Compare commits
No commits in common. "main" and "transcaffeine/user" have entirely different histories.
main
...
transcaffe
12
galaxy.yml
12
galaxy.yml
@ -1,28 +1,20 @@
|
||||
namespace: finallycoffee
|
||||
name: base
|
||||
version: 0.3.0
|
||||
version: 0.2.1
|
||||
readme: README.md
|
||||
authors:
|
||||
- transcaffeine <transcaffeine@finally.coffee>
|
||||
description: >-2
|
||||
Roles for base services which are core functionality like managing packages
|
||||
and ssh or common dependencies other services like databases
|
||||
description: Roles for base services which are common dependencies other services like databases
|
||||
dependencies:
|
||||
"community.docker": "^4.2.0"
|
||||
"community.general": "^10.0.0"
|
||||
license_file: LICENSE.md
|
||||
build_ignore:
|
||||
- '*.tar.gz'
|
||||
repository: https://git.finally.coffee/finallycoffee/base
|
||||
issues: https://codeberg.org/finallycoffee/ansible-collection-base/issues
|
||||
tags:
|
||||
- bootstrap
|
||||
- ssh
|
||||
- mosh
|
||||
- docker
|
||||
- lego
|
||||
- minio
|
||||
- nginx
|
||||
- restic
|
||||
- user_management
|
||||
- openldap
|
||||
|
||||
@ -1,78 +0,0 @@
|
||||
---
|
||||
- name: Bootstrap everything needed for an ansible connection
|
||||
hosts: "{{ target_hosts | default('all', true) }}"
|
||||
become: "{{ target_host_become | default(true, false) }}"
|
||||
gather_facts: false
|
||||
pre_tasks:
|
||||
- name: Gather information about the target system id
|
||||
ansible.builtin.raw: "cat /etc/os-release | grep '^ID=' | cut -d '=' -f2"
|
||||
register: target_host_os_info
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
- name: Set /etc/os-release system id
|
||||
ansible.builtin.set_fact:
|
||||
target_host_system_id: "{{ target_host_os_info.stdout_lines | first | trim }}"
|
||||
delegate_to: localhost
|
||||
- name: Gather information about the target system version
|
||||
ansible.builtin.raw: "cat /etc/os-release | grep '^VERSION_ID=' | cut -d '=' -f2"
|
||||
register: target_host_os_info_version
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
- name: Set /etc/os-release system version id
|
||||
ansible.builtin.set_fact:
|
||||
target_host_system_version_id: "{{ target_host_os_info_version.stdout_lines | first | trim }}"
|
||||
delegate_to: localhost
|
||||
|
||||
tasks:
|
||||
- name: Ensure apt bootstrap packages are installed
|
||||
ansible.builtin.raw: "apt install {{ apt_bootstrap_packages | join(' ') }}"
|
||||
register: target_host_apt_info
|
||||
when: target_host_system_id in targets_using_apt
|
||||
changed_when:
|
||||
- "'0 upgraded' not in target_host_apt_info.stdout_lines | last"
|
||||
- "'0 newly installed' not in target_host_apt_info.stdout_lines | last"
|
||||
- name: Ensure dnf < 4 bootstrap packages are installed
|
||||
ansible.builtin.raw: "dnf install --assumeyes {{ dnf4_bootstrap_packages | join(' ') }}"
|
||||
register: target_host_dnf_info
|
||||
when:
|
||||
- target_host_system_id in targets_using_dnf4.keys()
|
||||
- target_host_system_version_id | int < targets_using_dnf4[target_host_system_id]
|
||||
changed_when:
|
||||
- "(target_host_dnf_info.stdout_lines | last) != 'Nothing to do.'"
|
||||
- name: Ensure dnf5 bootstrap packages are installed
|
||||
ansible.builtin.raw: "dnf install --assumeyes {{ dnf5_bootstrap_packages | join(' ') }}"
|
||||
register: target_host_dnf_info
|
||||
when:
|
||||
- target_host_system_id in targets_using_dnf5.keys()
|
||||
- target_host_system_version_id | int >= targets_using_dnf5[target_host_system_id]
|
||||
changed_when:
|
||||
- "(target_host_dnf_info.stdout_lines | last) != 'Nothing to do.'"
|
||||
- name: Sort hosts into os-specific groups
|
||||
ansible.builtin.group_by:
|
||||
key: >-2
|
||||
{{ (os_group_prefix
|
||||
| default(false, true)
|
||||
| ternary(os_group_prefix | default('') + (os_group_seperator | default('_')), ''))
|
||||
+ target_host_system_id }}
|
||||
when: target_hosts_sort_into_system_ids | default(false, true)
|
||||
changed_when: false
|
||||
delegate_to: localhost
|
||||
vars:
|
||||
targets_using_apt:
|
||||
- debian
|
||||
- ubuntu
|
||||
apt_bootstrap_packages:
|
||||
- python3
|
||||
- python3-apt
|
||||
# default package manager is dnf5 since fedora 41
|
||||
# https://fedoraproject.org/wiki/Changes/SwitchToDnf5#Current_status
|
||||
targets_using_dnf4:
|
||||
fedora: 41
|
||||
targets_using_dnf5:
|
||||
fedora: 41
|
||||
dnf4_bootstrap_packages:
|
||||
- python3
|
||||
- python3-dnf
|
||||
- python3-libdnf
|
||||
dnf5_bootstrap_packages:
|
||||
- python3-libdnf5
|
||||
@ -1,6 +0,0 @@
|
||||
---
|
||||
- name: Install and configure docker daemon
|
||||
hosts: "{{ docker_hosts | default('docker', true) }}"
|
||||
become: "{{ docker_become | default(false, true) }}"
|
||||
roles:
|
||||
- role: finallycoffee.base.docker
|
||||
@ -1,16 +0,0 @@
|
||||
---
|
||||
- name: Manage docker registry credentials
|
||||
hosts: "{{ docker_hosts | default('docker', true) }}"
|
||||
become: "{{ docker_become | default(false) }}"
|
||||
gather_facts: "{{ docker_registry_gather_facts | default(true) }}"
|
||||
tasks:
|
||||
- name: Manage docker registry credentials
|
||||
community.docker.docker_login:
|
||||
registry_url: "{{ docker_registry.registry }}"
|
||||
username: "{{ docker_registry.username | default(omit) }}"
|
||||
password: "{{ docker_registry.password | default(omit) }}"
|
||||
state: "{{ docker_registry.state | default('present') }}"
|
||||
loop: "{{ docker_registries | default([], true) }}"
|
||||
loop_control:
|
||||
loop_var: "docker_registry"
|
||||
label: "{{ docker_registry.username}}@{{ docker_registry.registry }}"
|
||||
@ -1,109 +0,0 @@
|
||||
---
|
||||
- name: Configure LDAP directory information tree
|
||||
hosts: "{{ ldap_hosts | default('ldap') }}"
|
||||
become: "{{ ldap_become | default(false) }}"
|
||||
gather_facts: "{{ ldap_gather_facts | default(false) }}"
|
||||
vars:
|
||||
_state: "{{ ldap_state | default('present') }}"
|
||||
