feat: base configuration automation
This commit is contained in:
NaeiKinDus
commit
e4770a7343
GPG key ID:
8E52ADFF7CA8AE56
70 changed files with 2489 additions and 0 deletions
11
.gitignore
vendored
Normal file
11
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
.idea
|
||||||
|
.*~
|
||||||
|
venv
|
||||||
|
.task
|
||||||
|
collections/ansible_collections/*/*/tests/*
|
||||||
|
collections/ansible_collections/*/*/logs/*
|
||||||
|
!collections/ansible_collections/*/*/tests/config.yml
|
||||||
|
vault.yml
|
||||||
|
inventory/inventory.yml
|
||||||
|
inventory/host_vars/*
|
||||||
|
!.gitkeep
|
||||||
129
README.md
Normal file
129
README.md
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
# Abstract
|
||||||
|
## List of services
|
||||||
|
# Usage
|
||||||
|
## Prerequisites
|
||||||
|
***Required dependencies***
|
||||||
|
- Python3.9+,
|
||||||
|
- PIP,
|
||||||
|
- Virtualenv
|
||||||
|
- [Task](https://taskfile.dev/),
|
||||||
|
- Debian packages:
|
||||||
|
- libcurl4-openssl-dev,
|
||||||
|
- libssl-dev,
|
||||||
|
- libcairo2,
|
||||||
|
- libcairo2-dev,
|
||||||
|
- libffi-dev,
|
||||||
|
- python3-dev,
|
||||||
|
- python3-virtualenv
|
||||||
|
|
||||||
|
***Optional, dev-related dependencies***
|
||||||
|
- Docker
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
```shell
|
||||||
|
# Debian amd64
|
||||||
|
|
||||||
|
TASK_VERSION=3.29.1;
|
||||||
|
sudo apt install -y \
|
||||||
|
libcurl4-openssl-dev \
|
||||||
|
libssl-dev \
|
||||||
|
libcairo2 \
|
||||||
|
libcairo2-dev \
|
||||||
|
libffi-dev \
|
||||||
|
python3-virtualenv \
|
||||||
|
python3-dev;
|
||||||
|
wget https://github.com/go-task/task/releases/download/v"${TASK_VERSION}"/task_linux_amd64.deb;
|
||||||
|
sudo dpkg -i task_linux_amd64.deb;
|
||||||
|
task venv;
|
||||||
|
```
|
||||||
|
|
||||||
|
## General Setup
|
||||||
|
```shell
|
||||||
|
mkdir -p collections/ansible_collections
|
||||||
|
cd collections/ansible_collections
|
||||||
|
ansible-galaxy collection init nullified.infrastructure
|
||||||
|
cd nullified/infrastructure/roles
|
||||||
|
ansible-galaxy collection init tooling
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Cheatsheet
|
||||||
|
### Ansible usage
|
||||||
|
***validate files***
|
||||||
|
`ansible-playbook --syntax-check <file>`
|
||||||
|
|
||||||
|
***gather facts***
|
||||||
|
`ansible <target> -m setup`
|
||||||
|
|
||||||
|
***handlers***
|
||||||
|
invoked by a task through `notify`, executed only if caller triggered a state change; runs at the end of the play in the order
|
||||||
|
they are declared;
|
||||||
|
-> force handlers to run:
|
||||||
|
```yaml
|
||||||
|
- name: some task
|
||||||
|
meta: flush_handlers
|
||||||
|
```
|
||||||
|
|
||||||
|
***looping***
|
||||||
|
looping in task by using the `loop` array with items to loop over;
|
||||||
|
|
||||||
|
***runtime grouping***
|
||||||
|
```yaml
|
||||||
|
name: coin
|
||||||
|
hosts: all
|
||||||
|
gather_facts: true
|
||||||
|
tasks:
|
||||||
|
- name: group by OS
|
||||||
|
group_by:
|
||||||
|
key: "{{ ansible_facts.distribution }}"
|
||||||
|
```
|
||||||
|
|
||||||
|
***builtin vars***
|
||||||
|
- hostvars: {hostname => kvp_vars, ...},
|
||||||
|
- inventory_hostname(_short)?: name of current host,
|
||||||
|
- group_names: list of groups assigned to current host,
|
||||||
|
- groups: {groupname => [hostX, ...], ...},
|
||||||
|
- ansible_check_mode: isRunningInCheckMode ?,
|
||||||
|
- ansible_play_batch: list inventory hostnames active in current batch,
|
||||||
|
- ansibble_play_hosts: ist inventory hostnames active in current play,
|
||||||
|
|
||||||
|
### Python modules
|
||||||
|
***argument options***
|
||||||
|
> *NOTE*
|
||||||
|
> Ansible Up and Running, page 503
|
||||||
|
|
||||||
|
- *default*: default value if arg is required,
|
||||||
|
- *choices*: list of possible values for an array arg,
|
||||||
|
- *deprecated_aliases*: deprecate aliases; `dict(name, version, date, collection_name)`,
|
||||||
|
- *aliases*: aliases for given argument,
|
||||||
|
- *type*: arg type,
|
||||||
|
- *elements*: set type of list elements if arg is array,
|
||||||
|
- *fallback*: tuple of a lookup function and a list to pass to it,
|
||||||
|
- *no_log*: mask arg value in logs for sensitive data,
|
||||||
|
- *options*: complex args; create list of suboptions,
|
||||||
|
- *mutually_exclusive*: list of mutually exclusive suboptions,
|
||||||
|
- *required_together*: list of names of sub options,
|
||||||
|
- *required_one_of*: list of required mutually exclusive suboptions,
|
||||||
|
- *required_if*: sequence of sequences,
|
||||||
|
- *required_by*: dic mapping option names to seqs of option names
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Notes / Todo
|
||||||
|
***dir layout***
|
||||||
|
- collections: ansible root dir for all modules, playbooks and collections
|
||||||
|
- configuration: <DEPRECATED> ansible root dir for inventory
|
||||||
|
- images: docker images, mostly used for ansible-test / molecule
|
||||||
|
- scripts: scripts used by go-task
|
||||||
|
|
||||||
|
### Setup
|
||||||
|
```shell
|
||||||
|
cp configuration/group_vars/vault.yml.dist configuration/group_vars/vault.yml
|
||||||
|
# encrypt vault
|
||||||
|
ansible-vault encrypt configuration/group_vars/vault.yml
|
||||||
|
# decrypt vault
|
||||||
|
ansible-vault decrypt configuration/group_vars/vault.yml
|
||||||
|
# run ansible command with vault-encrypted data
|
||||||
|
ansible-playbook --ask-vault-password -i inventories/test playbooks/test.yml
|
||||||
|
```
|
||||||
106
Taskfile.yml
Normal file
106
Taskfile.yml
Normal file
|
|
@ -0,0 +1,106 @@
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
env:
|
||||||
|
DOCKER_REPOSITORY: pouncetech/molecule
|
||||||
|
|
||||||
|
vars:
|
||||||
|
PYTHON_WRAPPER: '{{.ROOT_DIR}}/scripts/python_wrapper.sh'
|
||||||
|
MOLECULE_DIR: '{{.ROOT_DIR}}/collections/ansible_collections/nullified/infrastructure/extensions'
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
venv:setup:
|
||||||
|
desc: install a Python3 virtualenv and all the required ansible / molecule dependencies.
