpa - god.home.arpa - enabling: - enabling[1:3].home.arpa - swarm: - swarm1m[1:3].home.arpa - swarm1w[1:4].home.arpa - cluster: - worker[1:3].home.arpa - front: - edge.home.arpa - - - diff --git a/ansible/main-lab/inventory/static_inventory.yaml b/ansible/main-lab/inventory/static_inventory.yaml index 9cc5263..0910f4f 100644 --- a/ansible/main-lab/inventory/static_inventory.yaml +++ b/ansible/main-lab/inventory/static_inventory.yaml @@ -1,8 +1,10 @@ all: + vars: + ansible_network_os: community.network.ce children: lan: hosts: - inspector.home.arpa: +# inspector.home.arpa: god.home.arpa: enabling: hosts: diff --git a/ansible/main-lab/nodes.yml b/ansible/main-lab/nodes.yml new file mode 100644 index 0000000..7157975 --- /dev/null +++ b/ansible/main-lab/nodes.yml @@ -0,0 +1,5 @@ +--- +- name: Basic check nodes + hosts: all + roles: + - role: common \ No newline at end of file diff --git a/ansible/main-lab/roles/common/defaults/main.yml b/ansible/main-lab/roles/common/defaults/main.yml new file mode 100644 index 0000000..7480a9e --- /dev/null +++ b/ansible/main-lab/roles/common/defaults/main.yml @@ -0,0 +1,2 @@ +--- +config-flavor: none \ No newline at end of file diff --git a/ansible/main-lab/roles/common/tasks/basic-check-node.yml b/ansible/main-lab/roles/common/tasks/basic-check-node.yml new file mode 100644 index 0000000..a4ab550 --- /dev/null +++ b/ansible/main-lab/roles/common/tasks/basic-check-node.yml @@ -0,0 +1,7 @@ +--- +- name: Check node up + ansible.builtin.ping: + +- name: Check public network access + ansible.netcommon.net_ping: + dest: 8.8.8.8 diff --git a/ansible/main-lab/roles/common/tasks/main.yml b/ansible/main-lab/roles/common/tasks/main.yml new file mode 100644 index 0000000..048646c --- /dev/null +++ b/ansible/main-lab/roles/common/tasks/main.yml @@ -0,0 +1,11 @@ +--- +- name: Ping node + ansible.builtin.ping: + +- name: Check internal DNS + ansible.netcommon.net_ping: + dest: edge.home.arpa + +- name: Check access to WAN + ansible.netcommon.net_ping: + dest: 1.1.1.1 \ No newline at end of file diff --git a/ansible/main-lab/roles/docker/README.md b/ansible/main-lab/roles/docker/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/ansible/main-lab/roles/docker/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/ansible/main-lab/roles/docker/defaults/main.yml b/ansible/main-lab/roles/docker/defaults/main.yml new file mode 100644 index 0000000..6b91042 --- /dev/null +++ b/ansible/main-lab/roles/docker/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker diff --git a/ansible/main-lab/roles/docker/handlers/main.yml b/ansible/main-lab/roles/docker/handlers/main.yml new file mode 100644 index 0000000..cfc4e72 --- /dev/null +++ b/ansible/main-lab/roles/docker/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker diff --git a/ansible/main-lab/roles/docker/meta/main.yml b/ansible/main-lab/roles/docker/meta/main.yml new file mode 100644 index 0000000..36b9858 --- /dev/null +++ b/ansible/main-lab/roles/docker/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/ansible/main-lab/roles/docker/tasks/main.yml b/ansible/main-lab/roles/docker/tasks/main.yml new file mode 100644 index 0000000..797ef6a --- /dev/null +++ b/ansible/main-lab/roles/docker/tasks/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for docker diff --git a/ansible/main-lab/roles/docker/tests/inventory b/ansible/main-lab/roles/docker/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/ansible/main-lab/roles/docker/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/ansible/main-lab/roles/docker/tests/test.yml b/ansible/main-lab/roles/docker/tests/test.yml new file mode 100644 index 0000000..e4f8498 --- /dev/null +++ b/ansible/main-lab/roles/docker/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker diff --git a/ansible/main-lab/roles/docker/vars/main.yml b/ansible/main-lab/roles/docker/vars/main.yml new file mode 100644 index 0000000..286fe09 --- /dev/null +++ b/ansible/main-lab/roles/docker/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker diff --git a/ansible/rup/site.yaml b/ansible/rup/site.yaml deleted file mode 100644 index bf539ca..0000000 --- a/ansible/rup/site.yaml +++ /dev/null @@ -1,3 +0,0 @@ -all: - children: - rupfront.home.arpa From 2e627c8895251029ffdda7ed32027f7f9f6dbf8d Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 4 Apr 2025 15:30:52 +0200 Subject: [PATCH 11/41] facts modules --- ansible/ansible.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg index 75405af..59f3c89 100644 --- a/ansible/ansible.cfg +++ b/ansible/ansible.cfg @@ -305,7 +305,7 @@ force_color=True # (list) Which modules to run during a play's fact gathering stage, using the default of 'smart' will try to figure it out based on connection type. # If adding your own modules but you still want to use the default Ansible facts, you will want to include 'setup' or corresponding network module to the list (if you add 'smart', Ansible will also figure it out). # This does not affect explicit calls to the 'setup' module, but does always affect the 'gather_facts' action (implicit or explicit). -;facts_modules=smart +facts_modules=[smart] # (boolean) Set this to "False" if you want to avoid host key checking by the underlying connection plugin Ansible uses to connect to the host. # Please read the documentation of the specific connection plugin used for details. From a2c4867af62979d0c7ad2e5dc30c2dc55a1227df Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 4 Apr 2025 17:12:03 +0200 Subject: [PATCH 12/41] facts module fix --- ansible/ansible.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg index 59f3c89..5225338 100644 --- a/ansible/ansible.cfg +++ b/ansible/ansible.cfg @@ -305,7 +305,7 @@ force_color=True # (list) Which modules to run during a play's fact gathering stage, using the default of 'smart' will try to figure it out based on connection type. # If adding your own modules but you still want to use the default Ansible facts, you will want to include 'setup' or corresponding network module to the list (if you add 'smart', Ansible will also figure it out). # This does not affect explicit calls to the 'setup' module, but does always affect the 'gather_facts' action (implicit or explicit). -facts_modules=[smart] +facts_modules=smart # (boolean) Set this to "False" if you want to avoid host key checking by the underlying connection plugin Ansible uses to connect to the host. # Please read the documentation of the specific connection plugin used for details. From 5d164ed5f6f6eda502e1bca09894aae146f7ccff Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 4 Apr 2025 17:12:22 +0200 Subject: [PATCH 13/41] interpreter_python set to auto silent --- ansible/ansible.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg index 5225338..16ca9a1 100644 --- a/ansible/ansible.cfg +++ b/ansible/ansible.cfg @@ -316,7 +316,7 @@ host_key_checking=False ;inject_facts_as_vars=True # (string) Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are ``auto`` (the default), ``auto_silent``, ``auto_legacy``, and ``auto_legacy_silent``. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting ``auto_silent`` or ``auto_legacy_silent``. The value of ``auto_legacy`` provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to ``/usr/bin/python``, will use that interpreter if present. -;interpreter_python=auto +interpreter_python=auto_silent # (boolean) If 'false', invalid attributes for a task will result in warnings instead of errors. ;invalid_task_attribute_failed=True From 4dcc0c8b23db94c7c3aa1cc726d7902d75f8218c Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 4 Apr 2025 17:48:54 +0200 Subject: [PATCH 14/41] commented network_os --- ansible/main-lab/inventory/static_inventory.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/main-lab/inventory/static_inventory.yaml b/ansible/main-lab/inventory/static_inventory.yaml index 0910f4f..d9984b8 100644 --- a/ansible/main-lab/inventory/static_inventory.yaml +++ b/ansible/main-lab/inventory/static_inventory.yaml @@ -1,6 +1,6 @@ all: vars: - ansible_network_os: community.network.ce + #ansible_network_os: community.network.ce children: lan: hosts: From 781303f62d5f2225ad9d43871dd143d09e45c18c Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 4 Apr 2025 17:49:23 +0200 Subject: [PATCH 15/41] Basic connectivity checks --- ansible/main-lab/nodes.yml | 4 ++-- .../main-lab/roles/common/tasks/basic-check-node.yml | 7 ------- ansible/main-lab/roles/common/tasks/connectivity.yml | 9 +++++++++ ansible/main-lab/roles/common/tasks/main.yml | 11 +---------- 4 files changed, 12 insertions(+), 19 deletions(-) delete mode 100644 ansible/main-lab/roles/common/tasks/basic-check-node.yml create mode 100644 ansible/main-lab/roles/common/tasks/connectivity.yml diff --git a/ansible/main-lab/nodes.yml b/ansible/main-lab/nodes.yml index 7157975..3e4c871 100644 --- a/ansible/main-lab/nodes.yml +++ b/ansible/main-lab/nodes.yml @@ -1,5 +1,5 @@ --- - name: Basic check nodes hosts: all - roles: - - role: common \ No newline at end of file + roles: + - common \ No newline at end of file diff --git a/ansible/main-lab/roles/common/tasks/basic-check-node.yml b/ansible/main-lab/roles/common/tasks/basic-check-node.yml deleted file mode 100644 index a4ab550..0000000 --- a/ansible/main-lab/roles/common/tasks/basic-check-node.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Check node up - ansible.builtin.ping: - -- name: Check public network access - ansible.netcommon.net_ping: - dest: 8.8.8.8 diff --git a/ansible/main-lab/roles/common/tasks/connectivity.yml b/ansible/main-lab/roles/common/tasks/connectivity.yml new file mode 100644 index 0000000..7023e5e --- /dev/null +++ b/ansible/main-lab/roles/common/tasks/connectivity.yml @@ -0,0 +1,9 @@ +--- +- name: Check node up + ansible.builtin.ping: + +#- name: Check internal DNS +# wait_for: host=edge.home.arpa port=53 timeout=1 + +- name: Check access to Internet + wait_for: host=1.1.1.1 timeout=1 diff --git a/ansible/main-lab/roles/common/tasks/main.yml b/ansible/main-lab/roles/common/tasks/main.yml index 048646c..af4c8ba 100644 --- a/ansible/main-lab/roles/common/tasks/main.yml +++ b/ansible/main-lab/roles/common/tasks/main.yml @@ -1,11 +1,2 @@ --- -- name: Ping node - ansible.builtin.ping: - -- name: Check internal DNS - ansible.netcommon.net_ping: - dest: edge.home.arpa - -- name: Check access to WAN - ansible.netcommon.net_ping: - dest: 1.1.1.1 \ No newline at end of file +- import_tasks: connectivity.yml \ No newline at end of file From 883990176a11bf48a3652592a38fe696d2783b77 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 7 May 2025 13:43:25 +0200 Subject: [PATCH 16/41] Cleanup ansible structure --- .../main-lab/inventory/static_inventory.yaml | 31 --------------- ansible/main-lab/nodes.yml | 5 --- .../main-lab/roles/common/defaults/main.yml | 2 - ansible/main-lab/roles/common/main.yaml | 0 .../roles/common/tasks/connectivity.yml | 9 ----- ansible/main-lab/roles/common/tasks/main.yml | 2 - ansible/main-lab/roles/docker/README.md | 38 ------------------- .../main-lab/roles/docker/defaults/main.yml | 3 -- .../main-lab/roles/docker/handlers/main.yml | 3 -- ansible/main-lab/roles/docker/meta/main.yml | 35 ----------------- ansible/main-lab/roles/docker/tasks/main.yml | 3 -- ansible/main-lab/roles/docker/tests/inventory | 3 -- ansible/main-lab/roles/docker/tests/test.yml | 6 --- ansible/main-lab/roles/docker/vars/main.yml | 3 -- ansible/main-lab/site.yaml | 0 .../non-infra/inventory/static-inventory.yaml | 0 ansible/services/rup/site.yaml | 3 -- 17 files changed, 146 deletions(-) delete mode 100644 ansible/main-lab/inventory/static_inventory.yaml delete mode 100644 ansible/main-lab/nodes.yml delete mode 100644 ansible/main-lab/roles/common/defaults/main.yml delete mode 100644 ansible/main-lab/roles/common/main.yaml delete mode 100644 ansible/main-lab/roles/common/tasks/connectivity.yml delete mode 100644 ansible/main-lab/roles/common/tasks/main.yml delete mode 100644 ansible/main-lab/roles/docker/README.md delete mode 100644 ansible/main-lab/roles/docker/defaults/main.yml delete mode 100644 ansible/main-lab/roles/docker/handlers/main.yml delete mode 100644 ansible/main-lab/roles/docker/meta/main.yml delete mode 100644 ansible/main-lab/roles/docker/tasks/main.yml delete mode 100644 ansible/main-lab/roles/docker/tests/inventory delete mode 100644 ansible/main-lab/roles/docker/tests/test.yml delete mode 100644 ansible/main-lab/roles/docker/vars/main.yml delete mode 100644 ansible/main-lab/site.yaml delete mode 100644 ansible/non-infra/inventory/static-inventory.yaml delete mode 100644 ansible/services/rup/site.yaml diff --git a/ansible/main-lab/inventory/static_inventory.yaml b/ansible/main-lab/inventory/static_inventory.yaml deleted file mode 100644 index d9984b8..0000000 --- a/ansible/main-lab/inventory/static_inventory.yaml +++ /dev/null @@ -1,31 +0,0 @@ -all: - vars: - #ansible_network_os: community.network.ce - children: - lan: - hosts: -# inspector.home.arpa: - god.home.arpa: - enabling: - hosts: - enabling[1:3].home.arpa: - swarm: - hosts: - swarm1m[1:3].home.arpa: - swarm1w[1:4].home.arpa: - cluster: - hosts: - worker[1:3].home.arpa: - front: - hosts: - edge.home.arpa: - rupfront.home.arpa: - labs: - hosts: - prox1.home.arpa: - operators: - children: - lan: - enabling: - - diff --git a/ansible/main-lab/nodes.yml b/ansible/main-lab/nodes.yml deleted file mode 100644 index 3e4c871..0000000 --- a/ansible/main-lab/nodes.