_ldap_bind_info: &ldap_bind_info
|
||||
server_uri: "{{ ldap_server_uri }}"
|
||||
bind_dn: "{{ ldap_bind_dn }}"
|
||||
bind_pw: "{{ ldap_bind_pw }}"
|
||||
roles:
|
||||
# Ensure all defaults from openldap role are in scope
|
||||
- role: finallycoffee.base.openldap
|
||||
when: false
|
||||
tasks:
|
||||
- name: Ensure org units in '{{ ldap_base_dn }}' are {{ _state }}
|
||||
community.general.ldap_entry:
|
||||
<<: *ldap_bind_info
|
||||
dn: "ou={{ org_unit }},{{ ldap_base_dn }}"
|
||||
objectClass: "organizationalUnit"
|
||||
state: "{{ _state }}"
|
||||
loop: "{{ ldap_org_units | default([], true) }}"
|
||||
loop_control:
|
||||
loop_var: org_unit
|
||||
|
||||
- name: Ensure admin user is {{ _state }}
|
||||
community.general.ldap_entry:
|
||||
<<: *ldap_bind_info
|
||||
dn: "uid={{ ldap_admin_user_rdn }},{{ ldap_admin_user_base }}"
|
||||
objectClass: "{{ ldap_admin_user_object_classes }}"
|
||||
attributes: "{{ ldap_admin_user_attributes }}"
|
||||
state: "{{ _state }}"
|
||||
vars:
|
||||
ldap_admin_user_base: >-2
|
||||
{{ ldap_admin_user_base_dn | default(ldap_base_dn, true) }}
|
||||
when: ldap_admin_user_rdn is defined
|
||||
|
||||
- name: Ensure admin user attributes are correct
|
||||
community.general.ldap_attrs:
|
||||
<<: *ldap_bind_info
|
||||
dn: "uid={{ ldap_admin_user_rdn }},{{ ldap_admin_user_base }}"
|
||||
attributes: "{{ ldap_admin_user_attributes }}"
|
||||
state: "{{ _state }}"
|
||||
vars:
|
||||
ldap_admin_user_base: >-2
|
||||
{{ ldap_admin_user_base_dn | default(ldap_base_dn, true) }}
|
||||
when:
|
||||
- ldap_admin_user_rdn is defined
|
||||
- _state == 'present'
|
||||
|
||||
- name: Ensure ldap groups are {{ _state }}
|
||||
community.general.ldap_entry:
|
||||
<<: *ldap_bind_info
|
||||
dn: "{{ _ldap_group_dn }}"
|
||||
objectClass: "{{ _ldap_group_object_classes }}"
|
||||
attributes: "{{ _ldap_group_attributes }}"
|
||||
state: "{{ _state }}"
|
||||
vars:
|
||||
_ldap_group_dn: >-2
|
||||
cn={{ _ldap_group.name }},{{ ldap_group_base_dn }}
|
||||
_ldap_group_object_classes:
|
||||
- "groupOfNames"
|
||||
_ldap_group_attributes:
|
||||
cn: "{{ _ldap_group.name }}"
|
||||
member: >-2
|
||||
{{ _ldap_group.members | default([]) }}
|
||||
loop: "{{ ldap_groups | default([], true) }}"
|
||||
loop_control:
|
||||
loop_var: _ldap_group
|
||||
label: "{{ _ldap_group.name }}"
|
||||
when:
|
||||
- ldap_groups is defined
|
||||
- ldap_group_base_dn is defined
|
||||
|
||||
- name: Ensure service accounts are {{ _state }}
|
||||
community.general.ldap_entry:
|
||||
<<: *ldap_bind_info
|
||||
dn: "{{ _ldap_service_account_dn }}"
|
||||
objectClass: "{{ _ldap_service_account_object_classes }}"
|
||||
attributes: "{{ _ldap_service_account_attributes }}"
|
||||
state: "{{ _state }}"
|
||||
loop: &ldap_service_account_loop "{{ ldap_service_accounts | default([]) }}"
|
||||
loop_control: &ldap_service_account_loop_control
|
||||
loop_var: "_ldap_service_account"
|
||||
label: "{{ _ldap_service_account.name }}"
|
||||
vars: &ldap_service_account_vars
|
||||
_ldap_service_account_dn: >-2
|
||||
uid={{ _ldap_service_account.name }},{{ ldap_service_account_base_dn }}
|
||||
_ldap_service_account_object_classes:
|
||||
- "account"
|
||||
- "simpleSecurityObject"
|
||||
_ldap_service_account_attributes:
|
||||
uid: "{{ _ldap_service_account.name }}"
|
||||
userPassword: "{{ _ldap_service_account.password }}"
|
||||
when: &ldap_service_account_when
|
||||
- ldap_service_accounts is defined
|
||||
- ldap_service_account_base_dn is defined
|
||||
|
||||
- name: Ensure service accounts attributes are correct
|
||||
community.general.ldap_attrs:
|
||||
<<: *ldap_bind_info
|
||||
dn: "{{ _ldap_service_account_dn }}"
|
||||
attributes: "{{ _ldap_service_account_attributes }}"
|
||||
state: exact
|
||||
loop: *ldap_service_account_loop
|
||||
loop_control: *ldap_service_account_loop_control
|
||||
vars: *ldap_service_account_vars
|
||||
when: *ldap_service_account_when
|
||||
@ -1,6 +0,0 @@
|
||||
---
|
||||
- name: Manage and configure mosh
|
||||
hosts: "{{ mosh_hosts | default('mosh', true) }}"
|
||||
become: "{{ mosh_become | default(true) }}"
|
||||
roles:
|
||||
- role: finallycoffee.base.mosh
|
||||
@ -1,7 +0,0 @@
|
||||
---
|
||||
- name: Deploy and configure openLDAP
|
||||
hosts: "{{ openldap_hosts | default('openldap', true) }}"
|
||||
become: "{{ openldap_become | default(true) }}"
|
||||
gather_facts: "{{ openldap_playbook_gather_facts | default(false) }}"
|
||||
roles:
|
||||
- role: finallycoffee.base.openldap
|
||||
@ -1,7 +0,0 @@
|
||||
---
|
||||
- name: Ensure openssh is installed and configured
|
||||
hosts: "{{ openssh_target | default('openssh') }}"
|
||||
become: "{{ openssh_become | default(true) }}"
|
||||
gather_facts: "{{ openssh_gather_facts | default(true) }}"
|
||||
roles:
|
||||
- role: finallycoffee.base.openssh
|
||||
@ -1,24 +0,0 @@
|
||||
---
|
||||
- name: Install system packages on the remote
|
||||
hosts: "{{ target_hosts | default('all', true) }}"
|
||||
become: "{{ target_host_become | default(true, true) }}"
|
||||
gather_facts: "{{ target_host_gather_facts | default(true, true) }}"
|
||||
tasks:
|
||||
- name: Install packages (apt)
|
||||
ansible.builtin.apt:
|
||||
package: "{{ package.name }}"
|
||||
state: "{{ package.state | default('present') }}"
|
||||
loop: "{{ system_packages | default([], true) }}"
|
||||
loop_control:
|
||||
loop_var: package
|
||||
label: "{{ package.name }}"
|
||||
when: ansible_facts['pkg_mgr'] == 'apt'
|
||||
- name: Install packages (dnf)
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ package.name }}"
|
||||
state: "{{ package.state | default('present') }}"
|
||||
loop: "{{ system_packages | default([], true) }}"
|
||||
loop_control:
|
||||
loop_var: package
|
||||
label: "{{ package.name }}"
|
||||
when: ansible_facts['pkg_mgr'] in ['dnf', 'dnf5', 'yum']
|
||||
@ -1,13 +0,0 @@
|
||||
# `finallycoffee.base.docker` ansible role
|
||||
|
||||
Install and configure the docker daemon.