|
||||||
|
cmds:
|
||||||
|
- |
|
||||||
|
set -e
|
||||||
|
rm -rf ./venv || true
|
||||||
|
python3 -m virtualenv --download venv
|
||||||
|
./venv/bin/python3 -m pip install --upgrade -r requirements.txt
|
||||||
|
status:
|
||||||
|
- test -d venv
|
||||||
|
|
||||||
|
test:modules:
|
||||||
|
desc: run `ansible-test sanity` on collections to find common issues for modules and collections
|
||||||
|
dir: collections/ansible_collections
|
||||||
|
vars:
|
||||||
|
ANSIBLE_COLLECTIONS:
|
||||||
|
sh: find -mindepth 2 -maxdepth 2 -type d
|
||||||
|
cmds:
|
||||||
|
- for: { var: ANSIBLE_COLLECTIONS }
|
||||||
|
task: 'test:module:sanity'
|
||||||
|
vars:
|
||||||
|
COLLECTION_PATH: 'collections/ansible_collections/{{.ITEM}}'
|
||||||
|
|
||||||
|
test:module:sanity:
|
||||||
|
internal: true
|
||||||
|
dir: '{{.COLLECTION_PATH}}'
|
||||||
|
preconditions:
|
||||||
|
- test -d tests
|
||||||
|
cmds:
|
||||||
|
- '{{.PYTHON_WRAPPER}} ansible-test sanity --docker default'
|
||||||
|
|
||||||
|
test:collections:
|
||||||
|
desc: run molecule tests for all roles and collections.
|
||||||
|
dir: collections/ansible_collections
|
||||||
|
vars:
|
||||||
|
ANSIBLE_COLLECTIONS:
|
||||||
|
sh: find -mindepth 2 -maxdepth 2 -type d
|
||||||
|
cmds:
|
||||||
|
- for: { var: ANSIBLE_COLLECTIONS }
|
||||||
|
task: 'test:collection:molecule'
|
||||||
|
vars:
|
||||||
|
COLLECTION_PATH: 'collections/ansible_collections/{{.ITEM}}'
|
||||||
|
|
||||||
|
test:collection:molecule:
|
||||||
|
internal: true
|
||||||
|
dir: '{{.COLLECTION_PATH}}/extensions'
|
||||||
|
preconditions:
|
||||||
|
- test -d molecule
|
||||||
|
cmds:
|
||||||
|
- '{{.PYTHON_WRAPPER}} molecule test'
|
||||||
|
|
||||||
|
module:github_artifact:
|
||||||
|
desc: run a module from the collection for testing purposes
|
||||||
|
vars:
|
||||||
|
PLUGINS_DIR: '{{.ROOT_DIR}}/collections/ansible_collections/nullified/infrastructure/plugins'
|
||||||
|
cmd: |
|
||||||
|
{{.PYTHON_WRAPPER}} python3 {{.PLUGINS_DIR}}/modules/github_artifact.py {{.PLUGINS_DIR}}/tests/github_artifact.json |
|
||||||
|
{{.PYTHON_WRAPPER}} python3 -m json.tool | {{.PYTHON_WRAPPER}} pygmentize -l json
|
||||||
|
|
||||||
|
docker:build:
|
||||||
|
desc: build docker images locally.
|
||||||
|
vars:
|
||||||
|
DOCKERFILE_IMAGES:
|
||||||
|
sh: find images -type f -name 'Dockerfile-*'
|
||||||
|
cmds:
|
||||||
|
- for: { var: DOCKERFILE_IMAGES }
|
||||||
|
task: 'docker:build:image'
|
||||||
|
vars:
|
||||||
|
DOCKERFILE: '{{.ITEM}}'
|
||||||
|
DOCKER_CONTEXT: images
|
||||||
|
IMAGE_TAG: '{{.ITEM | splitList "/" | last | replace "Dockerfile-" ""}}'
|
||||||
|
|
||||||
|
docker:build:image:
|
||||||
|
internal: true
|
||||||
|
sources:
|
||||||
|
- '{{.DOCKERFILE}}'
|
||||||
|
cmds:
|
||||||
|
- docker buildx build --load -t "{{.DOCKER_REPOSITORY}}:{{.IMAGE_TAG}}" -f {{.DOCKERFILE}} {{.DOCKER_CONTEXT}}
|
||||||
|
status:
|
||||||
|
- docker image ls --format '{{"{{"}} .Tag {{"}}"}}' | grep -E '^{{.IMAGE_TAG}}$'
|
||||||
|
|
||||||
|
docker:push:
|
||||||
|
desc: push locally built images
|
||||||
|
cmds:
|
||||||
|
- 'echo docker push $DOCKER_REPOSITORY:$IMAGE_TAG'
|
||||||
|
env:
|
||||||
|
IMAGE_TAG:
|
||||||
|
|
||||||
|
venv:
|
||||||
|
desc: execute a python3 command using the virtualenv wrapper
|
||||||
|
cmd: '{{.PYTHON_WRAPPER}} {{.CLI_ARGS}}'
|
||||||
|
|
||||||
|
molecule:
|
||||||
|
desc: execute a molecule command
|
||||||
|
dir: '{{.MOLECULE_DIR}}'
|
||||||
|
cmd: '{{.PYTHON_WRAPPER}} molecule {{.CLI_ARGS}}'
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
# Ansible Collection - nullified.infrastructure
|
||||||
|
|
||||||
|
Documentation for the collection.
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
[defaults]
|
||||||
|
# target root path of the repository
|
||||||
|
home = ../../../../..