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Basic check nodes - hosts: all - roles: - - common \ No newline at end of file diff --git a/ansible/main-lab/roles/common/defaults/main.yml b/ansible/main-lab/roles/common/defaults/main.yml deleted file mode 100644 index 7480a9e..0000000 --- a/ansible/main-lab/roles/common/defaults/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -config-flavor: none \ No newline at end of file diff --git a/ansible/main-lab/roles/common/main.yaml b/ansible/main-lab/roles/common/main.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/main-lab/roles/common/tasks/connectivity.yml b/ansible/main-lab/roles/common/tasks/connectivity.yml deleted file mode 100644 index 7023e5e..0000000 --- a/ansible/main-lab/roles/common/tasks/connectivity.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- name: Check node up - ansible.builtin.ping: - -#- name: Check internal DNS -# wait_for: host=edge.home.arpa port=53 timeout=1 - -- name: Check access to Internet - wait_for: host=1.1.1.1 timeout=1 diff --git a/ansible/main-lab/roles/common/tasks/main.yml b/ansible/main-lab/roles/common/tasks/main.yml deleted file mode 100644 index af4c8ba..0000000 --- a/ansible/main-lab/roles/common/tasks/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -- import_tasks: connectivity.yml \ No newline at end of file diff --git a/ansible/main-lab/roles/docker/README.md b/ansible/main-lab/roles/docker/README.md deleted file mode 100644 index 225dd44..0000000 --- a/ansible/main-lab/roles/docker/README.md +++ /dev/null @@ -1,38 +0,0 @@ -Role Name -========= - -A brief description of the role goes here. - -Requirements ------------- - -Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. - -Role Variables --------------- - -A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. - -Dependencies ------------- - -A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. - -Example Playbook ----------------- - -Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: - - - hosts: servers - roles: - - { role: username.rolename, x: 42 } - -License -------- - -BSD - -Author Information ------------------- - -An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/ansible/main-lab/roles/docker/defaults/main.yml b/ansible/main-lab/roles/docker/defaults/main.yml deleted file mode 100644 index 6b91042..0000000 --- a/ansible/main-lab/roles/docker/defaults/main.yml +++ /dev/null @@ -1,3 +0,0 @@ -#SPDX-License-Identifier: MIT-0 ---- -# defaults file for docker diff --git a/ansible/main-lab/roles/docker/handlers/main.yml b/ansible/main-lab/roles/docker/handlers/main.yml deleted file mode 100644 index cfc4e72..0000000 --- a/ansible/main-lab/roles/docker/handlers/main.yml +++ /dev/null @@ -1,3 +0,0 @@ -#SPDX-License-Identifier: MIT-0 ---- -# handlers file for docker diff --git a/ansible/main-lab/roles/docker/meta/main.yml b/ansible/main-lab/roles/docker/meta/main.yml deleted file mode 100644 index 36b9858..0000000 --- a/ansible/main-lab/roles/docker/meta/main.yml +++ /dev/null @@ -1,35 +0,0 @@ -#SPDX-License-Identifier: MIT-0 -galaxy_info: - author: your name - description: your role description - company: your company (optional) - - # If the issue tracker for your role is not on github, uncomment the - # next line and provide a value - # issue_tracker_url: http://example.com/issue/tracker - - # Choose a valid license ID from https://spdx.org - some suggested licenses: - # - BSD-3-Clause (default) - # - MIT - # - GPL-2.0-or-later - # - GPL-3.0-only - # - Apache-2.0 - # - CC-BY-4.0 - license: license (GPL-2.0-or-later, MIT, etc) - - min_ansible_version: 2.1 - - # If this a Container Enabled role, provide the minimum Ansible Container version. - # min_ansible_container_version: - - galaxy_tags: [] - # List tags for your role here, one per line. A tag is a keyword that describes - # and categorizes the role. Users find roles by searching for tags. Be sure to - # remove the '[]' above, if you add tags to this list. - # - # NOTE: A tag is limited to a single word comprised of alphanumeric characters. - # Maximum 20 tags per role. - -dependencies: [] - # List your role dependencies here, one per line. Be sure to remove the '[]' above, - # if you add dependencies to this list. diff --git a/ansible/main-lab/roles/docker/tasks/main.yml b/ansible/main-lab/roles/docker/tasks/main.yml deleted file mode 100644 index 797ef6a..0000000 --- a/ansible/main-lab/roles/docker/tasks/main.yml +++ /dev/null @@ -1,3 +0,0 @@ -#SPDX-License-Identifier: MIT-0 ---- -# tasks file for docker diff --git a/ansible/main-lab/roles/docker/tests/inventory b/ansible/main-lab/roles/docker/tests/inventory deleted file mode 100644 index 03ca42f..0000000 --- a/ansible/main-lab/roles/docker/tests/inventory +++ /dev/null @@ -1,3 +0,0 @@ -#SPDX-License-Identifier: MIT-0 -localhost - diff --git a/ansible/main-lab/roles/docker/tests/test.yml b/ansible/main-lab/roles/docker/tests/test.yml deleted file mode 100644 index e4f8498..0000000 --- a/ansible/main-lab/roles/docker/tests/test.yml +++ /dev/null @@ -1,6 +0,0 @@ -#SPDX-License-Identifier: MIT-0 ---- -- hosts: localhost - remote_user: root - roles: - - docker diff --git a/ansible/main-lab/roles/docker/vars/main.yml b/ansible/main-lab/roles/docker/vars/main.yml deleted file mode 100644 index 286fe09..0000000 --- a/ansible/main-lab/roles/docker/vars/main.yml +++ /dev/null @@ -1,3 +0,0 @@ -#SPDX-License-Identifier: MIT-0 ---- -# vars file for docker diff --git a/ansible/main-lab/site.yaml b/ansible/main-lab/site.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/non-infra/inventory/static-inventory.yaml b/ansible/non-infra/inventory/static-inventory.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/services/rup/site.yaml b/ansible/services/rup/site.yaml deleted file mode 100644 index bf539ca..0000000 --- a/ansible/services/rup/site.yaml +++ /dev/null @@ -1,3 +0,0 @@ -all: - children: - rupfront.home.arpa From 773256edec3fe8cc20db04e3698c1e6c761b5d17 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 7 May 2025 14:00:22 +0200 Subject: [PATCH 17/41] Cleanup ansible structure --- .../externals/static_inventory.yml | 8 ++++ .../host_vars/inspector.home.arpa.yml | 1 + .../main-lab/static_inventory.yaml | 30 +++++++++++++++ ansible/inventories/services/rup/site.yaml | 3 ++ ansible/nodes.yml | 5 +++ ansible/roles/common/defaults/main.yml | 2 + ansible/roles/common/tasks/connectivity.yml | 9 +++++ ansible/roles/common/tasks/main.yml | 2 + ansible/roles/docker/README.md | 38 +++++++++++++++++++ ansible/roles/docker/defaults/main.yml | 3 ++ ansible/roles/docker/handlers/main.yml | 3 ++ ansible/roles/docker/meta/main.yml | 35 +++++++++++++++++ ansible/roles/docker/tasks/main.yml | 3 ++ ansible/roles/docker/tests/inventory | 3 ++ ansible/roles/docker/tests/test.yml | 6 +++ ansible/roles/docker/vars/main.yml | 3 ++ ansible/site.yaml | 0 cloud-init/cloud-init.cfg | 12 ++++++ 18 files changed, 166 insertions(+) create mode 100644 ansible/inventories/externals/static_inventory.yml create mode 100644 ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml create mode 100644 ansible/inventories/main-lab/static_inventory.yaml create mode 100644 ansible/inventories/services/rup/site.yaml create mode 100644 ansible/nodes.yml create mode 100644 ansible/roles/common/defaults/main.yml create mode 100644 ansible/roles/common/tasks/connectivity.yml create mode 100644 ansible/roles/common/tasks/main.yml create mode 100644 ansible/roles/docker/README.md create mode 100644 ansible/roles/docker/defaults/main.yml create mode 100644 ansible/roles/docker/handlers/main.yml create mode 100644 ansible/roles/docker/meta/main.yml create mode 100644 ansible/roles/docker/tasks/main.yml create mode 100644 ansible/roles/docker/tests/inventory create mode 100644 ansible/roles/docker/tests/test.yml create mode 100644 ansible/roles/docker/vars/main.yml create mode 100644 ansible/site.yaml create mode 100644 cloud-init/cloud-init.cfg diff --git a/ansible/inventories/externals/static_inventory.yml b/ansible/inventories/externals/static_inventory.yml new file mode 100644 index 0000000..10e1973 --- /dev/null +++ b/ansible/inventories/externals/static_inventory.yml @@ -0,0 +1,8 @@ +all: + children: + rup: + hosts: + cloud.reterup.it + liquid + rup1 + rupfront \ No newline at end of file diff --git a/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml b/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml new file mode 100644 index 0000000..09a0dab --- /dev/null +++ b/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml @@ -0,0 +1 @@ +----TODO set user \ No newline at end of file diff --git a/ansible/inventories/main-lab/static_inventory.yaml b/ansible/inventories/main-lab/static_inventory.yaml new file mode 100644 index 0000000..6028807 --- /dev/null +++ b/ansible/inventories/main-lab/static_inventory.yaml @@ -0,0 +1,30 @@ +all: + vars: + #ansible_network_os: community.network.ce + children: + lan: + hosts: + inspector.home.arpa: + god.home.arpa: + enabling: + hosts: + enabling[1:3].home.arpa: + swarm: + hosts: + swarm1m[1:3].home.arpa: + swarm1w[1:4].home.arpa: + cluster: + hosts: + worker[1:3].home.arpa: + front: + hosts: + edge.home.arpa: + labs: + hosts: + prox1.home.arpa: + operators: + children: + lan: + enabling: + + diff --git a/ansible/inventories/services/rup/site.yaml b/ansible/inventories/services/rup/site.yaml new file mode 100644 index 0000000..bf539ca --- /dev/null +++ b/ansible/inventories/services/rup/site.yaml @@ -0,0 +1,3 @@ +all: + children: + rupfront.home.arpa diff --git a/ansible/nodes.yml b/ansible/nodes.yml new file mode 100644 index 0000000..3e4c871 --- /dev/null +++ b/ansible/nodes.yml @@ -0,0 +1,5 @@ +--- +- name: Basic check nodes + hosts: all + roles: + - common \ No newline at end of file diff --git a/ansible/roles/common/defaults/main.yml b/ansible/roles/common/defaults/main.yml new file mode 100644 index 0000000..7480a9e --- /dev/null +++ b/ansible/roles/common/defaults/main.yml @@ -0,0 +1,2 @@ +--- +config-flavor: none \ No newline at end of file diff --git a/ansible/roles/common/tasks/connectivity.yml b/ansible/roles/common/tasks/connectivity.yml new file mode 100644 index 0000000..7023e5e --- /dev/null +++ b/ansible/roles/common/tasks/connectivity.yml @@ -0,0 +1,9 @@ +--- +- name: Check node up + ansible.builtin.ping: + +#- name: Check internal DNS +# wait_for: host=edge.home.arpa port=53 timeout=1 + +- name: Check access to Internet + wait_for: host=1.1.1.1 timeout=1 diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml new file mode 100644 index 0000000..af4c8ba --- /dev/null +++ b/ansible/roles/common/tasks/main.yml @@ -0,0 +1,2 @@ +--- +- import_tasks: connectivity.yml \ No newline at end of file diff --git a/ansible/roles/docker/README.md b/ansible/roles/docker/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/ansible/roles/docker/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/ansible/roles/docker/defaults/main.yml b/ansible/roles/docker/defaults/main.yml new file mode 100644 index 0000000..6b91042 --- /dev/null +++ b/ansible/roles/docker/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker diff --git a/ansible/roles/docker/handlers/main.yml b/ansible/roles/docker/handlers/main.yml new file mode 100644 index 0000000..cfc4e72 --- /dev/null +++ b/ansible/roles/docker/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker diff --git a/ansible/roles/docker/meta/main.yml b/ansible/roles/docker/meta/main.yml new file mode 100644 index 0000000..36b9858 --- /dev/null +++ b/ansible/roles/docker/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/ansible/roles/docker/tasks/main.yml b/ansible/roles/docker/tasks/main.yml new file mode 100644 index 0000000..797ef6a --- /dev/null +++ b/ansible/roles/docker/tasks/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for docker diff --git a/ansible/roles/docker/tests/inventory b/ansible/roles/docker/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/ansible/roles/docker/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/ansible/roles/docker/tests/test.yml b/ansible/roles/docker/tests/test.yml new file mode 100644 index 0000000..e4f8498 --- /dev/null +++ b/ansible/roles/docker/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker diff --git a/ansible/roles/docker/vars/main.yml b/ansible/roles/docker/vars/main.yml new file mode 100644 index 0000000..286fe09 --- /dev/null +++ b/ansible/roles/docker/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker diff --git a/ansible/site.yaml b/ansible/site.yaml new file mode 100644 index 0000000..e69de29 diff --git a/cloud-init/cloud-init.cfg b/cloud-init/cloud-init.cfg new file mode 100644 index 0000000..e2a506c --- /dev/null +++ b/cloud-init/cloud-init.cfg @@ -0,0 +1,12 @@ +groups: + - admingroup: [root,sys] + - cloud-users + - docker + +users: + - swarm + - gecos: Docker Swarm user + - primary_group: docker + - passwd: $6$rounds=4096$hCzh4u/Ithq3ZD0p$APkrRjYwcD8y1oNJhmywYy.82OE4LTTL8u42TxL12LfUVDD.keBrlOM4F.wFvRfvEh2RYtOxncP/7XDkPm31E/ + - ssh_authorized_keys: [ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ== fabio@pc-fabio] + - sudo: ALL=(ALL) NOPASSWD:ALL \ No newline at end of file From 7b4c04008da96b37141ed34920fe808bd1ace069 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 7 May 2025 17:21:35 +0200 Subject: [PATCH 18/41] Bootstrap ansible user --- ansible/bootstrap.yml | 37 +++++++++++++++++++ ansible/controller.yml | 1 + .../main-lab/group_vars/all/all.yml | 1 + .../main-lab/group_vars/all/vault.yml | 7 ++++ .../library/templates/ansible_auth_keys.j2 | 1 + ansible/site.yaml | 7 ++++ 6 files changed, 54 insertions(+) create mode 100644 ansible/bootstrap.yml create mode 100644 ansible/controller.yml create mode 100644 ansible/inventories/main-lab/group_vars/all/all.yml create mode 100644 ansible/inventories/main-lab/group_vars/all/vault.yml create mode 100644 ansible/library/templates/ansible_auth_keys.j2 diff --git a/ansible/bootstrap.yml b/ansible/bootstrap.yml new file mode 100644 index 0000000..de82a52 --- /dev/null +++ b/ansible/bootstrap.yml @@ -0,0 +1,37 @@ +- hosts: all + become: yes + tasks: + - name: Add the ansible group + group: + name: ansible + gid: 1100 + state: present + + + + - name: Add the ansible user as a system user + user: + name: ansible + uid: 1100 + group: ansible + # Directly generate hash + # https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/ + password: "{{ ansible_crypted_password | password_hash('sha512') }}" + shell: /bin/bash + system: yes + home: /srv/ansible + state: present + + - name: Set ansible user as sudoer + copy: + content: "ansible ALL = (ALL) NOPASSWD:ALL" + dest: /etc/sudoers.d/ansible + owner: root + group: root + mode: 0440 + + - name: Create the .ssh directory + file: path=/srv/ansible/.ssh owner=ansible group=ansible mode=0700 state=directory + + - name: Add the mandatory ssh keys to the ansible user + template: src=library/templates/ansible_auth_keys.j2 dest=/srv/ansible/.ssh/authorized_keys owner=ansible group=ansible mode=0600 diff --git a/ansible/controller.yml b/ansible/controller.yml new file mode 100644 index 0000000..10f85fa --- /dev/null +++ b/ansible/controller.yml @@ -0,0 +1 @@ +controller.yml \ No newline at end of file diff --git a/ansible/inventories/main-lab/group_vars/all/all.yml b/ansible/inventories/main-lab/group_vars/all/all.yml new file mode 100644 index 0000000..d12e6a6 --- /dev/null +++ b/ansible/inventories/main-lab/group_vars/all/all.yml @@ -0,0 +1 @@ +ansible_user: ansible \ No newline at end of file diff --git a/ansible/inventories/main-lab/group_vars/all/vault.yml b/ansible/inventories/main-lab/group_vars/all/vault.yml new file mode 100644 index 0000000..0999531 --- /dev/null +++ b/ansible/inventories/main-lab/group_vars/all/vault.yml @@ -0,0 +1,7 @@ +$ANSIBLE_VAULT;1.1;AES256 +61393961306333653235623830613237633236393333343663613032653136373237316361643439 +3033653166663836363961663535396631653336653264330a643131393433376239633933613661 +34346235343936313434646533653261653334356239636431323338383538393964313666636233 +6235623436656430390a316639343438366436643935373162613135323034626339393539323433 +36363630643163666632306234386664323166373638353339663563333232663135383531336266 +3231326238326136323536383434383134313739643239623964 diff --git a/ansible/library/templates/ansible_auth_keys.j2 b/ansible/library/templates/ansible_auth_keys.j2 new file mode 100644 index 0000000..c35a1b8 --- /dev/null +++ b/ansible/library/templates/ansible_auth_keys.j2 @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ== fabio@pc-fabio \ No newline at end of file diff --git a/ansible/site.yaml b/ansible/site.yaml index e69de29..cb81818 100644 --- a/ansible/site.yaml +++ b/ansible/site.yaml @@ -0,0 +1,7 @@ +--- +#- import_playbook: dbservers.yml + +- name: Basic check nodes + hosts: all + roles: + - common \ No newline at end of file From eb1b46c8d9292e22a24a65c938c3558882d2e202 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 7 May 2025 18:27:49 +0200 Subject: [PATCH 19/41] Initial setup --- ansible/controller.yml | 3 ++- .../main-lab/host_vars/inspector.home.arpa.yml | 3 ++- ansible/readme.md | 13 +++---------- ansible/roles/docker/tasks/main.yml | 14 ++++++++++++++ ansible/site.yaml | 8 +++----- 5 files changed, 24 insertions(+), 17 deletions(-) diff --git a/ansible/controller.yml b/ansible/controller.yml index 10f85fa..168992f 100644 --- a/ansible/controller.yml +++ b/ansible/controller.yml @@ -1 +1,2 @@ -controller.yml \ No newline at end of file +--- +#- hosts: \ No newline at end of file diff --git a/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml b/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml index 09a0dab..7166053 100644 --- a/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml +++ b/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml @@ -1 +1,2 @@ -----TODO set user \ No newline at end of file +--- +ansible_user: clouseau \ No newline at end of file diff --git a/ansible/readme.md b/ansible/readme.md index 405d51c..c03391e 100644 --- a/ansible/readme.md +++ b/ansible/readme.md @@ -1,18 +1,11 @@ # Ansible Playbooks -## Main Lab +## Inventories +### Main Lab Main lab used for experimenting and development [check](main-lab) - -## Non Infra +### Externals Management of extra infra nodes [check](non-infra) -## Templating Lab -Used for final templating [check](templating-lab) - -## Services -Management of infrastructures / services fo third parties [check](services) - - ## TODO * K8s cluster * Ensure micro on operating nodes diff --git a/ansible/roles/docker/tasks/main.yml b/ansible/roles/docker/tasks/main.yml index 797ef6a..3aba941 100644 --- a/ansible/roles/docker/tasks/main.yml +++ b/ansible/roles/docker/tasks/main.yml @@ -1,3 +1,17 @@ #SPDX-License-Identifier: MIT-0 --- # tasks file for docker +- include_tasks: install.yml + args: + apply: + become: yes +- include_tasks: docker_user.yml + args: + apply: + become: yes + +# - include_tasks: swarm.yml +# args: +# apply: +# become: yes +# become_user: docker diff --git a/ansible/site.yaml b/ansible/site.yaml index cb81818..070496a 100644 --- a/ansible/site.yaml +++ b/ansible/site.yaml @@ -1,7 +1,5 @@ --- #- import_playbook: dbservers.yml - -- name: Basic check nodes - hosts: all - roles: - - common \ No newline at end of file +- import_playbook: nodes.yml +#- import_playbook: controller.yml +- import_playbook: swarms.yml From a339071b1d67ec79cfd9386e87818bfd83fe7c6a Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 7 May 2025 18:28:48 +0200 Subject: [PATCH 20/41] Docker initial config --- .../main-lab/group_vars/all/vault.yml | 14 ++++--- ansible/roles/docker/tasks/docker_user.yml | 24 +++++++++++ ansible/roles/docker/tasks/install.yml | 40 +++++++++++++++++++ ansible/roles/docker/tasks/swarm.yml | 4 ++ ansible/swarms.yml | 6 +++ 5 files changed, 82 insertions(+), 6 deletions(-) create mode 100644 ansible/roles/docker/tasks/docker_user.yml create mode 100644 ansible/roles/docker/tasks/install.yml create mode 100644 ansible/roles/docker/tasks/swarm.yml create mode 100644 ansible/swarms.yml diff --git a/ansible/inventories/main-lab/group_vars/all/vault.yml b/ansible/inventories/main-lab/group_vars/all/vault.yml index 0999531..a6c2122 100644 --- a/ansible/inventories/main-lab/group_vars/all/vault.yml +++ b/ansible/inventories/main-lab/group_vars/all/vault.yml @@ -1,7 +1,9 @@ $ANSIBLE_VAULT;1.1;AES256 -61393961306333653235623830613237633236393333343663613032653136373237316361643439 -3033653166663836363961663535396631653336653264330a643131393433376239633933613661 -34346235343936313434646533653261653334356239636431323338383538393964313666636233 -6235623436656430390a316639343438366436643935373162613135323034626339393539323433 -36363630643163666632306234386664323166373638353339663563333232663135383531336266 -3231326238326136323536383434383134313739643239623964 +39376138666334356631626564333933643938353065356235303636303064353263623831373036 +3461386536336466343665343639643730653838323939370a343737663839623962373065313932 +64623636646335616162633331613835613837336561666530623864346431363338653564323539 +3863656661653538390a623763636564383863643063353364366232663133326235353136626661 +31623736323938663561363562323832373939303637633337626132616530343731343037303062 +66376330613130323331363230626361383137393333326661343239613137386530666237393661 +38303330386663393334323735636637393262616664646536343865613431666234343566616661 +38323163383866353034 diff --git a/ansible/roles/docker/tasks/docker_user.yml b/ansible/roles/docker/tasks/docker_user.yml new file mode 100644 index 0000000..6c7f0f1 --- /dev/null +++ b/ansible/roles/docker/tasks/docker_user.yml @@ -0,0 +1,24 @@ +--- +- name: Add the docker group + group: + name: docker + gid: 1101 + state: present + + +- name: Add the docker user + user: + name: docker + uid: 1101 + group: docker + # Directly generate hash + # https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/ + password: "{{ docker_crypted_password | password_hash('sha512') }}" + shell: /bin/bash + system: yes + home: /srv/docker + state: present + +- name: Reset ssh connection to allow user changes to affect ansible user + ansible.builtin.meta: + reset_connection \ No newline at end of file diff --git a/ansible/roles/docker/tasks/install.yml b/ansible/roles/docker/tasks/install.yml new file mode 100644 index 0000000..5b092bb --- /dev/null +++ b/ansible/roles/docker/tasks/install.yml @@ -0,0 +1,40 @@ +--- +- name: Install aptitude + apt: + name: aptitude + state: latest + update_cache: true + +- name: Install required system packages + apt: + pkg: + - apt-transport-https + - ca-certificates + - curl + - software-properties-common + - python3-pip + - virtualenv + - python3-setuptools + state: latest + update_cache: true + +- name: Add Docker GPG apt Key + apt_key: + url: https://download.docker.com/linux/ubuntu/gpg + state: present + +- name: Add Docker Repository + apt_repository: + repo: deb https://download.docker.com/linux/ubuntu focal stable + state: present + +- name: Update apt and install docker-ce + apt: + name: docker-ce + state: latest + update_cache: true + +- name: Install Docker Module for Python + pip: + name: docker + diff --git a/ansible/roles/docker/tasks/swarm.yml b/ansible/roles/docker/tasks/swarm.yml new file mode 100644 index 0000000..82c51ff --- /dev/null +++ b/ansible/roles/docker/tasks/swarm.yml @@ -0,0 +1,4 @@ +--- +# configure as master if flag +# identify swarm by node variable +become_user: docker \ No newline at end of file diff --git a/ansible/swarms.yml b/ansible/swarms.yml new file mode 100644 index 0000000..bdfdbc0 --- /dev/null +++ b/ansible/swarms.yml @@ -0,0 +1,6 @@ +--- +- name: Configure swarms + hosts: swarm + roles: + - common + - docker \ No newline at end of file From 68b681704b49f665f219927f5bfa6e3810b20e20 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 8 May 2025 14:31:54 +0200 Subject: [PATCH 21/41] Fix docker install --- ansible/roles/docker/tasks/install.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/roles/docker/tasks/install.yml b/ansible/roles/docker/tasks/install.yml index 5b092bb..d25a570 100644 --- a/ansible/roles/docker/tasks/install.yml +++ b/ansible/roles/docker/tasks/install.yml @@ -36,5 +36,6 @@ - name: Install Docker Module for Python pip: + break_system_packages: true name: docker From 0080299b0b68699dc5b79a17fef16782efd0d69a Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 8 May 2025 14:32:04 +0200 Subject: [PATCH 22/41] Fix create docker group --- ansible/roles/docker/tasks/docker_user.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ansible/roles/docker/tasks/docker_user.yml b/ansible/roles/docker/tasks/docker_user.yml index 6c7f0f1..3911360 100644 --- a/ansible/roles/docker/tasks/docker_user.yml +++ b/ansible/roles/docker/tasks/docker_user.yml @@ -1,9 +1,9 @@ --- - name: Add the docker group - group: - name: docker - gid: 1101 - state: present + group: + name: docker + gid: 1101 + state: present - name: Add the docker user From a32eb173834d775a448bace4d1ffc377e4e82d4e Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 8 May 2025 18:01:19 +0200 Subject: [PATCH 23/41] fact cacheing --- ansible/ansible.cfg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg index 16ca9a1..2da7875 100644 --- a/ansible/ansible.cfg +++ b/ansible/ansible.cfg @@ -35,7 +35,7 @@ force_color=True ;become_plugins=/Users/fabioisti/.ansible/plugins/become:/usr/share/ansible/plugins/become # (string) Chooses which cache plugin to use, the default 'memory' is ephemeral. -;fact_caching=memory +fact_caching=memory # (string) Defines connection or path information for the cache plugin. ;fact_caching_connection= @@ -44,7 +44,7 @@ force_color=True ;fact_caching_prefix=ansible_facts # (integer) Expiration timeout for the cache plugin data. -;fact_caching_timeout=86400 +fact_caching_timeout=86400 # (list) List of enabled callbacks, not all callbacks need enabling, but many of those shipped with Ansible do as we don't want them activated by default. ;callbacks_enabled= From aded6b456b823463a57d3a5d25acd83d6ab5f16d Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 8 May 2025 18:01:42 +0200 Subject: [PATCH 24/41] swarm config in inventory --- .../main-lab/static_inventory.yaml | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/ansible/inventories/main-lab/static_inventory.yaml b/ansible/inventories/main-lab/static_inventory.yaml index 6028807..68ff083 100644 --- a/ansible/inventories/main-lab/static_inventory.yaml +++ b/ansible/inventories/main-lab/static_inventory.yaml @@ -6,13 +6,22 @@ all: hosts: inspector.home.arpa: god.home.arpa: - enabling: - hosts: - enabling[1:3].home.arpa: swarm: - hosts: - swarm1m[1:3].home.arpa: - swarm1w[1:4].home.arpa: + children: + enabling: + hosts: + enabling[1:3].home.arpa: + swarm_master: true + swarm_drain: false + vars: + swarm_name: enabling + swarm1: + hosts: + swarm1m[1:3].home.arpa: + swarm_master: true + swarm1w[1:4].home.arpa: + vars: + swarm_name: the_swarm cluster: hosts: worker[1:3].home.arpa: From 3bfd89e1b63108ec8f8c510963006319f61fb272 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 8 May 2025 18:02:11 +0200 Subject: [PATCH 25/41] Swarm config playbook --- ansible/swarms.yml | 144 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 141 insertions(+), 3 deletions(-) diff --git a/ansible/swarms.yml b/ansible/swarms.yml index bdfdbc0..d5f08e5 100644 --- a/ansible/swarms.yml +++ b/ansible/swarms.yml @@ -1,6 +1,144 @@ --- -- name: Configure swarms - hosts: swarm +- name: "Configure swarms" + hosts: swarm1 roles: - common - - docker \ No newline at end of file + - docker + tasks: + - name: "Prepare manager group" + add_host: + hostname: "{{ item }}" + groups: manager_group + with_items: "{{play_hosts}}" + when: hostvars[item]['swarm_master'] + + - name: "Prepare worker group" + add_host: + hostname: "{{ item }}" + groups: worker_group + with_items: "{{play_hosts}}" + when: not hostvars[item]['swarm_master'] + + + +# From https://medium.com/@cantrobot/deploying-docker-swarm-with-ansible-a991c1028427 + +- name: "Gather status of manager nodes" + hosts: manager_group + become_user: docker + tasks: + - name: "Load docker info as facts" + community.docker.docker_container_info: + + - name: "Create swarm_manager_operational group" + add_host: + hostname: "{{ item }}" + groups: swarm_manager_operational + with_items: "{{ play_hosts }}" + when: "'{{ hostvars[item]['docker_info']['Swarm']['LocalNodeState'] }}' == 'active'" + run_once: true + + - name: "Create swarm_manager_bootstrap group" + add_host: + hostname: "{{ item }}" + groups: swarm_manager_bootstrap + with_items: "{{ play_hosts }}" + when: "'{{ hostvars[item]['docker_info']['Swarm']['LocalNodeState'] }}' != 'active'" + run_once: true + + + +- name: "Do the same for workers" + hosts: worker_group + become_user: docker + tasks: + - name: "Load docker info as facts" + community.docker.docker_container_info: + + - name: "Create swarm_worker_operational group" + add_host: + hostname: "{{ item }}" + groups: swarm_worker_operational + with_items: "{{ play_hosts }}" + when: "'{{ hostvars[item]['docker_info']['Swarm']['LocalNodeState'] }}' == 'active'" + run_once: true + + - name: "Create swarm_worker_bootstrap group" + add_host: + hostname: "{{ item }}" + groups: swarm_worker_bootstrap + with_items: "{{ play_hosts }}" + when: "'{{ hostvars[item]['docker_info']['Swarm']['LocalNodeState'] }}' != 'active'" + run_once: true + + + +- name: "Bootstrap the swarm" + hosts: swarm_manager_bootstrap[0] + become_user: docker + tasks: + - name: initialize swarm cluster + shell: > + docker swarm init + --advertise-addr={{ swarm_iface | default('eth0') }}:2377 + when: "'swarm_manager_operational' not in groups" + register: bootstrap_first_node + + - name: add initialized host to swarm_manager_operational group + add_host: + hostname: "{{ play_hosts[0] }}" + groups: swarm_manager_operational + when: bootstrap_first_node | changed + + + +- name: "Retrieve the tokens" + hosts: swarm_manager_operational[0] + become: true + vars: + iface: "{{ swarm_iface | default('eth0') }}" + tasks: + - name: retrieve swarm manager token + shell: docker swarm join-token -q manager + register: swarm_manager_token + + - name: retrieve swarm worker token + shell: docker swarm join-token -q worker + register: swarm_worker_token + + - name: populate list of manager ips + add_host: + hostname: "{{ hostvars[item]['ansible_' + iface]['ipv4']['address'] }}" + groups: swarm_manager_ips + with_items: "{{ play_hosts }}" + + +- name: "Join managers" + # filtered from possible bootstrap + hosts: swarm_manager_bootstrap:!swarm_manager_operational + become: true + vars: + token: "{{ hostvars[groups['swarm_manager_operational'][0]]['swarm_manager_token']['stdout'] }}" + tasks: + - name: join manager nodes to cluster + shell: > + docker swarm join + --advertise-addr={{ swarm_iface | default('eth0') }}:2377 + --token={{ token }} + {{ groups['swarm_manager_ips'][0] }}:2377 + + + +- name: "Join workers" + hosts: swarm_worker_bootstrap + become: true + vars: + token: "{{ hostvars[groups['swarm_manager_operational'][0]]['swarm_worker_token']['stdout'] }}" + tasks: + - name: join worker nodes to cluster + shell: > + docker swarm join + --advertise-addr={{ swarm_iface | default('eth0') }}:2377 + --token={{ token }} + {{ groups['swarm_manager_ips'][0] }}:2377 + From 32f2ece9449ab3a2754c286640d4895f297f2c22 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Fri, 8 Aug 2025 16:28:40 +0200 Subject: [PATCH 26/41] change ansible password only on user creation --- ansible/bootstrap.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ansible/bootstrap.yml b/ansible/bootstrap.yml index de82a52..40abdb1 100644 --- a/ansible/bootstrap.yml +++ b/ansible/bootstrap.yml @@ -17,7 +17,8 @@ # Directly generate hash # https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/ password: "{{ ansible_crypted_password | password_hash('sha512') }}" - shell: /bin/bash + shell: /bin/bash + update_password: on_create system: yes home: /srv/ansible state: present From 35f52d78d0dbd4711645c05179a07d887b2bcb67 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Mon, 11 Aug 2025 18:22:27 +0200 Subject: [PATCH 27/41] Basic setup --- ansible/bootstrap.yml | 6 +-- .../externals/static_inventory.yml | 8 ---- .../main-lab/group_vars/all/all.yml | 1 - .../main-lab/group_vars/all/vault.yml | 9 ----- .../host_vars/inspector.home.arpa.yml | 2 - .../main-lab/static_inventory.yaml | 39 ------------------- ansible/inventories/services/rup/site.yaml | 3 -- ansible/readme.md | 22 +++++++++++ 8 files changed, 25 insertions(+), 65 deletions(-) delete mode 100644 ansible/inventories/externals/static_inventory.yml delete mode 100644 ansible/inventories/main-lab/group_vars/all/all.yml delete mode 100644 ansible/inventories/main-lab/group_vars/all/vault.yml delete mode 100644 ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml delete mode 100644 ansible/inventories/main-lab/static_inventory.yaml delete mode 100644 ansible/inventories/services/rup/site.yaml diff --git a/ansible/bootstrap.yml b/ansible/bootstrap.yml index 40abdb1..76f1e75 100644 --- a/ansible/bootstrap.yml +++ b/ansible/bootstrap.yml @@ -1,5 +1,6 @@ - hosts: all become: yes + debugger: on_failed tasks: - name: Add the ansible group group: @@ -7,8 +8,6 @@ gid: 1100 state: present - - - name: Add the ansible user as a system user user: name: ansible @@ -18,7 +17,8 @@ # https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/ password: "{{ ansible_crypted_password | password_hash('sha512') }}" shell: /bin/bash - update_password: on_create + # Uncomment to prevent password reset + # update_password: on_create system: yes home: /srv/ansible state: present diff --git a/ansible/inventories/externals/static_inventory.yml b/ansible/inventories/externals/static_inventory.yml deleted file mode 100644 index 10e1973..0000000 --- a/ansible/inventories/externals/static_inventory.yml +++ /dev/null @@ -1,8 +0,0 @@ -all: - children: - rup: - hosts: - cloud.reterup.it - liquid - rup1 - rupfront \ No newline at end of file diff --git a/ansible/inventories/main-lab/group_vars/all/all.yml b/ansible/inventories/main-lab/group_vars/all/all.yml deleted file mode 100644 index d12e6a6..0000000 --- a/ansible/inventories/main-lab/group_vars/all/all.yml +++ /dev/null @@ -1 +0,0 @@ -ansible_user: ansible \ No newline at end of file diff --git a/ansible/inventories/main-lab/group_vars/all/vault.yml b/ansible/inventories/main-lab/group_vars/all/vault.yml deleted file mode 100644 index a6c2122..0000000 --- a/ansible/inventories/main-lab/group_vars/all/vault.yml +++ /dev/null @@ -1,9 +0,0 @@ -$ANSIBLE_VAULT;1.1;AES256 -39376138666334356631626564333933643938353065356235303636303064353263623831373036 -3461386536336466343665343639643730653838323939370a343737663839623962373065313932 -64623636646335616162633331613835613837336561666530623864346431363338653564323539 -3863656661653538390a623763636564383863643063353364366232663133326235353136626661 -31623736323938663561363562323832373939303637633337626132616530343731343037303062 -66376330613130323331363230626361383137393333326661343239613137386530666237393661 -38303330386663393334323735636637393262616664646536343865613431666234343566616661 -38323163383866353034 diff --git a/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml b/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml deleted file mode 100644 index 7166053..0000000 --- a/ansible/inventories/main-lab/host_vars/inspector.home.arpa.