feat(nslcd): add role

roles/debian-proxmox/README.md

@@ -1,20 +0,0 @@
-# `debian-proxmox` ansible role
-
-This ansible role can be used to convert a (running and reachable) debian to a proxmox instance.
-
-It automates the instructions from https://pve.proxmox.com/wiki/Install_Proxmox_VE_on_Debian_11_Bullseye.
-
-## Usage
-
-This role will attempt to ensure that the `/etc/hosts` are configured correctly for PVE.
-The public IP of the server should be given in `debian_proxmox_public_ip` and defaults to
-`ansible_facts['eno1'].ipv4.address`.
-
-The hostname and fqdn should be correctly set in `debian_proxmox_hostname` and `debian_proxmox_fqdn`,
-and default to `ansible_hostname` and `ansible_fqdn` respectively.
-
-## Packages
-
-It is recommended to remove the packages for the `os-prober` (which would attempt to add VMs as bootable entries
-in the bootloader) and the default linux kernel `linux-image-amd64` / `linux-image-5.10*` (and use the proxmox-provided
-kernel instead). This role will remove those packages without asking, so be aware.

roles/debian-proxmox/defaults/main.yml

@@ -1,43 +0,0 @@
----
-
-debian_proxmox_role_required_packages:
-  - python3-apt
-  - gpg
-
-debian_proxmox_apt_repo_fingerprint: "28139A2F830BD68478A1A01FDD4BA3917E23BF59"
-debian_proxmox_apt_repo_key_url: "https://enterprise.proxmox.com/debian/proxmox-release-{{ ansible_distribution_release }}.gpg"
-
-debian_proxmox_apt_repo_url: "http://download.proxmox.com/debian/pve"
-debian_proxmox_apt_repo: "deb [arch=amd64] {{ debian_proxmox_apt_repo_url }} {{ ansible_distribution_release }} pve-no-subscription"
-
-debian_proxmox_apt_packages:
-  - "proxmox-ve"
-  - "postfix"
-  - "open-iscsi"
-
-debian_proxmox_apt_packages_to_remove:
-  - "linux-image-amd64"
-  - "linux-image-{{ (ansible_facts['kernel'] | split('-') | first | split('.'))[:2] | join('.') }}*"
-  - "os-prober"
-
-debian_proxmox_max_reboot_timeout_seconds: 900
-
-debian_proxmox_public_ip: "{{ ansible_facts['eno1'].ipv4.address }}"
-debian_proxmox_loopback_ipv4: "{{ ansible_facts['lo'].ipv4.address }}"
-
-debian_proxmox_hostname: "{{ ansible_hostname }}"
-debian_proxmox_fqdn: "{{ ansible_fqdn }}"
-
-debian_proxmox_hosts_file:
-  - ip: "{{ debian_proxmox_loopback_ipv4 }}"
-    fqdn: localhost.localdomain
-    aliases:
-      - localhost
-  - ip: "{[ debian_proxmox_public_ip }}"
-    fqdn: "{{ debian_proxmox_fqdn }}"
-    aliases:
-      - "{{ debian_proxmox_hostname }}"
-      - pvelocalhost
-  - ip: 127.0.1.1
-    fqdn: "{{ debian_proxmox_hostname }}"
-    state: absent

roles/debian-proxmox/tasks/main.yml

@@ -1,67 +0,0 @@
----
-
-- name: Ensure python3-apt and gpg is available
-  apt:
-    package: "{{ debian_proxmox_role_required_packages }}"
-    state: present
-
-- name: Check if target is debian before attempting to convert to proxmox
-  fail:
-    msg: "Target is {{ ansible_distribution }} which is not Debian"
-  when: ansible_distribution != 'Debian'
-
-- name: Check if debian version is supported by role
-  fail:
-    msg: "{{ ansible_distribution }} {{ ansible_distribution_version }} is not supported by the role"
-  when: ansible_distribution_version not in debian_proxmox_supported_debian_versions
-
-- name: Ensure /etc/hosts entries are safe for use with proxmox
-  lineinfile:
-    dest: /etc/hosts
-    line: "{{ item.ip }}\t{{ item.fqdn | default('') }}\t{{ item.aliases | default([]) | join('\t') }}"
-    regex: "{{ item.ip }}.+"
-    state: "{{ item.state | default('present') }}"
-  loop: "{{ debian_proxmox_hosts_file }}"
-
-- name: Ensure Proxmox VE apt repository keys are added
-  apt_key:
-    id: "{{ debian_proxmox_apt_repo_fingerprint }}"
-    url: "{{ debian_proxmox_apt_repo_key_url }}"
-    state: present
-
-- name: Ensure Proxmox VE apt repository is added
-  apt_repository:
-    filename: pve-install-repo
-    repo: "{{ debian_proxmox_apt_repo }}"
-    state: present
-  register: proxmox_ve_apt_repo
-
-- name: Ensure APT cache is up to date
-  apt:
-    update_cache: yes
-  when: proxmox_ve_apt_repo.changed
-
-- name: Ensure system is upgraded
-  apt:
-    upgrade: full
-
-- name: Ensure Proxmox VE packages are installed
-  apt:
-    package: "{{ debian_proxmox_apt_packages }}"
-    state: present
-  register: proxmox_ve_installed
-
-- name: Ensure system is rebooted after install of PVE packages
-  reboot:
-    reboot_timeout: "{{ debian_proxmox_max_reboot_timeout_seconds | int }}"
-  when: proxmox_ve_installed.changed
-
-- name: Ensure packages are removed that will conflict with proxmox operation
-  apt:
-    package: "{{ debian_proxmox_apt_packages_to_remove }}"
-    state: absent
-  register: proxmox_apt_packages_removed
-
-- name: Ensure grub was updated after the kernel was removed
-  command: update-grub
-  when: proxmox_apt_packages_removed.changed