|
||||
|
||||
## Configuration
|
||||
|
||||
- `docker_daemon_config` - configuration for the docker daemon
|
||||
- `docker_remove_legacy_packages` - clean up old versions of docker (see https://docs.docker.com/engine/install/debian/#uninstall-old-versions)
|
||||
|
||||
## Plugins
|
||||
|
||||
- `docker_plugin_buildx_enable` - enable the buildx plugin
|
||||
- `docker_plugin_compose_enable` - enable docker compose
|
||||
@ -1,31 +0,0 @@
|
||||
---
|
||||
docker_apt_key_url: "https://download.docker.com/linux/debian/gpg"
|
||||
docker_apt_key_id: "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
|
||||
|
||||
docker_apt_arch: amd64
|
||||
docker_apt_release_channel: stable
|
||||
docker_apt_repository_url: "https://download.docker.com/linux/debian"
|
||||
docker_apt_repository: >-2
|
||||
deb [arch={{ docker_apt_arch }}] {{ docker_apt_repository_url }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}
|
||||
docker_apt_cli_package: "docker-ce-cli"
|
||||
docker_apt_plugin_buildx_package: "docker-buildx-plugin"
|
||||
docker_apt_plugin_compose_package: "docker-compose-plugin"
|
||||
docker_apt_base_packages:
|
||||
- "docker-ce"
|
||||
- "docker-ce-cli"
|
||||
- "containerd.io"
|
||||
docker_apt_packages: >-2
|
||||
{{
|
||||
docker_apt_base_packages
|
||||
+ (docker_plugin_buildx_enable | default(false)
|
||||
| ternary([ docker_apt_plugin_buildx_package ], []))
|
||||
+ (docker_plugin_compose_enable | default(false)
|
||||
| ternary([ docker_apt_plugin_compose_package ], []))
|
||||
}}
|
||||
docker_apt_legacy_packages:
|
||||
- "docker.io"
|
||||
- "docker-compose"
|
||||
- "docker-doc"
|
||||
- "podman-docker"
|
||||
- "containerd"
|
||||
- "runc"
|
||||
@ -1,34 +0,0 @@
|
||||
---
|
||||
docker_fedora_repo_name: "docker-ce-stable"
|
||||
docker_fedora_repo_description: "Docker CE Stable - $basearch"
|
||||
docker_fedora_repo_url: "https://download.docker.com/linux/fedora/$releasever/$basearch/stable"
|
||||
docker_fedora_repo_validate_certs: true
|
||||
docker_fedora_repo_gpg_check: true
|
||||
docker_fedora_repo_gpg_key: "https://download.docker.com/linux/fedora/gpg"
|
||||
|
||||
docker_fedora_cli_package: "docker-ce-cli"
|
||||
docker_fedora_plugin_buildx_package: "docker-buildx-plugin"
|
||||
docker_fedora_plugin_compose_package: "docker-compose-plugin"
|
||||
docker_fedora_base_packages:
|
||||
- "docker-ce"
|
||||
- "docker-ce-cli"
|
||||
- "containerd.io"
|
||||
docker_fedora_packages: >-2
|
||||
{{
|
||||
docker_fedora_base_packages
|
||||
+ (docker_plugin_buildx_enable | default(false)
|
||||
| ternary([ docker_fedora_plugin_buildx_package ], []))
|
||||
+ (docker_plugin_compose_enable | default(false)
|
||||
| ternary([ docker_fedora_plugin_compose_package ], []))
|
||||
}}
|
||||
docker_fedora_legacy_packages:
|
||||
- "docker"
|
||||
- "docker-client"
|
||||
- "docker-client-latest"
|
||||
- "docker-common"
|
||||
- "docker-latest"
|
||||
- "docker-latest-logrotate"
|
||||
- "docker-logrotate"
|
||||
- "docker-selinux"
|
||||
- "docker-engine-selinux"
|
||||
- "docker-engine"
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
docker_state: "present"
|
||||
|
||||
docker_daemon_config: {}
|
||||
docker_daemon_config_file: "/etc/docker/daemon.json"
|
||||
docker_daemon_config_file_mode: "0644"
|
||||
docker_daemon_config_owner: root
|
||||
docker_daemon_config_group: "{{ docker_daemon_config_owner }}"
|
||||
|
||||
docker_plugin_buildx_enable: false
|
||||
docker_plugin_compose_enable: false
|
||||
|
||||
docker_remove_legacy_packages: true
|
||||
@ -1,5 +0,0 @@
|
||||
---
|
||||
docker_systemd_service_name: "docker.service"
|
||||
docker_systemd_service_state: >-2
|
||||
{{ (docker_state == 'present') | ternary('started', 'stopped') }}
|
||||
docker_systemd_service_enabled: "{{ (docker_state == 'present') }}"
|
||||
@ -1,6 +0,0 @@
|
||||
---
|
||||
- name: Restart docker daemon
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ docker_systemd_service_name }}"
|
||||
state: "restarted"
|
||||
listen: "docker-restart"
|
||||
@ -1,18 +0,0 @@
|
||||
---
|
||||
- name: Ensure config directory '{{ docker_daemon_config_file | dirname }}' is present
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_daemon_config_file | dirname }}"
|
||||
state: "directory"
|
||||
mode: "0755"
|
||||
owner: "{{ docker_daemon_config_owner }}"
|
||||
group: "{{ docker_daemon_config_group }}"
|
||||
|
||||
- name: Configure docker daemon using '{{ docker_daemon_config_file }}'
|
||||
ansible.builtin.copy:
|
||||
content: "{{ docker_daemon_config | to_nice_json }}"
|
||||
dest: "{{ docker_daemon_config_file }}"
|
||||
mode: "{{ docker_daemon_config_file_mode }}"
|
||||
owner: "{{ docker_daemon_config_owner }}"
|
||||
group: "{{ docker_daemon_config_group }}"
|
||||
when: docker_daemon_config | string | length > 0
|
||||
notify: docker-restart
|
||||
@ -1,30 +0,0 @@
|
||||
---
|
||||
- name: Ensure legacy docker packages are removed
|
||||
ansible.builtin.apt:
|
||||
name: "{{ docker_apt_legacy_packages }}"
|
||||
state: absent
|
||||
when: docker_remove_legacy_packages
|
||||
|
||||
- name: Add apt key for docker repository
|
||||
ansible.builtin.apt_key:
|
||||
id: "{{ docker_apt_key_id }}"
|
||||
url: "{{ docker_apt_key_url }}"
|
||||
state: "{{ docker_state }}"
|
||||
|
||||
- name: Add apt repository for docker
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "{{ docker_apt_repository }}"
|
||||
state: "{{ docker_state }}"
|
||||
register: docker_apt_repository_info
|
||||
|
||||
- name: Update apt cache if repository was newly added
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
when:
|
||||
- docker_state == 'present'
|
||||
- docker_apt_repository_info.changed
|
||||
|
||||
- name: Install apt packages for docker
|
||||
ansible.builtin.apt:
|
||||
name: "{{ docker_apt_packages }}"
|
||||
state: "{{ docker_state }}"
|
||||
@ -1,21 +0,0 @@
|
||||
---
|
||||
- name: Ensure legacy docker packages are removed
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ docker_fedora_legacy_packages }}"
|
||||
state: "removed"
|
||||
when: docker_remove_legacy_packages
|
||||
|
||||
- name: Ensure dnf repository for docker is {{ docker_state }}
|
||||
ansible.builtin.yum_repository:
|
||||
name: "{{ docker_fedora_repo_name }}"
|
||||
description: "{{ docker_fedora_repo_description }}"
|
||||
baseurl: "{{ docker_fedora_repo_url }}"
|
||||
validate_certs: "{{ docker_fedora_repo_validate_certs }}"
|
||||
gpgkey: "{{ docker_fedora_repo_gpg_key }}"
|
||||
gpgcheck: "{{ docker_fedora_repo_gpg_check }}"
|
||||
state: "{{ docker_state }}"
|
||||
|
||||
- name: Install dnf packages for docker
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ docker_fedora_packages }}"
|
||||
state: "{{ docker_state }}"
|
||||
@ -1,29 +0,0 @@
|
||||
---
|
||||
- name: Check if target OS is supported
|
||||
ansible.builtin.fail:
|
||||
msg: >-2
|
||||
OS '{{ docker_os }}' is not supported!