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -ansible_user: clouseau \ No newline at end of file diff --git a/ansible/inventories/main-lab/static_inventory.yaml b/ansible/inventories/main-lab/static_inventory.yaml deleted file mode 100644 index 68ff083..0000000 --- a/ansible/inventories/main-lab/static_inventory.yaml +++ /dev/null @@ -1,39 +0,0 @@ -all: - vars: - #ansible_network_os: community.network.ce - children: - lan: - hosts: - inspector.home.arpa: - god.home.arpa: - swarm: - children: - enabling: - hosts: - enabling[1:3].home.arpa: - swarm_master: true - swarm_drain: false - vars: - swarm_name: enabling - swarm1: - hosts: - swarm1m[1:3].home.arpa: - swarm_master: true - swarm1w[1:4].home.arpa: - vars: - swarm_name: the_swarm - cluster: - hosts: - worker[1:3].home.arpa: - front: - hosts: - edge.home.arpa: - labs: - hosts: - prox1.home.arpa: - operators: - children: - lan: - enabling: - - diff --git a/ansible/inventories/services/rup/site.yaml b/ansible/inventories/services/rup/site.yaml deleted file mode 100644 index bf539ca..0000000 --- a/ansible/inventories/services/rup/site.yaml +++ /dev/null @@ -1,3 +0,0 @@ -all: - children: - rupfront.home.arpa diff --git a/ansible/readme.md b/ansible/readme.md index c03391e..f553b28 100644 --- a/ansible/readme.md +++ b/ansible/readme.md @@ -1,11 +1,33 @@ # Ansible Playbooks +## Playbooks +##### Bootstrap +Creates user ansible with necessary privileges. Needs become password + +'ansible-playbook -i inventories bootstrap.yml -l nextrup_copy_test -u fabio -K --ask-vault-password' + +##### Nodes +Basic checks connectivity for **all** + + + + ## Inventories + ### Main Lab Main lab used for experimenting and development [check](main-lab) + ### Externals Management of extra infra nodes [check](non-infra) +### Production +Management of production services, beware! + +### Prox1_lab +Prox mox laboratory + + + ## TODO * K8s cluster * Ensure micro on operating nodes From d09c8a5b420d503b7cca1b4423290e75a4b7f0cd Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 12 Aug 2025 15:39:48 +0200 Subject: [PATCH 28/41] Inventory init --- ansible/inventories/externals.yml | 9 +++++ ansible/inventories/group_vars/all/all.yml | 2 ++ ansible/inventories/group_vars/all/vault.yaml | 7 ++++ .../host_vars/inspector.home.arpa.yml | 2 ++ ansible/inventories/main_lab.yaml | 34 +++++++++++++++++++ ansible/inventories/production.yaml | 7 ++++ ansible/inventories/prox1_lab.yaml | 6 ++++ 7 files changed, 67 insertions(+) create mode 100644 ansible/inventories/externals.yml create mode 100644 ansible/inventories/group_vars/all/all.yml create mode 100644 ansible/inventories/group_vars/all/vault.yaml create mode 100644 ansible/inventories/host_vars/inspector.home.arpa.yml create mode 100644 ansible/inventories/main_lab.yaml create mode 100644 ansible/inventories/production.yaml create mode 100644 ansible/inventories/prox1_lab.yaml diff --git a/ansible/inventories/externals.yml b/ansible/inventories/externals.yml new file mode 100644 index 0000000..e737f91 --- /dev/null +++ b/ansible/inventories/externals.yml @@ -0,0 +1,9 @@ +external_hosts: + children: + rup_tests: + hosts: + liquid: + ansible_host: 146.48.108.15 + nextrup_copy_test: + ansible_host: 146.48.108.16 + diff --git a/ansible/inventories/group_vars/all/all.yml b/ansible/inventories/group_vars/all/all.yml new file mode 100644 index 0000000..57b2a51 --- /dev/null +++ b/ansible/inventories/group_vars/all/all.yml @@ -0,0 +1,2 @@ +ansible_user: ansible +ansible_password: "{{ ansible_crypted_password }}" \ No newline at end of file diff --git a/ansible/inventories/group_vars/all/vault.yaml b/ansible/inventories/group_vars/all/vault.yaml new file mode 100644 index 0000000..0f8d593 --- /dev/null +++ b/ansible/inventories/group_vars/all/vault.yaml @@ -0,0 +1,7 @@ +$ANSIBLE_VAULT;1.1;AES256 +37333066623836633836613066346434626134336537663236396639346235386362336637376534 +3833636230313835326663306236333837343337393530390a636464393562346662613838343738 +39356439343862633937313539323661303866316164343830363431626435396636386366376263 +6536393735363663650a383461666230633838303436643837636562343366313235393264666462 +38643366653861666364363538333230656539663134646566666664626463343433613166393337 +3432333863646664336262353262333635323436326430376465 diff --git a/ansible/inventories/host_vars/inspector.home.arpa.yml b/ansible/inventories/host_vars/inspector.home.arpa.yml new file mode 100644 index 0000000..7166053 --- /dev/null +++ b/ansible/inventories/host_vars/inspector.home.arpa.yml @@ -0,0 +1,2 @@ +--- +ansible_user: clouseau \ No newline at end of file diff --git a/ansible/inventories/main_lab.yaml b/ansible/inventories/main_lab.yaml new file mode 100644 index 0000000..9c2e7cc --- /dev/null +++ b/ansible/inventories/main_lab.yaml @@ -0,0 +1,34 @@ +main_lab_hosts: + children: + lan: + hosts: + inspector.home.arpa: + god.home.arpa: + swarm: + children: + enabling: + hosts: + enabling[1:3].home.arpa: + swarm_master: true + swarm_drain: false + vars: + swarm_name: enabling + swarm1: + hosts: + swarm1m[1:3].home.arpa: + swarm_master: true + swarm1w[1:4].home.arpa: + vars: + swarm_name: the_swarm + cluster: + hosts: + worker[1:3].home.arpa: + front: + hosts: + edge.home.arpa: + operators: + children: + lan: + enabling: + + diff --git a/ansible/inventories/production.yaml b/ansible/inventories/production.yaml new file mode 100644 index 0000000..e7de252 --- /dev/null +++ b/ansible/inventories/production.yaml @@ -0,0 +1,7 @@ +prouction_hosts: + children: + public_access: + hosts: + #cloud.reterup.it: + # ansible_host: 146.48.108.17 + diff --git a/ansible/inventories/prox1_lab.yaml b/ansible/inventories/prox1_lab.yaml new file mode 100644 index 0000000..8fb3a02 --- /dev/null +++ b/ansible/inventories/prox1_lab.yaml @@ -0,0 +1,6 @@ +prox1_lab_hosts: + children: + front: + hosts: + prox1: + ansible_host: 146.48.108.11 \ No newline at end of file From baa35fa85f15e7fb96ea84dc1cab78f7938163f2 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 12 Aug 2025 16:44:04 +0200 Subject: [PATCH 29/41] Default Ask for Vault Password --- ansible/ansible.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg index 2da7875..0f2b912 100644 --- a/ansible/ansible.cfg +++ b/ansible/ansible.cfg @@ -73,7 +73,7 @@ fact_caching_timeout=86400 ;ask_pass=False # (boolean) This controls whether an Ansible playbook should prompt for a vault password. -;ask_vault_pass=False +ask_vault_pass=True # (pathspec) Colon-separated paths in which Ansible will search for Cache Plugins. ;cache_plugins=/Users/fabioisti/.ansible/plugins/cache:/usr/share/ansible/plugins/cache From 7130569e6f32496059cb075ddb44281b567f37f5 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Tue, 12 Aug 2025 17:46:38 +0200 Subject: [PATCH 30/41] Refactor playbooks and roles --- ansible/controller.yml | 2 - ansible/{ => playbooks}/bootstrap.yml | 0 ansible/playbooks/controller.yml | 68 +++++++++++++++++++ ansible/{ => playbooks}/nodes.yml | 0 .../roles/common/defaults/main.yml | 0 .../roles/common/tasks/connectivity.yml | 0 .../roles/common/tasks/main.yml | 0 .../roles/docker-swarm/tasks/main.yaml | 0 .../roles/docker-swarm}/tasks/swarm.yml | 0 .../{ => playbooks}/roles/docker/README.md | 0 .../roles/docker/defaults/main.yml | 0 .../roles/docker/handlers/main.yml | 0 .../roles/docker/meta/main.yml | 0 .../roles/docker/tasks/docker_user.yml | 0 .../roles/docker/tasks/install.yml | 0 .../roles/docker/tasks/main.yml | 0 .../roles/docker/tests/inventory | 0 .../roles/docker/tests/test.yml | 0 .../roles/docker/vars/main.yml | 0 .../roles/nextcloud_aio/tasks/main.yaml | 0 .../tasks/nextcloud_docker_aio.yaml | 6 ++ ansible/{ => playbooks}/swarms.yml | 4 +- ansible/readme.md | 26 +++++-- ansible/site.yaml | 1 + 24 files changed, 99 insertions(+), 8 deletions(-) delete mode 100644 ansible/controller.yml rename ansible/{ => playbooks}/bootstrap.yml (100%) create mode 100644 ansible/playbooks/controller.yml rename ansible/{ => playbooks}/nodes.yml (100%) rename ansible/{ => playbooks}/roles/common/defaults/main.yml (100%) rename ansible/{ => playbooks}/roles/common/tasks/connectivity.yml (100%) rename ansible/{ => playbooks}/roles/common/tasks/main.yml (100%) create mode 100644 ansible/playbooks/roles/docker-swarm/tasks/main.yaml rename ansible/{roles/docker => playbooks/roles/docker-swarm}/tasks/swarm.yml (100%) rename ansible/{ => playbooks}/roles/docker/README.md (100%) rename ansible/{ => playbooks}/roles/docker/defaults/main.yml (100%) rename ansible/{ => playbooks}/roles/docker/handlers/main.yml (100%) rename ansible/{ => playbooks}/roles/docker/meta/main.yml (100%) rename ansible/{ => playbooks}/roles/docker/tasks/docker_user.yml (100%) rename ansible/{ => playbooks}/roles/docker/tasks/install.yml (100%) rename ansible/{ => playbooks}/roles/docker/tasks/main.yml (100%) rename ansible/{ => playbooks}/roles/docker/tests/inventory (100%) rename ansible/{ => playbooks}/roles/docker/tests/test.yml (100%) rename ansible/{ => playbooks}/roles/docker/vars/main.yml (100%) create mode 100644 ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml create mode 100644 ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml rename ansible/{ => playbooks}/swarms.yml (97%) diff --git a/ansible/controller.yml b/ansible/controller.yml deleted file mode 100644 index 168992f..0000000 --- a/ansible/controller.