roles/debian-proxmox/vars/main.yml

@@ -1,4 +0,0 @@
----
-
-debian_proxmox_supported_debian_versions:
-  - 11

roles/nscd/defaults/main.yml

@@ -0,0 +1,41 @@
+---
+
+nscd_config_file: /etc/nscd.conf
+
+nscd_config_password_enable_cache: true
+nscd_config_password_positive_ttl_seconds: 300
+nscd_config_password_negative_ttl_seconds: 10
+nscd_config_password_suggested_size: 221
+nscd_config_password_check_files: true
+nscd_config_password_persistent: true
+nscd_config_password_shared: true
+nscd_config_password_max_db_size_bytes: 33554432
+nscd_config_password_auto_propagate: yes
+
+nscd_config_group_enable_cache: true
+nscd_config_group_positive_ttl_seconds: 900
+nscd_config_group_negative_ttl_seconds: 30
+nscd_config_group_suggested_size: 221
+nscd_config_group_check_files: true
+nscd_config_group_persistent: true
+nscd_config_group_shared: true
+nscd_config_group_max_db_size_bytes: 33554432
+nscd_config_group_auto_propagate: yes
+
+nscd_config_hosts_enable_cache: true
+nscd_config_hosts_positive_ttl_seconds: 1800
+nscd_config_hosts_negative_ttl_seconds: 60
+nscd_config_hosts_suggested_size: 221
+nscd_config_hosts_check_files: true
+nscd_config_hosts_persistent: true
+nscd_config_hosts_shared: true
+nscd_config_hosts_max_db_size_bytes: 33554432
+
+nscd_config_services_enable_cache: true
+nscd_config_services_positive_ttl_seconds: 28800
+nscd_config_services_negative_ttl_seconds: 20
+nscd_config_services_suggested_size: 221
+nscd_config_services_check_files: true
+nscd_config_services_persistent: true
+nscd_config_services_shared: true
+nscd_config_services_max_db_size_bytes: 33554432

roles/nscd/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+
+- name: Make sure nscd is installed
+  apt:
+    name: "{{ nscd_apt_package_name }}"
+    state: present
+  when: ansible_facts['pkg_mgr'] == 'apt'
+
+- name: Ensure nscd is configured
+  template:
+    src: nscd.conf.j2
+    dest: "{{ nscd_config_file }}"
+    owner: root
+    group: root
+    mode: "0640"
+
+- name: Ensure systemd service is enabled
+  systemd:
+    service: "{{ nscd_systemd_service_name }}"
+    enabled: true
+  when: ansible_facts['service_mgr'] == 'systemd'
+
+- name: Ensure systemd service is started
+  systemd:
+    service: "{{ nscd_systemd_service_name }}"
+    state: started
+  when: ansible_facts['service_mgr'] == 'systemd'