|
||||
when: docker_os not in docker_supported_oses
|
||||
vars:
|
||||
docker_os: "{{ ansible_distribution | lower }}"
|
||||
|
||||
- name: Ensure docker is {{ docker_state }} on {{ ansible_distribution }}
|
||||
ansible.builtin.include_tasks:
|
||||
file: "install-{{ ansible_distribution | lower }}.yml"
|
||||
|
||||
- name: Configure docker daemon
|
||||
ansible.builtin.include_tasks:
|
||||
file: "configure.yml"
|
||||
when: docker_state == 'present'
|
||||
|
||||
- name: Ensure docker daemon is {{ docker_systemd_service_enabled | ternary('enabled', 'disabled') }}
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ docker_systemd_service_name }}"
|
||||
enabled: "{{ docker_systemd_service_enabled }}"
|
||||
when: ansible_facts['service_mgr'] == 'systemd'
|
||||
|
||||
- name: Ensure docker daemon is {{ docker_systemd_service_state }}
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ docker_systemd_service_name }}"
|
||||
state: "{{ docker_systemd_service_state }}"
|
||||
when: ansible_facts['service_mgr'] == 'systemd'
|
||||
@ -1,4 +0,0 @@
|
||||
---
|
||||
docker_supported_oses:
|
||||
- 'debian'
|
||||
- 'fedora'
|
||||
@ -107,7 +107,6 @@
|
||||
{{ entry.key }}={{ entry.value }}
|
||||
{% endfor %}
|
||||
dest: "{{ lego_base_path }}/{{ lego_instance }}.conf"
|
||||
register: lego_env_file_info
|
||||
|
||||
- name: Ensure timer unit is templated
|
||||
ansible.builtin.template:
|
||||
@ -121,7 +120,6 @@
|
||||
src: "lego_run.sh"
|
||||
dest: "{{ lego_base_path }}/run.sh"
|
||||
mode: "0755"
|
||||
register: lego_handler_script_info
|
||||
|
||||
- name: Ensure per-instance base path is created
|
||||
ansible.builtin.file:
|
||||
@ -161,18 +159,7 @@
|
||||
name: "{{ lego_systemd_timer_name }}"
|
||||
state: "started"
|
||||
|
||||
- name: Check if certificates are present
|
||||
ansible.builtin.find:
|
||||
path: "{{ lego_instance_path }}/certificates"
|
||||
recurse: false
|
||||
file_type: "file"
|
||||
register: lego_certificate_info
|
||||
|
||||
- name: Ensure systemd service is started once to obtain the certificate
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ lego_systemd_service_name }}"
|
||||
state: "started"
|
||||
when: >-2
|
||||
lego_handler_script_info.changed
|
||||
or lego_env_file_info.changed
|
||||
or lego_certificate_info.files | default([]) | length == 0
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
minio_container_name: minio
|
||||
minio_container_image_name: "docker.io/minio/minio"
|
||||
minio_container_image_tag: "RELEASE.2025-04-22T22-12-26Z"
|
||||
minio_container_image_tag: "RELEASE.2025-04-08T15-41-24Z"
|
||||
minio_container_image: "{{ minio_container_image_name }}:{{ minio_container_image_tag }}"
|
||||
minio_container_networks: []
|
||||
minio_container_ports: []
|
||||
|
||||
@ -1,4 +0,0 @@
|
||||
# `finallycoffee.base.mosh`
|
||||
|
||||
Installs [`mosh`](https://mosh.org/#), a remote 'mobile shell' which supports
|
||||
roaming and re-uses SSH for the authentication layer.
|
||||
@ -1,2 +0,0 @@
|
||||
---
|
||||
mosh_state: present
|
||||
@ -1,15 +0,0 @@
|
||||
---
|
||||
mosh_debian_packages:
|
||||
- "mosh"
|
||||
- "openssh-server"
|
||||
mosh_fedora_packages:
|
||||
- "mosh"
|
||||
- "openssh-server"
|
||||
mosh_archlinux_packages:
|
||||
- "mosh"
|
||||
- "openssh"
|
||||
|
||||
mosh_packages:
|
||||
debian: "{{ mosh_debian_packages }}"
|
||||
fedora: "{{ mosh_fedora_packages }}"
|
||||
archlinux: "{{ mosh_archlinux_packages }}"
|
||||
@ -1,30 +0,0 @@
|
||||
---
|
||||
- name: Ensure mosh is {{ mosh_state }} (dnf)
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ mosh_packages[_key] }}"
|
||||
state: "{{ mosh_state }}"
|
||||
when:
|
||||
- ansible_facts['pkg_mgr'] in ['dnf', 'dnf5']
|
||||
- _key in mosh_packages.keys()
|
||||
vars:
|
||||
_key: "{{ ansible_distribution | lower }}"
|
||||
|
||||
- name: Ensure mosh is {{ mosh_state }} (apt)
|
||||
ansible.builtin.apt:
|
||||
package: "{{ mosh_packages[_key] }}"
|
||||
state: "{{ mosh_state }}"
|
||||
when:
|
||||
- ansible_facts['pkg_mgr'] in ['apt']
|
||||
- _key in mosh_packages.keys()
|
||||
vars:
|
||||
_key: "{{ ansible_distribution | lower }}"
|
||||
|
||||
- name: Ensure mosh is {{ mosh_state }} (pacman)
|
||||
community.general.pacman:
|
||||
name: "{{ mosh_packages[_key] }}"
|
||||
state: "{{ mosh_state }}"
|
||||
when:
|
||||
- ansible_facts['pkg_mgr'] in ['pacman']
|
||||
- _key in mosh_packages.keys()
|
||||
vars:
|
||||
_key: "{{ ansible_distribution | lower }}"
|
||||
@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Ensure 'mosh_state' is valid
|
||||
ansible.builtin.fail:
|
||||
msg: >-2
|
||||
Invalid state '{{ mosh_state }}' for 'mosh_state'!
|
||||
Allowed states are {{ mosh_states | join(', ') }}.