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -#- hosts: \ No newline at end of file diff --git a/ansible/bootstrap.yml b/ansible/playbooks/bootstrap.yml similarity index 100% rename from ansible/bootstrap.yml rename to ansible/playbooks/bootstrap.yml diff --git a/ansible/playbooks/controller.yml b/ansible/playbooks/controller.yml new file mode 100644 index 0000000..1adbedb --- /dev/null +++ b/ansible/playbooks/controller.yml @@ -0,0 +1,68 @@ +--- +# play 1 - local +# check config info from inventory + + + +# play 2 +# gather status + +# play 3 +# bootstrap + +# play 4 +# join + +- name: Tests + hosts: swarm + connection: local + gather_facts: no + + vars: + swarm_list: {} + + tasks: + - debug: var=hostvars + + - name: Gather Swarm info + set_fact: + swarm_list: "{{swarm_list + hostvars[hostname]['swarm_name']}}" + + - debug: var=swarm_list + + + # # show all the hosts in the inventory + # - debug: + # msg: "{{ item }}" + # loop: "{{ groups['all'] }}" + + # - name: printsomthieng + # debug: + # msg: "{{ item }}" + # with_items: "{{ play_hosts }}" + # #run_once: true + + + + # debug: + # msg: + # # - "{{ item }}" + # - "{{hostvars[item]['swarm_master']}}" + # #loop: "{{ hosts.items() | list }}" + + + + + + + + + # - name: Create swarm___ groups + # add_host: + # hostname: "{{ item }}" + # groups: "swarm_{{item}}manager_operational" + # with_items: "{{ play_hosts }}" + # run_once: true + + # - name: Display + # command: echo "swarm_{{item}}manager_operational" \ No newline at end of file diff --git a/ansible/nodes.yml b/ansible/playbooks/nodes.yml similarity index 100% rename from ansible/nodes.yml rename to ansible/playbooks/nodes.yml diff --git a/ansible/roles/common/defaults/main.yml b/ansible/playbooks/roles/common/defaults/main.yml similarity index 100% rename from ansible/roles/common/defaults/main.yml rename to ansible/playbooks/roles/common/defaults/main.yml diff --git a/ansible/roles/common/tasks/connectivity.yml b/ansible/playbooks/roles/common/tasks/connectivity.yml similarity index 100% rename from ansible/roles/common/tasks/connectivity.yml rename to ansible/playbooks/roles/common/tasks/connectivity.yml diff --git a/ansible/roles/common/tasks/main.yml b/ansible/playbooks/roles/common/tasks/main.yml similarity index 100% rename from ansible/roles/common/tasks/main.yml rename to ansible/playbooks/roles/common/tasks/main.yml diff --git a/ansible/playbooks/roles/docker-swarm/tasks/main.yaml b/ansible/playbooks/roles/docker-swarm/tasks/main.yaml new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/docker/tasks/swarm.yml b/ansible/playbooks/roles/docker-swarm/tasks/swarm.yml similarity index 100% rename from ansible/roles/docker/tasks/swarm.yml rename to ansible/playbooks/roles/docker-swarm/tasks/swarm.yml diff --git a/ansible/roles/docker/README.md b/ansible/playbooks/roles/docker/README.md similarity index 100% rename from ansible/roles/docker/README.md rename to ansible/playbooks/roles/docker/README.md diff --git a/ansible/roles/docker/defaults/main.yml b/ansible/playbooks/roles/docker/defaults/main.yml similarity index 100% rename from ansible/roles/docker/defaults/main.yml rename to ansible/playbooks/roles/docker/defaults/main.yml diff --git a/ansible/roles/docker/handlers/main.yml b/ansible/playbooks/roles/docker/handlers/main.yml similarity index 100% rename from ansible/roles/docker/handlers/main.yml rename to ansible/playbooks/roles/docker/handlers/main.yml diff --git a/ansible/roles/docker/meta/main.yml b/ansible/playbooks/roles/docker/meta/main.yml similarity index 100% rename from ansible/roles/docker/meta/main.yml rename to ansible/playbooks/roles/docker/meta/main.yml diff --git a/ansible/roles/docker/tasks/docker_user.yml b/ansible/playbooks/roles/docker/tasks/docker_user.yml similarity index 100% rename from ansible/roles/docker/tasks/docker_user.yml rename to ansible/playbooks/roles/docker/tasks/docker_user.yml diff --git a/ansible/roles/docker/tasks/install.yml b/ansible/playbooks/roles/docker/tasks/install.yml similarity index 100% rename from ansible/roles/docker/tasks/install.yml rename to ansible/playbooks/roles/docker/tasks/install.yml diff --git a/ansible/roles/docker/tasks/main.yml b/ansible/playbooks/roles/docker/tasks/main.yml similarity index 100% rename from ansible/roles/docker/tasks/main.yml rename to ansible/playbooks/roles/docker/tasks/main.yml diff --git a/ansible/roles/docker/tests/inventory b/ansible/playbooks/roles/docker/tests/inventory similarity index 100% rename from ansible/roles/docker/tests/inventory rename to ansible/playbooks/roles/docker/tests/inventory diff --git a/ansible/roles/docker/tests/test.yml b/ansible/playbooks/roles/docker/tests/test.yml similarity index 100% rename from ansible/roles/docker/tests/test.yml rename to ansible/playbooks/roles/docker/tests/test.yml diff --git a/ansible/roles/docker/vars/main.yml b/ansible/playbooks/roles/docker/vars/main.yml similarity index 100% rename from ansible/roles/docker/vars/main.yml rename to ansible/playbooks/roles/docker/vars/main.yml diff --git a/ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml b/ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml new file mode 100644 index 0000000..e69de29 diff --git a/ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml b/ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml new file mode 100644 index 0000000..a9ca522 --- /dev/null +++ b/ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml @@ -0,0 +1,6 @@ +--- +# NB inherit docker +- name: Create volumes + ## TODO + +- name: launch Nextcloud aio docker image diff --git a/ansible/swarms.yml b/ansible/playbooks/swarms.yml similarity index 97% rename from ansible/swarms.yml rename to ansible/playbooks/swarms.yml index d5f08e5..2ed0068 100644 --- a/ansible/swarms.yml +++ b/ansible/playbooks/swarms.yml @@ -1,5 +1,5 @@ --- -- name: "Configure swarms" +- name: "Configure swarm" hosts: swarm1 roles: - common @@ -10,7 +10,7 @@ hostname: "{{ item }}" groups: manager_group with_items: "{{play_hosts}}" - when: hostvars[item]['swarm_master'] + when: hostvars[item]['swarm_master'] is defined and hostvars[item]['swarm_master'] - name: "Prepare worker group" add_host: diff --git a/ansible/readme.md b/ansible/readme.md index f553b28..626776d 100644 --- a/ansible/readme.md +++ b/ansible/readme.md @@ -1,15 +1,33 @@ # Ansible Playbooks -## Playbooks -##### Bootstrap -Creates user ansible with necessary privileges. Needs become password +## Usage + +The inventory defines labs, nodes and their group based on function. + +Playbooks run Roles against node groups. + +Roles define set of Tasks. + + + +## Playbooks + +**Site** playbook launches them all. +**Bootstrap** is to be run first on new installations. + +### Site +This playbook recalls all the following playbooks in the stated order. + -'ansible-playbook -i inventories bootstrap.yml -l nextrup_copy_test -u fabio -K --ask-vault-password' ##### Nodes Basic checks connectivity for **all** +##### Swarms + +##### NextCloud +Installs Nextcloud AIO using SSE Lab / dockerized / nextcloud-aio ## Inventories diff --git a/ansible/site.yaml b/ansible/site.yaml index 070496a..d0c5b05 100644 --- a/ansible/site.yaml +++ b/ansible/site.yaml @@ -3,3 +3,4 @@ - import_playbook: nodes.yml #- import_playbook: controller.yml - import_playbook: swarms.yml +#- import_playbook: nextcloud.yml \ No newline at end of file From 93c0dc128fbaba63073fed4f1599c7df0a9e404a Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 11:36:41 +0200 Subject: [PATCH 31/41] Added bigbrain to external inventory --- ansible/inventories/externals.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ansible/inventories/externals.yml b/ansible/inventories/externals.yml index e737f91..c0fc491 100644 --- a/ansible/inventories/externals.yml +++ b/ansible/inventories/externals.yml @@ -6,4 +6,8 @@ external_hosts: ansible_host: 146.48.108.15 nextrup_copy_test: ansible_host: 146.48.108.16 + misc_tests: + hosts: + bigbrain: + ansible_host: 146.48.108.14 From 9c6da4aa1a011d135ee290347ef87c0b85258777 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 11:37:13 +0200 Subject: [PATCH 32/41] Fixed library position --- ansible/{ => playbooks}/library/templates/ansible_auth_keys.j2 | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename ansible/{ => playbooks}/library/templates/ansible_auth_keys.j2 (100%) diff --git a/ansible/library/templates/ansible_auth_keys.j2 b/ansible/playbooks/library/templates/ansible_auth_keys.j2 similarity index 100% rename from ansible/library/templates/ansible_auth_keys.j2 rename to ansible/playbooks/library/templates/ansible_auth_keys.j2 From 6ccdfe3089542410067b33e9560b1cccf98c6e0f Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 11:43:10 +0200 Subject: [PATCH 33/41] Docker role basic doc --- ansible/playbooks/roles/docker/README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ansible/playbooks/roles/docker/README.md b/ansible/playbooks/roles/docker/README.md index 225dd44..62ce0eb 100644 --- a/ansible/playbooks/roles/docker/README.md +++ b/ansible/playbooks/roles/docker/README.md @@ -1,12 +1,14 @@ -Role Name +Docker Role ========= -A brief description of the role goes here. +Tasks : +- Installs dependencies and docker env [tasks/install.yml](tasks/install.yml) +- Creates user docker (group docker) for docker operations [tasks/docker_user.yml](tasks/docker_user.yml) Requirements ------------ -Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. +Uses **become** Role Variables -------------- From 4ab24ab52cd7d0d21c3b7a9e536cff47e94d67b9 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 11:43:41 +0200 Subject: [PATCH 34/41] Bootstrap and ansible.cfg usage --- ansible/readme.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ansible/readme.md b/ansible/readme.md index 626776d..f816c90 100644 --- a/ansible/readme.md +++ b/ansible/readme.md @@ -12,14 +12,15 @@ Roles define set of Tasks. ## Playbooks +Launch playbooks from present folder in order to use [default config file](ansible.cfg). + **Site** playbook launches them all. **Bootstrap** is to be run first on new installations. + ### Site This playbook recalls all the following playbooks in the stated order. - - ##### Nodes Basic checks connectivity for **all** @@ -30,6 +31,11 @@ Basic checks connectivity for **all** Installs Nextcloud AIO using SSE Lab / dockerized / nextcloud-aio +### Bootstrap ### +Creates sudoer user ansible, necessitates of sudoer user. +Use `ansible-playbook -i inventories playbooks/bootstrap.yml -l [TARGET_HOST] -e 'ansible_user=[REMOTE_USER]' -K` + + ## Inventories ### Main Lab From 44b4b9bb45c0818d4f831447849fcb1f4c1c908b Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 12:50:07 +0200 Subject: [PATCH 35/41] Prox1 credentials --- ansible/inventories/host_vars/prox1.yaml | 8 ++++++++ ansible/inventories/prox1_lab.yaml | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 ansible/inventories/host_vars/prox1.yaml diff --git a/ansible/inventories/host_vars/prox1.yaml b/ansible/inventories/host_vars/prox1.yaml new file mode 100644 index 0000000..b59eaf0 --- /dev/null +++ b/ansible/inventories/host_vars/prox1.yaml @@ -0,0 +1,8 @@ +$ANSIBLE_VAULT;1.1;AES256 +32653362346631356539383863653761626165383165653839343965636363623637396138346163 +3239313335343263343265633966353230323663373664640a346234373733303139303139613962 +36316132363366376436353936653930326235303937623762636438313138636238613136303930 +3866303033613561630a666534326237363162656461336632623966653132656361333565356136 +37666536323434323934353362383363643561306136656339663666643764626565666264373761 +64306334323632326665386431323965653034393162373331313339653736346136313736626565 +663230663364393634306438616133623665 diff --git a/ansible/inventories/prox1_lab.yaml b/ansible/inventories/prox1_lab.yaml index 8fb3a02..b12ea3a 100644 --- a/ansible/inventories/prox1_lab.yaml +++ b/ansible/inventories/prox1_lab.yaml @@ -3,4 +3,5 @@ prox1_lab_hosts: front: hosts: prox1: - ansible_host: 146.48.108.11 \ No newline at end of file + ansible_host: 146.48.108.11 + ansible_python_interpreter: /usr/bin/python3 \ No newline at end of file From c673e3e90b0a89154ad52d6e1597331f6f8d9c53 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 14:41:47 +0200 Subject: [PATCH 36/41] label externals --- ansible/inventories/externals.