|
||||||
|
remote_tmp = /tmp
|
||||||
|
local_tmp = /tmp
|
||||||
|
|
||||||
|
[privilege_escalation]
|
||||||
|
become_method = su
|
||||||
|
become_flags = "-l"
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
---
|
||||||
|
# playbook file that contains the call for your role
|
||||||
|
- name: Fail if molecule group is missing
|
||||||
|
hosts: localhost
|
||||||
|
tasks:
|
||||||
|
- name: Print some info
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ groups }}"
|
||||||
|
|
||||||
|
- name: Assert group existence
|
||||||
|
ansible.builtin.assert:
|
||||||
|
that: "'molecule' in groups"
|
||||||
|
fail_msg: |
|
||||||
|
molecule group was not found inside inventory groups: {{ groups }}
|
||||||
|
|
||||||
|
- name: Converge
|
||||||
|
hosts: molecule
|
||||||
|
gather_facts: true
|
||||||
|
tasks:
|
||||||
|
- name: Testing common role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.common
|
||||||
|
tasks_from: main.yml
|
||||||
|
- name: Testing development role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.development
|
||||||
|
tasks_from: main.yml
|
||||||
|
- name: Testing security role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.security
|
||||||
|
tasks_from: main.yml
|
||||||
|
- name: Testing server role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.server
|
||||||
|
tasks_from: main.yml
|
||||||
|
- name: Testing workstation role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.workstation
|
||||||
|
tasks_from: main.yml
|
||||||
|
|
@ -0,0 +1,90 @@
|
||||||
|
---
|
||||||
|
# playbook file used for creating the instances and storing data in instance-config
|
||||||
|
- name: Create
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: false
|
||||||
|
vars:
|
||||||
|
molecule_inventory:
|
||||||
|
all:
|
||||||
|
hosts: {}
|
||||||
|
molecule: {}
|
||||||
|
tasks:
|
||||||
|
- name: Create a container
|
||||||
|
community.docker.docker_container:
|
||||||
|
name: "{{ item.name }}"
|
||||||
|
image: "{{ item.image }}"
|
||||||
|
detach: true
|
||||||
|
state: started
|
||||||
|
log_driver: json-file
|
||||||
|
cgroupns_mode: private
|
||||||
|
cgroup_parent: docker.slice
|
||||||
|
mounts:
|
||||||
|
- target: /run
|
||||||
|
type: tmpfs
|
||||||
|
- target: /run/lock
|
||||||
|
type: tmpfs
|
||||||
|
- target: /tmp
|
||||||
|
type: tmpfs
|
||||||
|
register: result
|
||||||
|
loop: "{{ molecule_yml.platforms }}"
|
||||||
|
|
||||||
|
- name: Print some info
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ result.results }}"
|
||||||
|
|
||||||
|
- name: Fail if container is not running
|
||||||
|
when: >
|
||||||
|
item.container.State.ExitCode != 0 or
|
||||||
|
not item.container.State.Running
|
||||||
|
ansible.builtin.include_tasks:
|
||||||
|
file: tasks/create-fail.yml
|
||||||
|
loop: "{{ result.results }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.container.Name }}"
|
||||||
|
|
||||||
|
- name: Add container to molecule_inventory
|
||||||
|
vars:
|
||||||
|
inventory_partial_yaml: |
|
||||||
|
all:
|
||||||
|
children:
|
||||||
|
molecule:
|
||||||
|
hosts:
|
||||||
|
"{{ item.name }}":
|
||||||
|
ansible_connection: community.docker.docker
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
molecule_inventory: >
|
||||||
|
{{ molecule_inventory | combine(inventory_partial_yaml | from_yaml) }}
|
||||||
|
loop: "{{ molecule_yml.platforms }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.name }}"
|
||||||
|
|
||||||
|
- name: Dump molecule_inventory
|
||||||
|
ansible.builtin.copy:
|
||||||
|
content: |
|
||||||
|
{{ molecule_inventory | to_yaml }}
|
||||||
|
dest: "{{ molecule_ephemeral_directory }}/inventory/molecule_inventory.yml"
|
||||||
|
mode: 0600
|
||||||
|
|
||||||
|
- name: Force inventory refresh
|
||||||
|
ansible.builtin.meta: refresh_inventory
|
||||||
|
|
||||||
|
- name: Fail if molecule group is missing
|
||||||
|
ansible.builtin.assert:
|
||||||
|
that: "'molecule' in groups"
|
||||||
|
fail_msg: |
|
||||||
|
molecule group was not found inside inventory groups: {{ groups }}
|
||||||
|
run_once: true # noqa: run-once[task]
|
||||||
|
|
||||||
|
# we want to avoid errors like "Failed to create temporary directory"
|
||||||
|
- name: Validate that inventory was refreshed
|
||||||
|
hosts: molecule
|
||||||
|
gather_facts: false
|
||||||
|
tasks:
|
||||||
|
- name: Check uname
|
||||||
|
ansible.builtin.raw: uname -a
|
||||||
|
register: result
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Display uname info
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ result.stdout }}"
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
---
|
||||||
|
# destroying the instances and removing them from instance-config
|
||||||
|
- name: Destroy molecule containers
|
||||||
|
hosts: molecule
|
||||||
|
gather_facts: false
|
||||||
|
tasks:
|
||||||
|
- name: Stop and remove container
|
||||||
|
delegate_to: localhost
|
||||||
|
community.docker.docker_container:
|
||||||
|
name: "{{ inventory_hostname }}"
|
||||||
|
state: absent
|
||||||
|
auto_remove: true
|
||||||
|
|
||||||
|
- name: Remove dynamic molecule inventory
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: false
|
||||||
|
tasks:
|
||||||
|
- name: Remove dynamic inventory file
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ molecule_ephemeral_directory }}/inventory/molecule_inventory.yml"
|
||||||
|
state: absent
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
---
|
||||||
|
# central configuration entry point for Molecule per scenario
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
options:
|
||||||
|
requirements-file: requirements.yml
|
||||||
|
platforms:
|
||||||
|
- name: debian-bookworm
|
||||||
|
image: pouncetech/molecule:debian-bookworm
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
collections:
|
||||||
|
- community.docker
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
- name: Retrieve container log
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: >-
|
||||||
|
{% raw %}
|
||||||
|
docker logs
|
||||||
|
{% endraw %}
|
||||||
|
{{ item.stdout_lines[0] }}
|
||||||
|
changed_when: false
|
||||||
|
register: logfile_cmd
|
||||||
|
|
||||||
|
- name: Display container log
|
||||||
|
ansible.builtin.fail:
|
||||||
|
msg: "{{ logfile_cmd.stderr }}"
|
||||||
|
|
@ -0,0 +1,67 @@
|
||||||
|
### REQUIRED
|
||||||
|
# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
|
||||||
|
# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
|
||||||
|
# underscores or numbers and cannot contain consecutive underscores
|
||||||
|
namespace: nullified
|
||||||
|
|
||||||
|
# The name of the collection. Has the same character restrictions as 'namespace'
|
||||||
|
name: infrastructure
|
||||||
|
|
||||||
|
# The version of the collection. Must be compatible with semantic versioning
|
||||||
|
version: 1.0.0
|
||||||
|
|
||||||
|
# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
|
||||||
|
readme: README.md
|
||||||
|
|
||||||
|
# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
|
||||||
|
# @nicks:irc/im.site#channel'
|
||||||
|
authors:
|
||||||
|
- Florian L. <git@0x2a.ninja>
|
||||||
|
|
||||||
|
### OPTIONAL but strongly recommended
|
||||||
|
# A short summary description of the collection
|
||||||
|
description: your collection description
|
||||||
|
|
||||||
|
# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
|
||||||
|
# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
|
||||||
|
license:
|
||||||
|
- GPL-2.0-or-later
|
||||||
|
|
||||||
|