|
||||
when: mosh_state not in mosh_states
|
||||
|
||||
- name: Ensure mosh is {{ mosh_state }}
|
||||
ansible.builtin.include_tasks:
|
||||
file: "install.yml"
|
||||
@ -1,4 +0,0 @@
|
||||
---
|
||||
mosh_states:
|
||||
- "present"
|
||||
- "absent"
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
nginx_version: "1.28.0"
|
||||
nginx_version: "1.27.5"
|
||||
nginx_flavour: alpine
|
||||
nginx_base_path: /opt/nginx
|
||||
nginx_config_file: "{{ nginx_base_path }}/nginx.conf"
|
||||
|
||||
@ -1,3 +0,0 @@
|
||||
# `finallycoffee.base.openldap` ansible role
|
||||
|
||||
Deploy and configure [OpenLDAP](https://www.openldap.org/).
|
||||
@ -1,61 +0,0 @@
|
||||
---
|
||||
openldap_container_name: "openldap"
|
||||
openldap_container_image_registry: docker.finally.coffee
|
||||
openldap_container_image_namespace: containers
|
||||
openldap_container_image_name: "openldap"
|
||||
openldap_container_image_tag: ~
|
||||
openldap_container_image_source: "pull"
|
||||
openldap_container_image_force_source: >-2
|
||||
{{ openldap_container_image_tag | default(false, true) }}
|
||||
openldap_container_image_repository: >-2
|
||||
{{
|
||||
[
|
||||
openldap_container_image_registry | default([], true),
|
||||
openldap_container_image_namespace | default([], true),
|
||||
openldap_container_image_name
|
||||
] | flatten | join('/')
|
||||
}}
|
||||
openldap_container_image: >-2
|
||||
{{
|
||||
[
|
||||
openldap_container_image_repository,
|
||||
openldap_container_image_tag
|
||||
| default(openldap_alpine_package_version, true),
|
||||
] | join(':')
|
||||
}}
|
||||
openldap_container_env: ~
|
||||
openldap_container_user: ~
|
||||
openldap_container_ports: ~
|
||||
openldap_container_labels: ~
|
||||
openldap_container_volumes: ~
|
||||
openldap_container_networks: ~
|
||||
openldap_container_network_mode: ~
|
||||
openldap_container_dns_servers: ~
|
||||
openldap_container_etc_hosts: ~
|
||||
openldap_container_ulimits:
|
||||
- "nofile:{{ openldap_fd_soft_limit }}:{{ openldap_fd_hard_limit }}"
|
||||
openldap_container_memory: "256M"
|
||||
openldap_container_memory_swap: ~
|
||||
openldap_container_memory_reservation: "128M"
|
||||
openldap_container_restart_policy: "on-failure"
|
||||
openldap_container_state: >-2
|
||||
{{ (openldap_state == 'present') | ternary('started', 'absent') }}
|
||||
|
||||
openldap_container_data_path: "{{ openldap_data_path }}"
|
||||
openldap_container_config_path: "{{ openldap_config_path }}"
|
||||
openldap_container_socket_path: "{{ openldap_socket_path }}"
|
||||
openldap_container_base_volumes:
|
||||
- "{{ openldap_config_path }}:{{ openldap_container_config_path }}:Z"
|
||||
- "{{ openldap_data_path }}:{{ openldap_container_data_path }}:rw"
|
||||
- "{{ openldap_socket_path }}:{{ openldap_container_socket_path }}:rw"
|
||||
openldap_container_all_volumes: >-2
|
||||
{{ openldap_container_base_volumes | default([], true)
|
||||
+ openldap_container_volumes | default([], true) }}
|
||||
openldap_init_container_volumes:
|
||||
- "{{ [openldap_slapd_path, openldap_slapd_path, 'ro'] | join(':') }}"
|
||||
|
||||
openldap_container_healthcheck:
|
||||
test: >-2
|
||||
[[ $(netstat -plnte | grep slapd | wc -l) -ge 1 ]]
|
||||
&& [[ $(ps aux | grep slapd | wc -l) -ge 1 ]]
|
||||
|| exit 1
|
||||
@ -1,24 +0,0 @@
|
||||
---
|
||||
openldap_version: "2.6.8"
|
||||
openldap_alpine_revision: "0"
|
||||
openldap_alpine_package_version: >-2
|
||||
v{{ openldap_version }}-r{{ openldap_alpine_revision | string }}
|
||||
|
||||
openldap_domain: ~
|
||||
openldap_organization: ~
|
||||
|
||||
openldap_config_path: "/etc/openldap/"
|
||||
openldap_olc_path: "{{ openldap_config_path }}/{0}config"
|
||||
openldap_slapd_path: "{{ openldap_config_path }}/slapd.ldif"
|
||||
openldap_schema_path: "{{ openldap_config_path }}/schema"
|
||||
openldap_data_path: "/var/lib/openldap"
|
||||
openldap_socket_path: "/run/openldap"
|
||||
openldap_socket: "{{ openldap_socket_path }}/slapd.sock"
|
||||
openldap_socket_url: >-2
|
||||
ldapi://{{ openldap_socket | urlencode | replace('/', '%2F') }}
|
||||
|
||||
openldap_state: "present"
|
||||
openldap_deployment_method: "docker"
|
||||
|
||||
openldap_slapadd_init_command: >-2
|
||||
slapadd -v -F {{ openldap_olc_path }} -n 0 -l {{ openldap_slapd_path }}
|
||||
@ -1,65 +0,0 @@
|
||||
---
|
||||
openldap_dn: >-2
|
||||
dc={{ openldap_domain | regex_replace('\.', ',dc=') }}
|
||||
openldap_root_username: "admin"
|
||||
openldap_root_pw: ~
|
||||
openldap_root_node_object_classes:
|
||||
- "top"
|
||||
- "dcObject"
|
||||
- "organization"
|
||||
openldap_root_node_dc: "{{ openldap_domain | regex_replace('\\..+', '') }}"
|
||||
openldap_root_node_o: "{{ openldap_organization | default('not set!', true) }}"
|
||||
|
||||
openldap_fd_soft_limit: "8192"
|
||||
openldap_fd_hard_limit: "8192"
|
||||
|
||||
openldap_module_path: "/usr/lib/openldap"
|
||||
openldap_modules:
|
||||
- "mdb"
|
||||
- "hdb"
|
||||
|
||||
openldap_core_schema_path: "{{ openldap_schema_path }}/core.ldif"
|
||||
openldap_enabled_schemas:
|
||||
- name: "cosine"
|
||||
- name: "inetorgperson"
|
||||
openldap_additional_schemas: []
|
||||
openldap_schemas: >-2
|
||||
{{ openldap_enabled_schemas + openldap_additional_schemas }}
|
||||
|
||||
openldap_config_dn: "cn=config"
|
||||
openldap_config_db_dn: "olcDatabase={0}config,cn=config"
|
||||
openldap_config_db_olc_access:
|
||||
- '{0} to *
|
||||
by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
|
||||
by * none'
|
||||
openldap_config_attributes: {}
|
||||
openldap_config_db_attributes:
|
||||
olcAccess: "{{ openldap_config_db_olc_access }}"
|
||||
|
||||
openldap_default_indices:
|
||||
- "objectClass eq"
|
||||
openldap_indices: []
|
||||
|
||||
openldap_default_database_name: "mdb"
|
||||
openldap_default_database_object_class: "olcMdbConfig"
|
||||
openldap_default_database_suffix: "{{ openldap_dn }}"
|
||||
openldap_default_database_root_dn: >-2
|
||||
cn={{ openldap_root_username }},{{ openldap_default_database_suffix }}
|
||||
openldap_default_database_root_pw: "{{ openldap_root_pw }}"
|
||||
openldap_default_database_directory: >-2
|
||||
{{ openldap_data_path }}/{{ openldap_default_database_name }}
|
||||
openldap_default_database_indices: >-2