roles/nscd/templates/nscd.conf.j2

@@ -0,0 +1,41 @@
+#logfile	/var/log/nscd.log
+#threads	4
+#max-threads	32
+
+enable-cache		passwd	{{ nscd_config_passwd_auto_propagate | ternary('yes', 'no') }}
+positive-time-to-live	passwd	{{ nscd_config_passwd_positive_ttl_seconds }}
+negative-time-to-live	passwd	{{ nscd_config_passwd_negative_ttl_seconds }}
+suggested-size		passwd	{{ nscd_config_passwd_suggested_size }}
+check-files		passwd	{{ nscd_config_passwd_check_files | ternary('yes', 'no') }}
+persistent		passwd	{{ nscd_config_passwd_persistent | ternary('yes', 'no') }}
+shared			passwd	{{ nscd_config_passwd_shared | ternary('yes', 'no') }}
+max-db-size		passwd	{{ nscd_config_passwd_max_db_size_bytes }}
+auto-propagate		passwd	{{ nscd_config_passwd_auto_propagate | ternary('yes', 'no') }}
+
+enable-cache		group	{{ nscd_config_group_auto_propagate | ternary('yes', 'no') }}
+positive-time-to-live	group	{{ nscd_config_group_positive_ttl_seconds }}
+negative-time-to-live	group	{{ nscd_config_group_negative_ttl_seconds }}
+suggested-size		group	{{ nscd_config_group_suggested_size }}
+check-files		group	{{ nscd_config_group_check_files | ternary('yes', 'no') }}
+persistent		group	{{ nscd_config_group_persistent | ternary('yes', 'no') }}
+shared			group	{{ nscd_config_group_shared | ternary('yes', 'no') }}
+max-db-size		group	{{ nscd_config_group_max_db_size_bytes }}
+auto-propagate		group	{{ nscd_config_group_auto_propagate | ternary('yes', 'no') }}
+
+enable-cache		hosts	{{ nscd_config_hosts_auto_propagate | ternary('yes', 'no') }}
+positive-time-to-live	hosts	{{ nscd_config_hosts_positive_ttl_seconds }}
+negative-time-to-live	hosts	{{ nscd_config_hosts_negative_ttl_seconds }}
+suggested-size		hosts	{{ nscd_config_hosts_suggested_size }}
+check-files		hosts	{{ nscd_config_hosts_check_files | ternary('yes', 'no') }}
+persistent		hosts	{{ nscd_config_hosts_persistent | ternary('yes', 'no') }}
+shared			hosts	{{ nscd_config_hosts_shared | ternary('yes', 'no') }}
+max-db-size		hosts	{{ nscd_config_hosts_max_db_size_bytes }}
+
+enable-cache		services	{{ nscd_config_services_auto_propagate | ternary('yes', 'no') }}
+positive-time-to-live	services	{{ nscd_config_services_positive_ttl_seconds }}
+negative-time-to-live	services	{{ nscd_config_services_negative_ttl_seconds }}
+suggested-size		services	{{ nscd_config_services_suggested_size }}
+check-files		services	{{ nscd_config_services_check_files | ternary('yes', 'no') }}
+persistent		services	{{ nscd_config_services_persistent | ternary('yes', 'no') }}
+shared			services	{{ nscd_config_services_shared | ternary('yes', 'no') }}
+max-db-size		services	{{ nscd_config_services_max_db_size_bytes }}

roles/nscd/vars/main.yml

@@ -0,0 +1,4 @@
+---
+
+nscd_apt_package_name: nscd
+nscd_systemd_service_name: nscd.service

roles/nslcd/defaults/main.yml

@@ -0,0 +1,20 @@
+---
+
+nslcd_config_uid: nslcd
+nslcd_config_gid: nslcd
+
+nslcd_config_ldap_uri: ldaps://127.0.0.1
+nslcd_config_ldap_base: ~
+nslcd_config_ldap_scope: sub
+nslcd_config_ldap_version: 3
+nslcd_config_ldap_bind_dn: ~
+nslcd_config_ldap_bind_pw: ~
+nslcd_config_ldap_root_pw_mod_dn: ~
+nslcd_config_ldap_ssl: on
+nslcd_config_ldap_tls_reqcert: always
+nslcd_config_ldap_tls_cacertfile: /etc/ssl/certs/ca-certificates.crt
+
+nslcd_config_pam_authz_search: >-2
+  (&(objectClass=posixAccount)(uid=$username)(|
+    (host=$hostname)(host=$fqdn)
+  ))

roles/nslcd/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+
+- name: Ensure nslcd is installed
+  apt:
+    name: "{{ nslcd_apt_package_name }}"
+    state: present
+  when: ansible_facts['pkg_mgr'] == 'apt'
+
+- name: Ensure config is templated
+  template:
+    src: nslcd.conf.j2
+    dest: /etc/nslcd.conf
+    owner: root
+    group: root
+    mode: "0640"
+
+- name: Ensure systemd service is enabled
+  systemd:
+    service: "{{ nslcd_systemd_service_name }}"
+    enabled: true
+  when: ansible_facts['service_mgr'] == 'systemd'
+
+- name: Ensure systemd service is running
+  systemd:
+    service: "{{ nslcd_systemd_service_name }}"
+    state: started
+  when: ansible_facts['service_mgr'] == 'systemd'

roles/nslcd/templates/nslcd.conf.j2

@@ -0,0 +1,17 @@
+uid {{ nslcd_config_uid }}
+gid {{ nslcd_config_gid }}
+
+uri {{ nslcd_config_ldap_uri }}
+base {{ nslcd_config_ldap_base }}
+binddn {{ nslcd_config_ldap_bind_dn }}
+bindpw {{ nslcd_config_ldap_bind_pw }}
+ldap_version {{ nslcd_config_ldap_version }}
+
+rootpwmoddn {{ nslcd_config_ldap_root_pw_mod_dn }}
+
+ssl {{ nslcd_config_ldap_ssl }}
+tls_reqcert {{ nslcd_config_ldap_tls_reqcert }}
+tls_cacertfile {{ nslcd_config_ldap_tls_cacertfile }}
+
+scope {{ nslcd_config_ldap_scope }}
+pam_authz_search {{ nslcd_config_ldap_pam_authz_search }}