# The path to the license file for the collection. This path is relative to the root of the collection. This key is
|
||||||
|
# mutually exclusive with 'license'
|
||||||
|
license_file: ''
|
||||||
|
|
||||||
|
# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
|
||||||
|
# requirements as 'namespace' and 'name'
|
||||||
|
tags: []
|
||||||
|
|
||||||
|
# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
|
||||||
|
# collection label 'namespace.name'. The value is a version range
|
||||||
|
# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
|
||||||
|
# range specifiers can be set and are separated by ','
|
||||||
|
dependencies: {}
|
||||||
|
|
||||||
|
# The URL of the originating SCM repository
|
||||||
|
repository: http://example.com/repository
|
||||||
|
|
||||||
|
# The URL to any online docs
|
||||||
|
documentation: http://docs.example.com
|
||||||
|
|
||||||
|
# The URL to the homepage of the collection/project
|
||||||
|
homepage: http://example.com
|
||||||
|
|
||||||
|
# The URL to the collection issue tracker
|
||||||
|
issues: http://example.com/issue/tracker
|
||||||
|
|
||||||
|
# A list of file glob-like patterns used to filter any files or directories that should not be included in the build
|
||||||
|
# artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This
|
||||||
|
# uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry',
|
||||||
|
# and '.git' are always filtered. Mutually exclusive with 'manifest'
|
||||||
|
build_ignore: []
|
||||||
|
|
||||||
|
# A dict controlling use of manifest directives used in building the collection artifact. The key 'directives' is a
|
||||||
|
# list of MANIFEST.in style
|
||||||
|
# L(directives,https://packaging.python.org/en/latest/guides/using-manifest-in/#manifest-in-commands). The key
|
||||||
|
# 'omit_default_directives' is a boolean that controls whether the default directives are used. Mutually exclusive
|
||||||
|
# with 'build_ignore'
|
||||||
|
# manifest: null
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
requires_ansible: '>=2.9.10'
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
---
|
||||||
|
- hosts: server
|
||||||
|
tasks:
|
||||||
|
- name: include common role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.common
|
||||||
|
- name: include security role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.security
|
||||||
|
- name: include server role
|
||||||
|
ansible.builtin.include_role:
|
||||||
|
name: nullified.infrastructure.server
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
# Collections Plugins Directory
|
||||||
|
|
||||||
|
This directory can be used to ship various plugins inside an Ansible collection. Each plugin is placed in a folder that
|
||||||
|
is named after the type of plugin it is in. It can also include the `module_utils` and `modules` directory that
|
||||||
|
would contain module utils and modules respectively.
|
||||||
|
|
||||||
|
Here is an example directory of the majority of plugins currently supported by Ansible:
|
||||||
|
|
||||||
|
```
|
||||||
|
└── plugins
|
||||||
|
├── action
|
||||||
|
├── become
|
||||||
|
├── cache
|
||||||
|
├── callback
|
||||||
|
├── cliconf
|
||||||
|
├── connection
|
||||||
|
├── filter
|
||||||
|
├── httpapi
|
||||||
|
├── inventory
|
||||||
|
├── lookup
|
||||||
|
├── module_utils
|
||||||
|
├── modules
|
||||||
|
├── netconf
|
||||||
|
├── shell
|
||||||
|
├── strategy
|
||||||
|
├── terminal
|
||||||
|
├── test
|
||||||
|
└── vars
|
||||||
|
```
|
||||||
|
|
||||||
|
A full list of plugin types can be found at [Working With Plugins](https://docs.ansible.com/ansible-core/2.15/plugins/plugins.html).
|
||||||
|
|
@ -0,0 +1,402 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Copyright: (c) 2023, Florian L. <git+ansible@pounce.tech>
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
from __future__ import annotations
|
||||||
|
__metaclass__ = type
|
||||||
|
|
||||||
|
DOCUMENTATION = r'''
|
||||||
|
---
|
||||||
|
module: github_artifact
|
||||||
|
|
||||||
|
short_description: fetch assets from a GitHub repository release
|
||||||
|
|
||||||
|
description: vaguely similar to a package manager, but for GitHub artifacts.
|
||||||
|
|
||||||
|
version_added: "2.15.0"
|
||||||
|
|
||||||
|
options:
|
||||||
|
artifacts:
|
||||||
|
description: a list of artifacts to retrieve
|
||||||
|
type: list
|
||||||
|
required: true
|
||||||
|
elements: dict
|
||||||
|
suboptions:
|
||||||
|
asset_name:
|
||||||
|
description: filename of the asset to retrieve, used only for release type; supports templating
|
||||||
|
type: str
|
||||||
|
required: false
|
||||||
|
default: ""
|
||||||
|
asset_type:
|
||||||
|
description: whether the asset is a release or just a tagged asset
|
||||||
|
type: str
|
||||||
|
required: true
|
||||||
|
choices:
|
||||||
|
- release
|
||||||
|
- tag
|
||||||
|
cmds:
|
||||||
|
description: commands to execute in order to install the downloaded asset; supports templating
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
required: false
|
||||||
|
default: []
|
||||||
|
repository:
|
||||||
|
description: repository to query, formatted like "<owner>/<repo>"
|
||||||
|
required: true
|
||||||
|
type: str
|
||||||
|
version:
|
||||||
|
description: version of the asset to fetch; defaults to `latest`
|
||||||
|
required: false
|
||||||
|
type: str
|
||||||
|
default: latest
|
||||||
|
github_token:
|
||||||
|
description: a GitHub app token if you have one; limits impact of rate-limiting errors
|
||||||
|
type: str
|
||||||
|
required: false
|
||||||
|
|
||||||
|
notes:
|
||||||
|
- "Strings that allow the use of templating variables support the following:"
|
||||||
|
- " V(version): version of the system, B(NOT) the asset's;"
|
||||||
|
- " V(system): type of the OS, retrieved from C(platform.system), e.g. I(Linux), I(Darwin);"
|
||||||
|
- " V(machine): machine architecture, retrieved from C(platform.machine), e.g. I(x86_64), I(i386);"
|
||||||
|
- " V(asset_name): name of the selected asset from the GitHub metadata results, e.g. I(dive_0.11.0_linux_amd64.deb);"
|
||||||
|
- " V(asset_dirname): directory where the downloaded asset is located, e.g. I(/tmp/ansible-moduletmp-1695757626.5862153-xjpc5ip8);"
|
||||||
|
- " V(asset_filename): name of the download asset file, e.g. I(dive_0.11.0_linux_amd64bnha_1dr.deb);"
|
||||||
|
- " V(asset_version): version of the asset, retrieved directly from the GitHub metadata;"
|
||||||
|
- " all variables defined in C(/etc/os-release), lowercase."
|
||||||
|
|
||||||
|
author:
|
||||||
|
- Florian L. (@NaeiKinDus)
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = r'''
|
||||||
|
- name: Install dependencies from GitHub
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
github_artifact:
|
||||||
|
artifacts:
|
||||||
|
- asset_type: tag
|
||||||
|
repository: smxi/inxi
|
||||||
|
cmds:
|
||||||
|
- tar -zxf {asset_dirname}/{asset_filename}
|
||||||
|
- install --group=root --mode=755 --owner=root smxi-inxi-*/inxi /usr/bin
|
||||||
|
- install --group=root --mode=644 --owner=root smxi-inxi-*/inxi.1 /usr/share/man/man1
|
||||||
|
- apt-get install libdata-dump-perl
|
||||||
|
- asset_name: dive_{version}_linux_amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
repository: wagoodman/dive
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
'''
|
||||||
|
|
||||||
|
RETURN = r'''
|
||||||
|
# These are examples of possible return values, and in general should use other names for return values.
|
||||||
|
original_message:
|
||||||
|
description: The original name param that was passed in.