|
||||
{{ openldap_default_indices + openldap_indices }}
|
||||
openldap_default_database_config: >-2
|
||||
olcDatabase={1}{{ openldap_default_database_name }},{{ openldap_config_dn }}
|
||||
openldap_default_database:
|
||||
name: "{{ openldap_default_database_name }}"
|
||||
object_class: "{{ openldap_default_database_object_class }}"
|
||||
suffix: "{{ openldap_default_database_suffix }}"
|
||||
root_dn: "{{ openldap_default_database_root_dn }}"
|
||||
root_pw: "{{ openldap_default_database_root_pw }}"
|
||||
directory: "{{ openldap_default_database_directory }}"
|
||||
indices: "{{ openldap_default_database_indices }}"
|
||||
openldap_default_database_olc_access: "{{ openldap_config_db_olc_access }}"
|
||||
openldap_databases:
|
||||
- "{{ openldap_default_database }}"
|
||||
@ -1,80 +0,0 @@
|
||||
---
|
||||
- name: Ensure config attributes are configured
|
||||
community.general.ldap_attrs:
|
||||
dn: "{{ openldap_config_dn }}"
|
||||
attributes: "{{ { entry.key : entry.value } }}"
|
||||
state: exact
|
||||
server_uri: "{{ openldap_socket_url }}"
|
||||
loop: "{{ openldap_config_attributes | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: "entry"
|
||||
label: "{{ entry.key }}"
|
||||
|
||||
- name: Ensure config db attributes are configured
|
||||
community.general.ldap_attrs:
|
||||
dn: "{{ openldap_config_db_dn }}"
|
||||
attributes: "{{ { entry.key : entry.value } }}"
|
||||
state: exact
|
||||
server_uri: "{{ openldap_socket_url }}"
|
||||
loop: "{{ openldap_config_db_attributes | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: "entry"
|
||||
label: "{{ entry.key }}"
|
||||
|
||||
- name: Ensure ACLs for default database are configured
|
||||
community.general.ldap_attrs:
|
||||
dn: "{{ openldap_default_database_config }}"
|
||||
attributes:
|
||||
olcAccess: "{{ openldap_default_database_olc_access }}"
|
||||
state: "exact"
|
||||
server_uri: "{{ openldap_socket_url }}"
|
||||
retries: 3
|
||||
delay: 3
|
||||
register: openldap_acl_result
|
||||
until: openldap_acl_result is succeeded
|
||||
|
||||
- name: Ensure LDAP DIT is configured
|
||||
when:
|
||||
- openldap_default_database_root_dn is defined
|
||||
- openldap_default_database_root_pw is defined
|
||||
vars:
|
||||
_meta: &openldap_bind_info
|
||||
bind_dn: "{{ openldap_default_database_root_dn }}"
|
||||
bind_pw: "{{ openldap_default_database_root_pw }}"
|
||||
server_uri: "{{ openldap_socket_url }}"
|
||||
block:
|
||||
- name: Ensure rootDN + credentials are correct
|
||||
community.general.ldap_attrs:
|
||||
dn: "{{ openldap_default_database_config }}"
|
||||
attributes: "{{ {entry.key: entry.value} }}"
|
||||
state: "exact"
|
||||
server_uri: "{{ openldap_socket_url }}"
|
||||
no_log: "{{ entry.log is defined and not entry.log }}"
|
||||
loop:
|
||||
- key: "olcRootDN"
|
||||
value: "{{ openldap_default_database_root_dn }}"
|
||||
- key: "olcRootPW"
|
||||
value: "{{ openldap_default_database_root_pw }}"
|
||||
log: false
|
||||
loop_control:
|
||||
loop_var: "entry"
|
||||
label: "{{ entry.key }}"
|
||||
|
||||
- name: Ensure root node is {{ openldap_state }}
|
||||
community.general.ldap_entry:
|
||||
dn: "{{ openldap_dn }}"
|
||||
objectClass: "{{ openldap_root_node_object_classes }}"
|
||||
attributes:
|
||||
dc: "{{ openldap_root_node_dc }}"
|
||||
o: "{{ openldap_root_node_o }}"
|
||||
<<: *openldap_bind_info
|
||||
|
||||
- name: Ensure root node attributes are up to date
|
||||
community.general.ldap_attrs:
|
||||
dn: "{{ openldap_dn }}"
|
||||
attributes:
|
||||
dc: "{{ openldap_root_node_dc }}"
|
||||
o: "{{ openldap_root_node_o }}"
|
||||
state: exact
|
||||
<<: *openldap_bind_info
|
||||
when: openldap_state == 'present'
|
||||
@ -1,25 +0,0 @@
|
||||
---
|
||||
- name: Ensure container '{{ openldap_container_name }}' is {{ openldap_container_state }}
|
||||
community.docker.docker_container:
|
||||
name: "{{ openldap_container_name }}"
|
||||
image: "{{ openldap_container_image }}"
|
||||
env: "{{ openldap_container_env | default(omit, true) }}"
|
||||
user: "{{ openldap_container_user | default(omit, true) }}"
|
||||
ports: "{{ openldap_container_ports | default(omit, true) }}"
|
||||
labels: "{{ openldap_container_labels | default(omit, true) }}"
|
||||
volumes: "{{ openldap_container_all_volumes | default(omit, true) }}"
|
||||
networks: "{{ openldap_container_networks | default(omit, true) }}"
|
||||
network_mode: "{{ openldap_container_network_mode | default(omit, true) }}"
|
||||
dns_servers: "{{ openldap_container_dns_servers | default(omit, true) }}"
|
||||
etc_hosts: "{{ openldap_container_etc_hosts | default(omit, true) }}"
|
||||
command: "{{ openldap_container_command | default(omit, true) }}"
|
||||
ulimits: "{{ openldap_container_ulimits | default(omit, true) }}"
|
||||
memory: "{{ openldap_container_memory | default(omit, true) }}"
|
||||
memory_swap: "{{ openldap_container_memory_swap | default(omit, true) }}"
|
||||
memory_reservation: >-2
|
||||
{{ openldap_container_memory_reservation | default(omit, true) }}
|
||||
restart_policy: >-2
|
||||
{{ openldap_container_restart_policy | default(omit, true) }}
|
||||
healthcheck: "{{ openldap_container_healthcheck | default(omit, true) }}"
|
||||
state: "{{ openldap_container_state }}"
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
---
|
||||
- name: Ensure additional schemas are mapped to container
|
||||
ansible.builtin.set_fact:
|
||||
openldap_init_container_volumes: >-2
|
||||
{{ openldap_init_container_volumes + [ schema_mount ] }}
|
||||
vars:
|
||||
schema_file: "{{ openldap_schema_path }}/{{ schema.name }}.ldif"
|
||||
schema_mount: >-2
|
||||
{{ schema_file }}:{{ schema_file }}:ro
|
||||
loop: "{{ openldap_additional_schemas }}"
|
||||
loop_control:
|
||||
loop_var: "schema"
|
||||
label: "{{ schema.name }}"
|
||||
|
||||
- name: Ensure ldap container is initialized
|
||||
community.docker.docker_container:
|
||||
name: "{{ openldap_container_name }}"
|
||||
image: "{{ openldap_container_image }}"
|
||||
env: "{{ openldap_container_env | default(omit, true) }}"
|
||||
user: "{{ openldap_container_user | default(omit, true) }}"
|
||||
ports: "{{ openldap_container_ports | default(omit, true) }}"
|
||||
labels: "{{ openldap_container_labels | default(omit, true) }}"