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/inventories/externals.yml b/ansible/inventories/externals.yml index c0fc491..75abd62 100644 --- a/ansible/inventories/externals.yml +++ b/ansible/inventories/externals.yml @@ -1,4 +1,4 @@ -external_hosts: +externals: children: rup_tests: hosts: From e4e18ade6e64230e6a516108dbb29900b16572fe Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 14:42:05 +0200 Subject: [PATCH 37/41] edge as internal LAN --- ansible/inventories/main_lab.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ansible/inventories/main_lab.yaml b/ansible/inventories/main_lab.yaml index 9c2e7cc..f2c98d7 100644 --- a/ansible/inventories/main_lab.yaml +++ b/ansible/inventories/main_lab.yaml @@ -2,6 +2,7 @@ main_lab_hosts: children: lan: hosts: + edge.home.arpa: inspector.home.arpa: god.home.arpa: swarm: @@ -25,7 +26,8 @@ main_lab_hosts: worker[1:3].home.arpa: front: hosts: - edge.home.arpa: + main_lab_edge: + ansible_host: 146.48.108.5 operators: children: lan: From f99e3958d5d8c7ecba40c683a4f4ee012d74324f Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Wed, 10 Sep 2025 14:43:19 +0200 Subject: [PATCH 38/41] ping all --- ansible/inventories/prox1_lab.yaml | 5 ++--- ansible/playbooks/nodes.yml | 4 +++- ansible/playbooks/ping_all.yaml | 10 ++++++++++ ansible/playbooks/roles/common/tasks/connectivity.yml | 6 ------ ansible/playbooks/roles/docker/tests/test.yml | 1 - ansible/{ => playbooks}/site.yaml | 0 6 files changed, 15 insertions(+), 11 deletions(-) create mode 100644 ansible/playbooks/ping_all.yaml rename ansible/{ => playbooks}/site.yaml (100%) diff --git a/ansible/inventories/prox1_lab.yaml b/ansible/inventories/prox1_lab.yaml index b12ea3a..23f1055 100644 --- a/ansible/inventories/prox1_lab.yaml +++ b/ansible/inventories/prox1_lab.yaml @@ -2,6 +2,5 @@ prox1_lab_hosts: children: front: hosts: - prox1: - ansible_host: 146.48.108.11 - ansible_python_interpreter: /usr/bin/python3 \ No newline at end of file + prox1_lab_edge: + ansible_host: 146.48.108.11 \ No newline at end of file diff --git a/ansible/playbooks/nodes.yml b/ansible/playbooks/nodes.yml index 3e4c871..7240cbf 100644 --- a/ansible/playbooks/nodes.yml +++ b/ansible/playbooks/nodes.yml @@ -1,5 +1,7 @@ --- +- import_playbook: ping_all.yaml - name: Basic check nodes hosts: all roles: - - common \ No newline at end of file + - common + \ No newline at end of file diff --git a/ansible/playbooks/ping_all.yaml b/ansible/playbooks/ping_all.yaml new file mode 100644 index 0000000..df77080 --- /dev/null +++ b/ansible/playbooks/ping_all.yaml @@ -0,0 +1,10 @@ +--- + +- hosts: all + gather_facts: False + connection: local + + tasks: + - name: ping + shell: ping -c 1 -W 2 {{ ansible_host }} + diff --git a/ansible/playbooks/roles/common/tasks/connectivity.yml b/ansible/playbooks/roles/common/tasks/connectivity.yml index 7023e5e..003cded 100644 --- a/ansible/playbooks/roles/common/tasks/connectivity.yml +++ b/ansible/playbooks/roles/common/tasks/connectivity.yml @@ -1,9 +1,3 @@ --- -- name: Check node up - ansible.builtin.ping: - -#- name: Check internal DNS -# wait_for: host=edge.home.arpa port=53 timeout=1 - - name: Check access to Internet wait_for: host=1.1.1.1 timeout=1 diff --git a/ansible/playbooks/roles/docker/tests/test.yml b/ansible/playbooks/roles/docker/tests/test.yml index e4f8498..479c928 100644 --- a/ansible/playbooks/roles/docker/tests/test.yml +++ b/ansible/playbooks/roles/docker/tests/test.yml @@ -1,6 +1,5 @@ #SPDX-License-Identifier: MIT-0 --- - hosts: localhost - remote_user: root roles: - docker diff --git a/ansible/site.yaml b/ansible/playbooks/site.yaml similarity index 100% rename from ansible/site.yaml rename to ansible/playbooks/site.yaml From 2dd337f09f20a9c82299ca71b2ac4d8bf77d064a Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 25 Sep 2025 15:46:28 +0200 Subject: [PATCH 39/41] Inventory update --- ansible/inventories/main_lab.yaml | 1 + ansible/inventories/production.yaml | 10 +++++++--- ansible/playbooks/bootstrap.yml | 1 + ansible/readme.md | 3 +++ 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/ansible/inventories/main_lab.yaml b/ansible/inventories/main_lab.yaml index f2c98d7..1cf750b 100644 --- a/ansible/inventories/main_lab.yaml +++ b/ansible/inventories/main_lab.yaml @@ -24,6 +24,7 @@ main_lab_hosts: cluster: hosts: worker[1:3].home.arpa: + cl1m1.home.arpa: front: hosts: main_lab_edge: diff --git a/ansible/inventories/production.yaml b/ansible/inventories/production.yaml index e7de252..b10db3e 100644 --- a/ansible/inventories/production.yaml +++ b/ansible/inventories/production.yaml @@ -2,6 +2,10 @@ prouction_hosts: children: public_access: hosts: - #cloud.reterup.it: - # ansible_host: 146.48.108.17 - + #cloud.reterup.it: + #ansible_host: 146.48.108.17 + backups: + ansible_host: 146.48.108.12 + ftp_server: + hosts: + backups: diff --git a/ansible/playbooks/bootstrap.yml b/ansible/playbooks/bootstrap.yml index 76f1e75..6f0520e 100644 --- a/ansible/playbooks/bootstrap.yml +++ b/ansible/playbooks/bootstrap.yml @@ -36,3 +36,4 @@ - name: Add the mandatory ssh keys to the ansible user template: src=library/templates/ansible_auth_keys.j2 dest=/srv/ansible/.ssh/authorized_keys owner=ansible group=ansible mode=0600 + diff --git a/ansible/readme.md b/ansible/readme.md index f816c90..ecb6978 100644 --- a/ansible/readme.md +++ b/ansible/readme.md @@ -47,6 +47,9 @@ Management of extra infra nodes [check](non-infra) ### Production Management of production services, beware! +Hosts are commented by default + + ### Prox1_lab Prox mox laboratory From b551f464a457fb3c441224808f3cf171ac86fc02 Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 25 Sep 2025 15:49:59 +0200 Subject: [PATCH 40/41] Imported robgmills pure-ftpd --- ansible/playbooks/ftp.yaml | 5 + .../roles/robgmills.pure-ftpd/.gitignore | 3 + .../roles/robgmills.pure-ftpd/.travis.yml | 38 +++++++ .../roles/robgmills.pure-ftpd/README.md | 106 ++++++++++++++++++ .../roles/robgmills.pure-ftpd/Vagrantfile | 4 + .../roles/robgmills.pure-ftpd/ansible.cfg | 2 + .../robgmills.pure-ftpd/defaults/main.yml | 23 ++++ .../roles/robgmills.pure-ftpd/inventory | 1 + .../meta/.galaxy_install_info | 2 + .../roles/robgmills.pure-ftpd/meta/main.yml | 18 +++ .../roles/robgmills.pure-ftpd/playbook.yml | 5 + .../roles/robgmills.pure-ftpd/tasks/main.yml | 38 +++++++ .../tasks/setup-Debian.yml | 15 +++ .../roles/robgmills.pure-ftpd/tasks/tls.yml | 41 +++++++ .../tasks/virtual-user.yml | 34 ++++++ .../roles/robgmills.pure-ftpd/tests/inventory | 1 + .../roles/robgmills.pure-ftpd/tests/test.yml | 5 + .../roles/robgmills.pure-ftpd/vars/Debian.yml | 6 + 18 files changed, 347 insertions(+) create mode 100644 ansible/playbooks/ftp.yaml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/.gitignore create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/.travis.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/README.md create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/Vagrantfile create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/ansible.cfg create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/defaults/main.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/inventory create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/meta/.galaxy_install_info create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/meta/main.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/playbook.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/tasks/setup-Debian.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/tasks/tls.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/tasks/virtual-user.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/tests/inventory create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/tests/test.yml create mode 100644 ansible/playbooks/roles/robgmills.pure-ftpd/vars/Debian.yml diff --git a/ansible/playbooks/ftp.yaml b/ansible/playbooks/ftp.yaml new file mode 100644 index 0000000..d731849 --- /dev/null +++ b/ansible/playbooks/ftp.yaml @@ -0,0 +1,5 @@ +--- +- name: Install FTP Server + hosts: ftp_server + roles: + - robgmills.pure-ftpd \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/.gitignore b/ansible/playbooks/roles/robgmills.pure-ftpd/.gitignore new file mode 100644 index 0000000..8d396df --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/.gitignore @@ -0,0 +1,3 @@ +.idea/ +*.iml +.vagrant/ diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/.travis.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/.travis.yml new file mode 100644 index 0000000..e31dd27 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/.travis.yml @@ -0,0 +1,38 @@ +--- +sudo: required +language: python +python: "2.7" + +env: + - SITE=test.yml + +before_install: + - sudo apt-get update -qq + - sudo apt-get install -y curl + +install: + # Install Ansible. + - pip install ansible + + # Add ansible.cfg to pick up roles path. + #- "{ echo '[defaults]'; echo 'roles_path = ../'; } >> ansible.cfg" + +script: + # Check the role/playbook's syntax. + - "ansible-playbook -i tests/inventory tests/$SITE --syntax-check" + + # Run the role/playbook with ansible-playbook. + - "ansible-playbook -i tests/inventory tests/$SITE --connection=local --sudo" + + # Run the role/playbook again, checking to make sure it's idempotent. + - > + ansible-playbook -i tests/inventory tests/$SITE --connection=local --sudo + | grep -q 'changed=2.*failed=0' + && (echo 'Idempotence test: pass' && exit 0) + || (echo 'Idempotence test: fail' && exit 1) + + # TODO - get the test working. + # Request a file via FTP, to make sure pure-ftpd is running and responds. + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/README.md b/ansible/playbooks/roles/robgmills.pure-ftpd/README.md new file mode 100644 index 0000000..5bab329 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/README.md @@ -0,0 +1,106 @@ +# Ansible Role: Pure-FTPd + +[![Build Status](https://travis-ci.org/robgmills/ansible-pure-ftpd.svg?branch=master)](https://travis-ci.org/robgmills/ansible-pure-ftpd) + +Installs Pure-FTPd on Debian/Ubuntu Linux. + +This role installs and configures the latest version of Pure-FTPd from the Pure-FTPd via apt (on Debian-based systems). You will likely need to do extra setup work after this role has installed Pure-FTPd. + +## Requirements + +None. + +## Role Variables + +Available variables are listed below, along with default values (see `defaults/main.yml`): + + pure_ftpd_root: "/var/ftp" + +A directory path at which to scope the FTP server access. + + pure_ftpd_user: "ftp" + +The system-level user that the FTP daemon performs operations under. This user is setup without login permissions (can't ssh into system) but owns all of the files uploaded via the FTP server. + + pure_ftpd_group: "ftp-sys-group" + +The system-level group that the FTP daemon performs operations under. This is the group assigned to all files uploaded via the FTP server. + + pure_ftpd_vusers: + - name: "ftp" + password: "FTPisSoC00l?" + dir: "/var/ftp" # optional + +A list of user definitions virtual FTP users. If left empty, defaults to a single user with the username `ftp` and password `ftp`. `name` and `password` are required fields. `dir` is optional and defaults to the value of `ftp_root`. + +Since the array of `virtual_users` needs to contain secret credentials, it is recommended to create an [Ansible Vault][vault]-encrypted variable file to include that contains your users and overrides the role default vars. + + pure_ftpd_tls: true + +Turns on/off support for FTP TLS encryption. It is strongly recommended that this remain `true`. + + pure_ftpd_allow_insecure: false + +When TLS encryption is enabled, the default is to not allow non-encrypted, insecure connections. Setting this value to `true` will allow both secure and insecure connections. Requires that `enable_tls` be `true`. + + pure_ftpd_pem: "" + +The contents of the PEM certificate to use for FTP TLS encryption. It is recommended to create an [Ansible Vault][vault]-encrypted variable file to include that contains your PEM certificate. + +If no `pure_ftpd_pem` is provided, a PEM certificate is generated using `openssl`. + + pure_ftpd_openssl_config: {} + +The `openssl_config` vars object controls the generation of an openssl PEM certificate + key combination. + +The sub-properties of the `openssl_config` object are as follows: + + days: "365" + +The number of days for which the certificate is valid. + + size: "2048" + +The size of the certificate key. The larger, the more secure. + + country: "" + state: "" + locality: "" + org: "" + unit: "" + common: "" + email: "" + +The values of the certificate subject information. + +## Dependencies + +None. + +## Example Playbook + + - hosts: server + roles: + - role: robgmills.pure-ftpd + +## Try It! + +From the root of the project: + + vagrant up + +...then... + + ansible-playbook -i inventory -b -u vagrant -k playbook.yml + +...then use your favorite FTPS client to connect to `ftps://ftp:FTPisSoC00l?