|
||||||
|
type: str
|
||||||
|
returned: always
|
||||||
|
sample: "hello world"
|
||||||
|
'''
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import AnsibleModule, missing_required_lib # noqa
|
||||||
|
from ansible.module_utils.urls import fetch_url, fetch_file # noqa
|
||||||
|
|
||||||
|
ANSIBLE_MODULE: AnsibleModule | None = None
|
||||||
|
LIB_IMPORTED = False
|
||||||
|
GITHUB_API_BASE = "https://api.github.com"
|
||||||
|
GITHUB_DOWNLOAD_BASE = "https://github.com"
|
||||||
|
GITHUB_API_VERSION = "2022-11-28"
|
||||||
|
DEFAULT_HEADERS: dict[str, str] = {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"Accept": "application/json, application/vnd.github+json;q=0.8",
|
||||||
|
}
|
||||||
|
|
||||||
|
TEMPLATE_ASSET_NAME_VARS: dict[str, str] = {
|
||||||
|
"version": "", # platform.version(), e.g. "12 (bookworm)"
|
||||||
|
"system": "", # platform.system(), e.g. "Linux", "Darwin"
|
||||||
|
"machine": "" # platform.machine(), e.g. "x86_64", "i386"
|
||||||
|
}
|
||||||
|
try:
|
||||||
|
from datetime import datetime
|
||||||
|
from difflib import SequenceMatcher
|
||||||
|
from json import loads
|
||||||
|
from os import environ, sep
|
||||||
|
from platform import system, machine
|
||||||
|
from typing import Any
|
||||||
|
LIB_IMPORTED = True
|
||||||
|
except ModuleNotFoundError as excp:
|
||||||
|
import traceback
|
||||||
|
IMPORT_LIB_ERROR = traceback.format_exc()
|
||||||
|
IMPORT_LIB_NAME = excp.name
|
||||||
|
try:
|
||||||
|
from platform import freedesktop_os_release
|
||||||
|
except (ModuleNotFoundError, ImportError):
|
||||||
|
FREEDESKTOP_OS_RELEASE_FILE = '/etc/os-release'
|
||||||
|
|
||||||
|
def freedesktop_os_release() -> dict[str, str]:
|
||||||
|
try:
|
||||||
|
with open(FREEDESKTOP_OS_RELEASE_FILE, 'r') as fd:
|
||||||
|
data = fd.read()
|
||||||
|
os_info: dict[str, str] = {key: value.strip('"') for key, value in (line.split('=') for line in data.splitlines())}
|
||||||
|
except FileNotFoundError:
|
||||||
|
return dict()
|
||||||
|
return os_info
|
||||||
|
|
||||||
|
|
||||||
|
def find_compatible_asset(assets_list: list[dict[str, str | int | float]], asset_name: str) -> dict[str, str] | None:
|
||||||
|
""" takes a list of assets and tries to find the most relevant one; assumes only one asset is required """
|
||||||
|
best_match: dict[str, str] = {}
|
||||||
|
matched_name_ratio: float = 0.0
|
||||||
|
|
||||||
|
if len(assets_list) == 0:
|
||||||
|
return None
|
||||||
|
elif len(assets_list) == 1:
|
||||||
|
return {
|
||||||
|
"asset_name": assets_list[0]["name"],
|
||||||
|
"download_url": assets_list[0]["browser_download_url"],
|
||||||
|
"match_ratio": "1.0"
|
||||||
|
}
|
||||||
|
|
||||||
|
sm = SequenceMatcher(a=asset_name, b="")
|
||||||
|
for asset in assets_list:
|
||||||
|
if asset_name == asset["name"]:
|
||||||
|
return {
|
||||||
|
"asset_name": asset["name"],
|
||||||
|
"download_url": asset["browser_download_url"],
|
||||||
|
"match_ratio": "1.0"
|
||||||
|
}
|
||||||
|
sm.set_seq2(asset["name"])
|
||||||
|
ratio = sm.ratio()
|
||||||
|
if ratio > matched_name_ratio:
|
||||||
|
best_match = asset
|
||||||
|
matched_name_ratio = ratio
|
||||||
|
if not best_match:
|
||||||
|
return None
|
||||||
|
return {
|
||||||
|
"asset_name": best_match["name"],
|
||||||
|
"download_url": best_match["browser_download_url"],
|
||||||
|
"match_ratio": "{:.5f}".format(matched_name_ratio)
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
def fetch_github_data(url: str) -> tuple[dict | None, dict[str, int]]:
|
||||||
|
""" query GitHub API and return a JSON formatted response along with HTTP info data """
|
||||||
|
response, info = fetch_url(ANSIBLE_MODULE, url, headers=DEFAULT_HEADERS)
|
||||||
|
http_status: int = info.get("status", 999)
|
||||||
|
if http_status >= 400:
|
||||||
|
return None, info
|
||||||
|
return loads(response.read().decode("utf-8")), info
|
||||||
|
|
||||||
|
|
||||||
|
def get_released_asset(artifact: dict[str, str]) -> tuple[dict[str, str], dict[str, int] | None]:
|
||||||
|
""" fetch asset metadata using the release GitHub API """
|
||||||
|
repository: str = artifact["repository"]
|
||||||
|
version: str = artifact["version"]
|
||||||
|
releases_url: str = "{}/repos/{}/releases/{}{}".format(
|
||||||
|
GITHUB_API_BASE,
|
||||||
|
repository,
|
||||||
|
"tags/" if version != "latest" else "",
|
||||||
|
version
|
||||||
|
)
|
||||||
|
|
||||||
|
if ANSIBLE_MODULE.check_mode:
|
||||||
|
return {
|
||||||
|
"asset_name": "{}/{}.ext".format(repository, version),
|
||||||
|
"download_url": "download_url",
|
||||||
|
"match_confidence": "match_ratio",
|
||||||
|
"version": version
|
||||||
|
}, {}
|
||||||
|
|
||||||
|
response_data, info = fetch_github_data(releases_url)
|
||||||
|
if not response_data:
|
||||||
|
return {"error": "No release found for version {}. Requested source: {}".format(version, releases_url)}, info
|
||||||
|
|
||||||
|
asset_name = artifact.get("asset_name", "").format(**TEMPLATE_ASSET_NAME_VARS)
|
||||||
|
asset = find_compatible_asset(response_data["assets"], asset_name=asset_name)
|
||||||
|
if not asset:
|
||||||
|
if not asset_name:
|
||||||
|
return {"error": "No matching asset detected, try specifying the desired asset name in arguments list"}, info
|
||||||
|
return {"error": "No asset matching name {} found".format(asset_name)}, info
|
||||||
|
return {
|
||||||
|
"asset_name": asset["asset_name"],
|
||||||
|
"download_url": asset["download_url"],
|
||||||
|
"match_confidence": asset["match_ratio"],
|
||||||
|
"version": response_data["tag_name"] or response_data["name"]
|
||||||
|
}, info
|
||||||
|
|
||||||
|
|
||||||
|
def get_tagged_asset(artifact: dict[str, Any]) -> tuple[dict[str, str], dict[str, int] | None]:
|
||||||
|
""" fetch asset metadata using the tags GitHub API """
|
||||||
|