|
||||
volumes: "{{ openldap_container_merged_volumes | default(omit, true) }}"
|
||||
networks: "{{ openldap_container_networks | default(omit, true) }}"
|
||||
network_mode: "{{ openldap_container_network_mode | default(omit, true) }}"
|
||||
dns_servers: "{{ openldap_container_dns_servers | default(omit, true) }}"
|
||||
etc_hosts: "{{ openldap_container_etc_hosts | default(omit, true) }}"
|
||||
memory: "{{ openldap_container_memory | default(omit, true) }}"
|
||||
memory_swap: "{{ openldap_container_memory_swap | default(omit, true) }}"
|
||||
memory_reservation: >-2
|
||||
{{ openldap_container_memory_reservation | default(omit, true) }}
|
||||
command: "{{ openldap_slapadd_init_command }}"
|
||||
detach: false
|
||||
cleanup: true
|
||||
vars:
|
||||
openldap_container_merged_volumes: >-2
|
||||
{{ openldap_container_all_volumes + openldap_init_container_volumes }}
|
||||
@ -1,47 +0,0 @@
|
||||
---
|
||||
- name: Determine if persisted OLC config exists
|
||||
ansible.builtin.stat:
|
||||
path: "{{ openldap_olc_path }}/cn=config"
|
||||
register: openldap_olc_stat_info
|
||||
|
||||
- name: Ensure openldap databases are initialized
|
||||
when: not openldap_olc_stat_info.stat.exists
|
||||
block:
|
||||
- name: Ensure initial slapd.ldif is templated
|
||||
ansible.builtin.template:
|
||||
src: "slapd.ldif.j2"
|
||||
dest: "{{ openldap_slapd_path }}"
|
||||
mode: "0644"
|
||||
- name: Ensure additional schemas to install are present
|
||||
ansible.builtin.copy:
|
||||
content: "{{ schema.content }}"
|
||||
dest: "{{ openldap_schema_path }}/{{ schema.name }}.ldif"
|
||||
mode: "0644"
|
||||
loop: "{{ openldap_additional_schemas }}"
|
||||
loop_control:
|
||||
loop_var: "schema"
|
||||
label: "{{ schema.name }}"
|
||||
- name: Ensure db data directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ openldap_default_database_directory }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
- name: Ensure container is initialized using {{ openldap_deployment_method }}
|
||||
ansible.builtin.include_tasks:
|
||||
file: "initialize-{{ openldap_deployment_method }}.yml"
|
||||
rescue:
|
||||
- name: Ensure temporary schema files are absent
|
||||
ansible.builtin.file:
|
||||
path: "{{ openldap_schema_path }}/{{ file.name }}.ldif"
|
||||
state: absent
|
||||
loop: >-2
|
||||
{{ openldap_additional_schemas }}
|
||||
loop_control:
|
||||
loop_var: "file"
|
||||
label: "{{ file.name }}"
|
||||
ignore_errors: true
|
||||
- name: Ensure intial slapd.ldif file is absent
|
||||
ansible.builtin.file:
|
||||
path: "{{ openldap_slapd_path }}"
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
@ -1,26 +0,0 @@
|
||||
---
|
||||
- name: Check if 'openldap_state' is valid
|
||||
ansible.builtin.fail:
|
||||
msg: >-2
|
||||
Invalid state '{{ openldap_state }}'!
|
||||
Supported states are {{ openldap_states | join(', ') }}.
|
||||
when: openldap_state not in openldap_states
|
||||
|
||||
- name: Check if 'openldap_deployment_method' is valid
|
||||
ansible.builtin.fail:
|
||||
msg: >-2
|
||||
Invalid state '{{ openldap_deployment_method }}'!
|
||||
Supported states are {{ openldap_deployment_methods | join(', ') }}.
|
||||
when: openldap_deployment_method not in openldap_deployment_methods
|
||||
|
||||
- name: Ensure openldap deployment is prepared
|
||||
ansible.builtin.include_tasks:
|
||||
file: "prepare-{{ openldap_deployment_method }}.yml"
|
||||
|
||||
- name: Ensure openldap is deployed using {{ openldap_deployment_method }}
|
||||
ansible.builtin.include_tasks:
|
||||
file: "deploy-{{ openldap_deployment_method }}.yml"
|
||||
|
||||
- name: Ensure openldap is configured
|
||||
ansible.builtin.include_tasks:
|
||||
file: "configure.yml"
|
||||
@ -1,7 +0,0 @@
|
||||
---
|
||||
- name: Ensure container image '{{ openldap_container_image }}' is {{ openldap_state }}
|
||||
community.docker.docker_image:
|
||||
name: "{{ openldap_container_image }}"
|
||||
state: "{{ openldap_state }}"
|
||||
source: "{{ openldap_container_image_source }}"
|
||||
force_source: "{{ openldap_container_image_force_source }}"
|
||||
@ -1,64 +0,0 @@
|
||||
dn: cn=config
|
||||
objectClass: olcGlobal
|
||||
cn: config
|
||||
olcPidFile: /run/openldap/slapd.pid
|
||||
olcArgsFile: /run/openldap/slapd.args
|
||||
|
||||
|
||||
# Dynamic backend modules
|
||||
dn: cn=module,cn=config
|
||||
objectClass: olcModuleList
|
||||
cn: module
|
||||
olcModulepath: {{ openldap_module_path }}
|
||||
{% for mod in openldap_modules | default([]) %}
|
||||
olcModuleload: back_{{ mod }}.so
|
||||
{% endfor %}
|
||||
|
||||
# Schema config
|
||||
dn: cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: schema
|
||||
|
||||
include: file://{{ openldap_core_schema_path }}
|
||||
{% for schema in openldap_schemas %}
|
||||
include: file://{{ openldap_schema_path }}/{{ schema.name }}.ldif
|
||||
{% endfor %}
|
||||
|
||||
# Frontend settings
|
||||
dn: olcDatabase=frontend,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcFrontendConfig
|
||||
olcDatabase: frontend
|
||||
|
||||
|
||||
# Config-DB settings
|
||||
dn: olcDatabase=config,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
olcDatabase: config
|
||||
{% for attr in openldap_config_db_attributes | dict2items %}
|
||||
{% if attr is string %}
|
||||
{{ attr.key }}: {{ attr.value }}
|
||||
{% else %}
|
||||
{% for val in attr.value %}
|
||||
{{ attr.key }}: {{ val }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
|
||||
# database settings
|
||||
{% for db in openldap_databases %}
|
||||
dn: olcDatabase={{ db.name }},cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: {{ db.object_class }}
|
||||
olcDatabase: {{ db.name }}
|
||||
olcSuffix: {{ db.suffix }}
|
||||
olcRootDN: {{ db.root_dn }}
|
||||
olcRootPW: {{ db.root_pw }}
|
||||
olcDbDirectory: {{ db.directory }}
|
||||
{% for idx in db.indices %}
|
||||
olcDbIndex: {{ idx }}
|
||||
{% endfor %}
|
||||
|
||||
|
||||
{% endfor %}
|
||||
@ -1,6 +0,0 @@
|
||||
---
|
||||
openldap_states:
|
||||
- "present"
|
||||
- "absent"
|
||||
openldap_deployment_methods:
|
||||
- "docker"
|
||||
@ -1,13 +0,0 @@
|
||||
# `finallycoffee.base.openssh`
|
||||
|
||||
Ansible role to manage and configure openssh and it's components (like `sshd`).