@192.168.50.2` + +## License + +MIT / BSD + +## Author Information + +This role was created in 2016 by [Rob Mills](https://robgmills.com/). + +[vault]: http://docs.ansible.com/ansible/playbooks_vault.html \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/Vagrantfile b/ansible/playbooks/roles/robgmills.pure-ftpd/Vagrantfile new file mode 100644 index 0000000..05b0f5f --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/Vagrantfile @@ -0,0 +1,4 @@ +Vagrant.configure(2) do |config| + config.vm.box = "debian/jessie64" + config.vm.network "private_network", ip: "192.168.50.2" +end \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/ansible.cfg b/ansible/playbooks/roles/robgmills.pure-ftpd/ansible.cfg new file mode 100644 index 0000000..613d83b --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/ansible.cfg @@ -0,0 +1,2 @@ +[defaults] +roles_path = ../ diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/defaults/main.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/defaults/main.yml new file mode 100644 index 0000000..2492f4b --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/defaults/main.yml @@ -0,0 +1,23 @@ +--- +# Used only for Debian/Ubuntu installation, as the -t option for apt. +pureftpd_default_release: "" + +pure_ftpd_user: "ftp" +pure_ftpd_group: "ftp" +pure_ftpd_root: "/var/ftp" +pure_ftpd_vusers: + - name: ftp + dir: "{{ pure_ftpd_root }}" + password: "FTPisSoC00l?" +pure_ftpd_tls: true +pure_ftpd_allow_insecure: false +pure_ftpd_openssl_config: + days: "365" + size: "2048" + country: "" + state: "" + locality: "" + org: "" + unit: "" + common: "" + email: "" \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/inventory b/ansible/playbooks/roles/robgmills.pure-ftpd/inventory new file mode 100644 index 0000000..5ffd80d --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/inventory @@ -0,0 +1 @@ +192.168.50.2 \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/meta/.galaxy_install_info b/ansible/playbooks/roles/robgmills.pure-ftpd/meta/.galaxy_install_info new file mode 100644 index 0000000..eb153b8 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Thu Sep 25 13:49:03 2025 +version: 1.0.1 diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/meta/main.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/meta/main.yml new file mode 100644 index 0000000..170f7a2 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/meta/main.yml @@ -0,0 +1,18 @@ +--- +galaxy_info: + author: Rob Mills + description: Installs and configures a Pure-FTPd server + company: RGM + license: MIT + min_ansible_version: 2.0 + platforms: + - name: Debian + versions: + - all + galaxy_tags: + - ftp + - server + - ftps + - tls + - openssl +dependencies: [] diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/playbook.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/playbook.yml new file mode 100644 index 0000000..e1668a6 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/playbook.yml @@ -0,0 +1,5 @@ +--- +- hosts: 192.168.50.2 + become: true + roles: + - ansible-pure-ftpd \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml new file mode 100644 index 0000000..007b9fa --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml @@ -0,0 +1,38 @@ +--- +# Variable setup. +- name: Include OS-specific variables. + include_vars: "{{ ansible_os_family }}.yml" + +# Setup/install tasks. +- include: setup-Debian.yml + when: ansible_os_family == 'Debian' + +# Pure-FTPd setup +- name: Create the FTP system group '{{ pure_ftpd_group }}' + group: name={{ pure_ftpd_group }} state=present + +- name: Create the FTP system user '{{ pure_ftpd_user }}' + user: name={{ pure_ftpd_user }} group={{ pure_ftpd_group }} home=/dev/null shell=/sbin/nologin state=present + +- name: Create FTP server root directory '{{ pure_ftpd_root }}' + file: dest={{ pure_ftpd_root }} mode=0755 state=directory owner={{ pure_ftpd_user }} group={{ pure_ftpd_group }} + +# Create and/or install SSL certificate +- include: tls.yml + when: pure_ftpd_tls + +# Create the virtual FTP users and set their passwords +- include: virtual-user.yml + with_items: "{{ pure_ftpd_vusers }}" + +- name: Link virtual FTP user database to the correct location + file: src={{ __ftp_user_db }} dest={{ __ftp_user_db_sym }} state=link + register: r_linkdb + +- name: Restart pure-ftpd + service: name=pure-ftpd state=restarted + when: r_linkdb.changed + +# - Ensure that FTP service is running +- name: Ensure pure-ftpd is started and enabled to start at boot. + service: name=pure-ftpd state=started enabled=yes diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/setup-Debian.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/setup-Debian.yml new file mode 100644 index 0000000..300b6cf --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/setup-Debian.yml @@ -0,0 +1,15 @@ +--- +- name: Update apt cache. + apt: update_cache=yes cache_valid_time=86400 + +- name: Ensure requisite apt packages are installed. + apt: name={{ item }} state=present default_release={{ pureftpd_default_release }} + with_items: + - pure-ftpd + - python-pip + - openssl + +- name: Install pexpect + pip: + name: "pexpect" + state: present \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/tls.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/tls.yml new file mode 100644 index 0000000..2d79051 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/tls.yml @@ -0,0 +1,41 @@ +--- +# assumes that `enable_tls: true` +- name: Define TLS support level. + no_log: true + set_fact: + tls_level: 2 + when: not pure_ftpd_allow_insecure + +- name: Define TLS support level. + no_log: true + set_fact: + tls_level: 1 + when: pure_ftpd_allow_insecure + +- name: Set TLS config level ({{ tls_level | default(2) }}) + copy: content={{ tls_level | default(2) }} dest={{ __ftp_conf_root }}/TLS owner=root group=root + +- name: Install configured TLS PEM for pure-ftpd + no_log: true + copy: content="{{ pure_ftpd_pem }}" dest=/etc/ssl/private/pure-ftpd.pem owner=root group=root + when: pure_ftpd_pem is defined + +- name: Check if pure-pw centificate file exists + stat: path=/etc/ssl/private/pure-ftpd.pem + register: r_ftppem + +- name: Generate TLS PEM for pure-ftpd + expect: + command: openssl req -x509 -nodes -days {{ pure_ftpd_openssl_config.days }} -newkey rsa:{{ pure_ftpd_openssl_config.size }} -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem + responses: + (?i)country name: "{{ pure_ftpd_openssl_config.country }}" + (?i)state or province name: "{{ pure_ftpd_openssl_config.state }}" + (?i)locality name: "{{ pure_ftpd_openssl_config.locality }}" + (?i)organization name: "{{ pure_ftpd_openssl_config.org }}" + (?i)organizational unit name: "{{ pure_ftpd_openssl_config.unit }}" + (?i)common name: "{{ pure_ftpd_openssl_config.common }}" + (?i)email address: "{{ pure_ftpd_openssl_config.email }}" + when: pure_ftpd_pem is not defined and not r_ftppem.stat.exists + +- name: Restrict permissions on PEM + file: state=file path=/etc/ssl/private/pure-ftpd.pem mode=0600 owner=root group=root \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/virtual-user.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/virtual-user.yml new file mode 100644 index 0000000..343680c --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/virtual-user.yml @@ -0,0 +1,34 @@ +--- +- name: Create directory {{ item.dir | default( pure_ftpd_root ) }} for virtual FTP user {{ item.name }} + file: dest={{ item.dir | default( pure_ftpd_root ) }} mode=0755 state=directory owner={{ pure_ftpd_user }} group={{ pure_ftpd_group}} + +- name: Check if pure-pw passwords file exists + stat: path={{ __ftp_passwd }} + register: r_passwd + +- name: Check if virtual FTP user {{ item.name }} exists + command: pure-pw show {{ item.name }} + register: r_userexists + when: r_passwd.stat.exists + changed_when: "r_userexists.rc != 0" + ignore_errors: true + +- name: Create virtual FTP user {{ item.name }} + expect: + command: pure-pw useradd {{ item.name }} -u {{ pure_ftpd_user }} -g {{ pure_ftpd_group }} -d {{ item.dir | default( pure_ftpd_root ) }} -m + responses: + (?i)password: "{{ item.password }}" + (?i)enter it again: "{{ item.password }}" + when: (r_userexists|failed) or (not r_passwd.stat.exists) + +- name: Update virtual FTP user {{ item.name }} + command: pure-pw usermod {{ item.name }} -u {{ pure_ftpd_user }} -g {{ pure_ftpd_group }} -d {{ item.dir | default( pure_ftpd_root ) }} -m + when: r_userexists|success + +- name: Update virtual FTP user {{ item.name }} password + expect: + command: pure-pw passwd {{ item.name }} + responses: + (?i)password: "{{ item.password }}" + (?i)enter it again: "{{ item.password }}" + when: r_userexists|success \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tests/inventory b/ansible/playbooks/roles/robgmills.pure-ftpd/tests/inventory new file mode 100644 index 0000000..d18580b --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tests/inventory @@ -0,0 +1 @@ +localhost \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tests/test.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/tests/test.yml new file mode 100644 index 0000000..e0c20b6 --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - role: ansible-pure-ftpd \ No newline at end of file diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/vars/Debian.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/vars/Debian.yml new file mode 100644 index 0000000..1ef37ff --- /dev/null +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/vars/Debian.yml @@ -0,0 +1,6 @@ +--- +__ftp_root: "/etc/pure-ftpd" +__ftp_passwd: "{{ __ftp_root }}/pureftpd.passwd" +__ftp_conf_root: "{{ __ftp_root }}/conf" +__ftp_user_db: "{{ __ftp_conf_root }}/PureDB" +__ftp_user_db_sym: "{{ __ftp_root }}/auth/60puredb" \ No newline at end of file From 0d3d6eb22ea8d35cf0e91260a3b56b048ce8958a Mon Sep 17 00:00:00 2001 From: Fabio Sinibaldi Date: Thu, 25 Sep 2025 15:51:32 +0200 Subject: [PATCH 41/41] Fixed "include" -> "include_tasks" --- ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml index 007b9fa..bd46223 100644 --- a/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml +++ b/ansible/playbooks/roles/robgmills.pure-ftpd/tasks/main.yml @@ -4,7 +4,7 @@ include_vars: "{{ ansible_os_family }}.yml" # Setup/install tasks. -- include: setup-Debian.yml +- include_tasks: setup-Debian.yml when: ansible_os_family == 'Debian' # Pure-FTPd setup @@ -18,11 +18,11 @@ file: dest={{ pure_ftpd_root }} mode=0755 state=directory owner={{ pure_ftpd_user }} group={{ pure_ftpd_group }} # Create and/or install SSL certificate -- include: tls.yml +- include_tasks: tls.yml when: pure_ftpd_tls # Create the virtual FTP users and set their passwords -- include: virtual-user.yml +- include_tasks: virtual-user.yml with_items: "{{ pure_ftpd_vusers }}" - name: Link virtual FTP user database to the correct location