repository: str = artifact["repository"]
|
||||||
|
version: str = artifact["version"]
|
||||||
|
tags_url: str = "{}/repos/{}/tags?per_page=1".format(GITHUB_API_BASE, repository)
|
||||||
|
|
||||||
|
if version != "latest":
|
||||||
|
return {
|
||||||
|
"asset_name": "{}.tar.gz".format(version),
|
||||||
|
"download_url": "{}/{}/archive/refs/tags/{}.tar.gz".format(GITHUB_DOWNLOAD_BASE, repository, version),
|
||||||
|
"version": version
|
||||||
|
}, None
|
||||||
|
|
||||||
|
if ANSIBLE_MODULE.check_mode:
|
||||||
|
return {
|
||||||
|
"asset_name": "asset_name",
|
||||||
|
"download_url": "download_url",
|
||||||
|
"version": version
|
||||||
|
}, {}
|
||||||
|
|
||||||
|
response_data, info = fetch_github_data(tags_url)
|
||||||
|
if not response_data:
|
||||||
|
return {
|
||||||
|
"error": "No tagged asset found for '{}'".format(tags_url)
|
||||||
|
}, info
|
||||||
|
response_data = response_data[0]
|
||||||
|
return {
|
||||||
|
"asset_name": "{}.tar.gz".format(response_data.get("name", "unknown")),
|
||||||
|
"download_url": response_data.get("tarball_url"),
|
||||||
|
"version": response_data.get("name", "latest")
|
||||||
|
}, info
|
||||||
|
|
||||||
|
|
||||||
|
def fetch_metadata(artifact: dict[str, str]) -> dict[str, str] | None:
|
||||||
|
""" retrieve metadata from the specified repository """
|
||||||
|
if artifact["asset_type"] == "tag":
|
||||||
|
metadata, info = get_tagged_asset(artifact)
|
||||||
|
else:
|
||||||
|
metadata, info = get_released_asset(artifact)
|
||||||
|
if info:
|
||||||
|
reset_date = info.get("x-ratelimit-reset", None)
|
||||||
|
metadata["rate_limit_max"] = info.get("x-ratelimit-limit", "unknown")
|
||||||
|
metadata["rate_limit_remaining"] = info.get("x-ratelimit-remaining", "unknown")
|
||||||
|
metadata["rate_limit_reset_date"] = datetime.fromtimestamp(float(reset_date)).isoformat() if reset_date else "unknown"
|
||||||
|
return metadata
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
global ANSIBLE_MODULE
|
||||||
|
|
||||||
|
module_args: dict[str, dict[str, Any]] = {
|
||||||
|
"artifacts": {
|
||||||
|
"type": "list",
|
||||||
|
"elements": "dict",
|
||||||
|
"required": True,
|
||||||
|
"options": {
|
||||||
|
"asset_name": {
|
||||||
|
"type": "str",
|
||||||
|
"required": False,
|
||||||
|
"default": ""
|
||||||
|
},
|
||||||
|
"asset_type": {
|
||||||
|
"type": "str",
|
||||||
|
"required": True,
|
||||||
|
"choices": ["release", "tag"],
|
||||||
|
},
|
||||||
|
"cmds": {
|
||||||
|
"type": "list",
|
||||||
|
"elements": "str",
|
||||||
|
"required": False,
|
||||||
|
"default": []
|
||||||
|
},
|
||||||
|
"repository": {
|
||||||
|
"type": "str",
|
||||||
|
"required": True
|
||||||
|
},
|
||||||
|
"version": {
|
||||||
|
"type": "str",
|
||||||
|
"required": False,
|
||||||
|
"default": "latest"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"github_token": {
|
||||||
|
"type": "str",
|
||||||
|
"required": False,
|
||||||
|
"no_log": True
|
||||||
|
},
|
||||||
|
}
|
||||||
|
result: dict[str, Any] = {
|
||||||
|
"artifacts": [],
|
||||||
|
"changed": False,
|
||||||
|
"msg": ""
|
||||||
|
}
|
||||||
|
|
||||||
|
ANSIBLE_MODULE = AnsibleModule(argument_spec=module_args, supports_check_mode=True)
|
||||||
|
if "FORCE_CHECK_MODE" in environ:
|
||||||
|
ANSIBLE_MODULE.check_mode = True if environ.get("FORCE_CHECK_MODE", False) in [True, "1", "True", "true"] else False
|
||||||
|
if ANSIBLE_MODULE.params["github_token"]:
|
||||||
|
DEFAULT_HEADERS["Authorization"] = "Bearer {}".format(ANSIBLE_MODULE.params["github_token"])
|
||||||
|
|
||||||
|
if not LIB_IMPORTED:
|
||||||
|
ANSIBLE_MODULE.fail_json(msg=missing_required_lib(IMPORT_LIB_NAME), exception=IMPORT_LIB_ERROR) # pylint: disable=used-before-assignment
|
||||||
|
|
||||||
|
# load local metadata cached file to retrieve installed version
|
||||||
|
TEMPLATE_ASSET_NAME_VARS.update({key.lower(): value for key, value in freedesktop_os_release().items()})
|
||||||
|
TEMPLATE_ASSET_NAME_VARS["system"] = system().lower()
|
||||||
|
TEMPLATE_ASSET_NAME_VARS["machine"] = machine().lower()
|
||||||
|
for artifact in ANSIBLE_MODULE.params["artifacts"]:
|
||||||
|
# fetch artifact metadata
|
||||||
|
artifact_result: dict[str, Any] = {
|
||||||
|
"asset_data": fetch_metadata(artifact),
|
||||||
|
"repository": artifact.get("repository"),
|
||||||
|
"version": artifact.get("version"),
|
||||||
|
"cmds": []
|
||||||
|
}
|
||||||
|
result["rate_limit_remaining"] = artifact_result["asset_data"].get("rate_limit_remaining", "unknown")
|
||||||
|
result["rate_limit_max"] = artifact_result["asset_data"].get("rate_limit_max", "unknown")
|
||||||
|
|
||||||
|
if "error" in artifact_result["asset_data"]:
|
||||||
|
result["artifacts"].append(artifact_result)
|
||||||
|
result["msg"] = artifact_result["asset_data"].get("error")
|
||||||
|
result["failed"] = True
|
||||||
|
ANSIBLE_MODULE.fail_json(**result)
|
||||||
|
|
||||||
|
# download artifact
|
||||||
|
if ANSIBLE_MODULE.check_mode:
|
||||||
|
artifact_result["download_dir"] = "unknown"
|
||||||
|
else:
|
||||||
|
artifact_result["download_dir"] = fetch_file(ANSIBLE_MODULE, artifact_result["asset_data"].get("download_url", "unknown"), decompress=False)
|
||||||
|
TEMPLATE_ASSET_NAME_VARS["asset_name"] = artifact_result["asset_data"].get("asset_name", "unknown")
|
||||||
|
TEMPLATE_ASSET_NAME_VARS["asset_version"] = artifact_result["asset_data"].get("version", "unknown")
|
||||||
|
parts = artifact_result["download_dir"].rsplit(sep, 1)
|
||||||
|
TEMPLATE_ASSET_NAME_VARS["asset_dirname"] = parts[0] if len(parts) > 1 else ""
|
||||||
|
TEMPLATE_ASSET_NAME_VARS["asset_filename"] = parts[1] if len(parts) > 1 else parts[0]
|
||||||
|
|
||||||
|
# install artifact
|
||||||
|
artifact_commands = [line.format(**TEMPLATE_ASSET_NAME_VARS) for line in artifact["cmds"]]
|