|
||||
|
||||
Currently supports `fedora` and `debian` linux distributions.
|
||||
|
||||
## `sshd`
|
||||
|
||||
To configure `sshd`, see the [`defaults/main/sshd.yml`](defaults/main/sshd.yml),
|
||||
where snake\_cased config keys for `/etc/ssh/sshd_config` are available in
|
||||
the `openssh_sshd_config_` namespace.
|
||||
|
||||
To add your own config on top, simply use key-value syntax in `openssh_sshd_config`.
|
||||
@ -1,3 +0,0 @@
|
||||
---
|
||||
openssh_state: 'present'
|
||||
openssh_sshd_config_file: "/etc/ssh/sshd_config"
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
openssh_packages:
|
||||
fedora: "{{ openssh_fedora_packages }}"
|
||||
debian: "{{ openssh_debian_packages }}"
|
||||
openssh_fedora_packages:
|
||||
- "openssh-server"
|
||||
openssh_debian_packages:
|
||||
- "openssh-server"
|
||||
@ -1,33 +0,0 @@
|
||||
---
|
||||
openssh_sshd_enable: true
|
||||
openssh_sshd_config_pubkey_authentication: true
|
||||
openssh_sshd_config_password_authentication: false
|
||||
openssh_sshd_config_challenge_response_authentication: false
|
||||
openssh_sshd_config_permit_root_login: false
|
||||
|
||||
# Limits
|
||||
openssh_sshd_config_max_sessions: ~
|
||||
openssh_sshd_config_max_startups: ~
|
||||
|
||||
# Hardening
|
||||
openssh_sshd_config_protocol: 2
|
||||
openssh_sshd_config_x11_forwarding: false
|
||||
openssh_sshd_config_allow_agent_forwarding: false
|
||||
openssh_sshd_config_allow_tcp_forwarding: false
|
||||
|
||||
openssh_sshd_default_config:
|
||||
PubkeyAuthentication: "{{ openssh_sshd_config_pubkey_authentication }}"
|
||||
PasswordAuthentication: "{{ openssh_sshd_config_password_authentication }}"
|
||||
ChallengeResponseAuthentication: >-2
|
||||
{{ openssh_sshd_config_challenge_response_authentication }}
|
||||
PermitRootLogin: "{{ openssh_sshd_config_permit_root_login }}"
|
||||
MaxSessions: "{{ openssh_sshd_config_max_sessions }}"
|
||||
MaxStartups: "{{ openssh_sshd_config_max_startups }}"
|
||||
Protocol: "{{ openssh_sshd_config_protocol }}"
|
||||
X11Forwarding: "{{ openssh_sshd_config_x11_forwarding }}"
|
||||
AllowAgentForwarding: "{{ openssh_sshd_config_allow_agent_forwarding }}"
|
||||
AllowTcpForwarding: "{{ openssh_sshd_config_allow_tcp_forwarding }}"
|
||||
|
||||
openssh_sshd_merged_config: >-2
|
||||
{{ openssh_sshd_default_config | default({}, true)
|
||||
| combine(openssh_sshd_config | default({}, true)) }}
|
||||
@ -1,2 +0,0 @@
|
||||
---
|
||||
openssh_sshd_systemd_service_name: "sshd.service"
|
||||
@ -1,7 +0,0 @@
|
||||
---
|
||||
- name: Ensure sshd is reloaded
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ openssh_sshd_systemd_service_name }}"
|
||||
state: "reloaded"
|
||||
when: ansible_facts['service_mgr'] == 'systemd'
|
||||
listen: openssh_sshd_reload
|
||||
@ -1,28 +0,0 @@
|
||||
---
|
||||
- name: Configure sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ openssh_sshd_config_file }}"
|
||||
regexp: "{{ openssh_sshd_config_regexp }}"
|
||||
line: "{{ openssh_sshd_config_line }}"
|
||||
firstmatch: true
|
||||
state: present
|
||||
validate: "sshd -Tf %s"
|
||||
loop: "{{ openssh_sshd_merged_config | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: "tuple"
|
||||
label: "{{ tuple.key }}"
|
||||
notify:
|
||||
- openssh_sshd_reload
|
||||
vars:
|
||||
openssh_sshd_config_regexp: "^\\s*#?\\s*{{ tuple.key }}"
|
||||
openssh_sshd_config_line: >-2
|
||||
{{ openssh_sshd_config_line_commented }}{{ tuple.key }} {{ openssh_sshd_config_value }}
|
||||
openssh_sshd_config_value_is_none: "{{ tuple.value is none }}"
|
||||
openssh_sshd_config_line_commented: >-2
|
||||
{{ openssh_sshd_config_value_is_none | ternary('#', '') }}
|
||||
openssh_sshd_config_value: >-2
|
||||
{{ (tuple.value is boolean) | ternary(
|
||||
tuple.value | ternary('yes', 'no'),
|
||||
tuple.value
|
||||
)
|
||||
}}
|
||||
@ -1,16 +0,0 @@
|
||||
---
|
||||
- name: Ensure openssh server package is {{ openssh_state }} (dnf)
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ openssh_packages[ansible_distribution | lower] }}"
|
||||
state: "{{ openssh_state }}"
|
||||
when:
|
||||
- ansible_facts['pkg_mgr'] in ['dnf', 'dnf5']
|
||||
- ansible_distribution | lower in openssh_packages.keys()
|
||||
|
||||
- name: Ensure openssh server package is {{ openssh_state }} (apt)
|
||||
ansible.builtin.apt:
|
||||
package: "{{ openssh_packages[ansible_distribution | lower] }}"
|
||||
state: "{{ openssh_state }}"
|
||||
when:
|
||||
- ansible_facts['pkg_mgr'] in ['apt']
|
||||
- ansible_distribution | lower in openssh_packages.keys()
|
||||
@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Ensure 'openssh_state' is valid
|
||||
ansible.builtin.fail:
|
||||
msg: >-2
|
||||
Invalid value '{{ openssh_state }}' for 'openssh_state'.
|
||||
Valid values are {{ openssh_states | join(', ') }}!
|
||||
when: openssh_state not in openssh_states
|
||||
|
||||
- name: Ensure openssh is {{ openssh_state }}
|
||||
ansible.builtin.include_tasks:
|
||||
file: "install.yml"
|
||||
|
||||
- name: Ensure sshd is configured
|
||||
ansible.builtin.include_tasks:
|
||||
file: "configure-sshd.yml"
|
||||
@ -1,4 +0,0 @@
|
||||
---
|
||||
openssh_states:
|
||||
- "present"
|
||||
- "absent"
|
||||
Loading…
x
Reference in New Issue
Block a user