||||||
|
if ANSIBLE_MODULE.check_mode:
|
||||||
|
artifact_result["stdout"] = artifact_result["stderr"] = ""
|
||||||
|
artifact_result["ret_code"] = None
|
||||||
|
artifact_result["cmds"] = artifact_commands
|
||||||
|
artifact_result["state"] = "should be installed" if len(artifact_commands) else "should be downloaded"
|
||||||
|
else:
|
||||||
|
for command_line in artifact_commands:
|
||||||
|
cmd_rc, cmd_out, cmd_err = ANSIBLE_MODULE.run_command(command_line, use_unsafe_shell=True, cwd=ANSIBLE_MODULE.tmpdir)
|
||||||
|
result["changed"] = True
|
||||||
|
artifact_result["cmds"].append({
|
||||||
|
"command": command_line,
|
||||||
|
"stdout": cmd_out,
|
||||||
|
"stderr": cmd_err,
|
||||||
|
"ret_code": cmd_rc
|
||||||
|
})
|
||||||
|
|
||||||
|
if cmd_rc:
|
||||||
|
artifact_result["state"] = "installation failed"
|
||||||
|
result["failed"] = True
|
||||||
|
result["artifacts"].append(artifact_result)
|
||||||
|
ANSIBLE_MODULE.fail_json(**result)
|
||||||
|
|
||||||
|
try:
|
||||||
|
del artifact_result["command"], artifact_result["stdout"], artifact_result["stderr"], artifact_result["ret_code"]
|
||||||
|
except: # pylint: disable=bare-except # noqa: 722
|
||||||
|
pass
|
||||||
|
artifact_result["state"] = "installed" if len(artifact_commands) else "downloaded"
|
||||||
|
|
||||||
|
result["artifacts"].append(artifact_result)
|
||||||
|
result["msg"] = "OK"
|
||||||
|
ANSIBLE_MODULE.exit_json(**result)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
{
|
||||||
|
"ANSIBLE_MODULE_ARGS": {
|
||||||
|
"github_token": "",
|
||||||
|
"artifacts": [
|
||||||
|
{
|
||||||
|
"asset_type": "tag",
|
||||||
|
"repository": "smxi/inxi",
|
||||||
|
"version": "3.3.29-1",
|
||||||
|
"cmds": [
|
||||||
|
"echo asset_name: {asset_name}",
|
||||||
|
"echo asset_dirname: {asset_dirname}",
|
||||||
|
"echo asset_filename: {asset_filename}",
|
||||||
|
"echo asset_version: {asset_version}",
|
||||||
|
"echo system: {system}",
|
||||||
|
"echo machine: {machine}",
|
||||||
|
"echo version: {version}"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"asset_type": "tag",
|
||||||
|
"repository": "smxi/inxi",
|
||||||
|
"cmds": [
|
||||||
|
"tar -zxf {asset_dirname}/{asset_filename}",
|
||||||
|
"install --group=root --mode=755 --owner=root smxi-inxi-*/inxi /usr/bin",
|
||||||
|
"install --group=root --mode=644 --owner=root smxi-inxi-*/inxi.1 /usr/share/man/man1",
|
||||||
|
"apt-get install libdata-dump-perl"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"asset_name": "dive_{version}_linux_amd64.deb",
|
||||||
|
"asset_type": "release",
|
||||||
|
"repository": "wagoodman/dive"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"asset_name": "dive_{version}_linux_amd64.deb",
|
||||||
|
"asset_type": "release",
|
||||||
|
"repository": "wagoodman/dive",
|
||||||
|
"version": "v0.10.0"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
custom_github_token: ""
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
author: Florian L.
|
||||||
|
namespace: nullified
|
||||||
|
description: Setup common tasks (e.g. users, CLI tools)
|
||||||
|
# issue_tracker_url: http://example.com/issue/tracker
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: 2.15
|
||||||
|
|
||||||
|
# https://galaxy.ansible.com/api/v1/platforms/
|
||||||
|
platforms:
|
||||||
|
- name: Debian
|
||||||
|
versions:
|
||||||
|
- bookworm
|
||||||
|
|
||||||
|
galaxy_tags:
|
||||||
|
- github
|
||||||
|
- assets
|
||||||
|
- utils
|
||||||
|
- system
|
||||||
|
|
||||||
|
dependencies: []
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
---
|
||||||
|
- name: '[APT] install dependencies and tools'
|
||||||
|
become: yes
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: yes
|
||||||
|
force_apt_get: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
pkg:
|
||||||
|
- bzip2
|
||||||
|
- cron
|
||||||
|
- emacs-nox
|
||||||
|
- git
|
||||||
|
- jq
|
||||||
|
- less
|
||||||
|
- libdata-dump-perl # inxi
|
||||||
|
- libxml-dumper-perl # inxi
|
||||||
|
- ncdu
|
||||||
|
- openssh-server
|
||||||
|
- procps
|
||||||
|
- rsync
|
||||||
|
- zsh
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[GitHub] install tools'
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
nullified.infrastructure.github_artifact:
|
||||||
|
github_token: '{{ custom_github_token }}'
|
||||||
|
artifacts:
|
||||||
|
- repository: smxi/inxi
|
||||||
|
asset_type: tag
|
||||||
|
cmds:
|
||||||
|
- tar -zxf {asset_dirname}/{asset_filename}
|
||||||
|
- install --group=root --mode=755 --owner=root smxi-inxi-*/inxi /usr/local/bin
|
||||||
|
- install --group=root --mode=644 --owner=root smxi-inxi-*/inxi.1 /usr/share/man/man1
|
||||||
|
- repository: sharkdp/bat
|
||||||
|
asset_name: bat_{version}_amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
- repository: aristocratos/btop
|
||||||
|
asset_name: btop-x86_64-linux-musl.tbz
|
||||||
|
asset_type: release
|
||||||
|
cmds:
|
||||||
|
- tar -xjf {asset_dirname}/{asset_filename}
|
||||||
|
- install --group=root --mode=755 --owner=root btop/bin/btop /usr/bin
|
||||||
|
- mkdir /usr/share/btop || true
|
||||||
|
- cp -pr btop/themes /usr/share/btop
|
||||||
|
- repository: eza-community/eza
|
||||||
|
asset_name: eza_x86_64-unknown-linux-gnu.tar.gz
|
||||||
|
asset_type: release
|
||||||
|
cmds:
|
||||||
|
- tar -zxf {asset_dirname}/{asset_filename}
|
||||||
|
- install --group=root --mode=755 --owner=root eza /usr/bin
|
||||||
|
- repository: muesli/duf
|
||||||
|
asset_name: duf_{version}_linux_amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
localhost
|
||||||
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
custom_github_token: ""
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
# handlers file for development
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
author: Florian L.
|
||||||
|
namespace: nullified
|
||||||
|
description: Install tools for development environment
|
||||||
|
# issue_tracker_url: http://example.com/issue/tracker
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: 2.15
|
||||||
|
|
||||||
|
# https://galaxy.ansible.com/api/v1/platforms/
|
||||||
|
platforms:
|
||||||
|
- name: Debian
|
||||||
|
versions:
|
||||||
|
- bookworm
|
||||||
|
|
||||||
|
galaxy_tags:
|
||||||
|
- github
|
||||||
|
- assets
|
||||||
|
- utils
|
||||||
|
- system
|
||||||
|
|
||||||
|
dependencies: []
|
||||||
|
|
@ -0,0 +1,146 @@
|
||||||
|
---
|
||||||
|
- name: '[APT] install dependencies and tools'
|
||||||
|
become: true
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
force_apt_get: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
pkg:
|
||||||
|
- autoconf
|
||||||
|
- bc
|
||||||
|
- ca-certificates # docker-ce
|
||||||
|
- curl
|
||||||
|
- g++
|
||||||
|
- gcc
|
||||||
|
- git
|
||||||
|
- gnupg # docker-ce
|
||||||
|
- jq
|
||||||
|
- libasound2 # draw.io
|
||||||
|
- libatspi2.0-0 # draw.io
|
||||||
|
- libgtk-3-0 # draw.io
|
||||||
|
- libnotify4 # draw.io
|
||||||
|
- libnss3 # draw.io
|
||||||
|
- libsecret-1-0 # draw.io
|
||||||
|
- libxss1 # draw.io
|
||||||
|
- libxtst6 # draw.io
|
||||||
|
- make
|
||||||
|
- shellcheck
|
||||||
|
- valgrind
|
||||||
|
- xdg-utils # draw.io
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[GitHub] install tools'
|
||||||
|
become: true
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
nullified.infrastructure.github_artifact:
|
||||||
|
github_token: '{{ custom_github_token }}'
|
||||||
|
artifacts:
|
||||||
|
- asset_name: dive_{version}_linux_amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
repository: wagoodman/dive
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
- asset_name: kubeconform-linux-amd64.tar.gz
|
||||||
|
asset_type: release
|
||||||
|
repository: yannh/kubeconform
|
||||||
|
cmds:
|
||||||
|
- tar -zxf {asset_dirname}/{asset_filename}
|
||||||
|
- install --group=root --mode=755 --owner=root kubeconform /usr/local/bin
|
||||||
|
- asset_name: git-delta_{version}_amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
repository: dandavison/delta
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
- asset_name: docker-compose-linux-x86_64
|
||||||
|
asset_type: release
|
||||||
|
repository: docker/compose
|
||||||
|
cmds:
|
||||||
|
- install --group=root --mode=755 --owner=root {asset_dirname}/{asset_filename} /usr/local/bin/docker-compose
|
||||||
|
- test -d /usr/local/lib/docker/cli-plugins && (rm /usr/local/lib/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/local/lib/docker/cli-plugins) || true
|
||||||
|
- test -d /usr/local/libexec/docker/cli-plugins && (rm /usr/local/libexec/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/local/libexec/docker/cli-plugins) || true
|
||||||
|
- test -d /usr/lib/docker/cli-plugins && (rm /usr/lib/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/lib/docker/cli-plugins) || true
|
||||||
|
- test -d /usr/libexec/docker/cli-plugins && (rm /usr/libexec/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/libexec/docker/cli-plugins) || true
|
||||||
|
- asset_name: buildx-{version}.linux-amd64
|
||||||
|
asset_type: release
|
||||||
|
repository: docker/buildx
|
||||||
|
cmds:
|
||||||
|
- install --group=root --mode=755 --owner=root {asset_dirname}/{asset_filename} /usr/local/bin/docker-buildx
|
||||||
|
- test -d /usr/local/lib/docker/cli-plugins && (rm /usr/local/lib/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/local/lib/docker/cli-plugins) || true
|
||||||
|
- test -d /usr/local/libexec/docker/cli-plugins && (rm /usr/local/libexec/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/local/libexec/docker/cli-plugins) || true
|
||||||
|
- test -d /usr/lib/docker/cli-plugins && (rm /usr/lib/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/lib/docker/cli-plugins) || true
|
||||||
|
- test -d /usr/libexec/docker/cli-plugins && (rm /usr/libexec/docker/cli-plugins/docker-compose; ln -s /usr/local/bin/docker-compose /usr/libexec/docker/cli-plugins) || true
|
||||||
|
- asset_name: drawio-amd64-{version}.deb
|
||||||
|
asset_type: release
|
||||||
|
repository: jgraph/drawio-desktop
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
- asset_name: OpenLens-{version}.amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
repository: MuhammedKalkan/OpenLens
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
- asset_name: stern_{version}_linux_amd64.tar.gz
|
||||||
|
asset_type: release
|
||||||
|
repository: stern/stern
|
||||||
|
cmds:
|
||||||
|
- tar -zxf {asset_dirname}/{asset_filename}
|
||||||
|
- install --group=root --mode=755 --owner=root stern /usr/local/bin
|
||||||
|
- asset_name: tofu_{version}_amd64.deb
|
||||||
|
asset_type: release
|
||||||
|
repository: opentofu/opentofu
|
||||||
|
cmds:
|
||||||
|
- dpkg -i {asset_dirname}/{asset_filename}
|
||||||
|
|
||||||
|
- name: '[Custom] install latest kubectl'
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
kubeVersion=$(curl -sSL -f https://storage.googleapis.com/kubernetes-release/release/stable.txt 2> /dev/null)
|
||||||
|
kubeVersion=${kubeVersion:-v1.28.2}
|
||||||
|
curl --silent --compressed -L -XGET https://storage.googleapis.com/kubernetes-release/release/${kubeVersion}/bin/linux/amd64/kubectl -o kubectl
|
||||||
|
install --group=root --mode=755 --owner=root kubectl /usr/local/bin && rm kubectl
|
||||||
|
|
||||||
|
- name: '[Custom] install latest Helm'
|
||||||
|
become: yes
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
helmVersion=$(curl -sSL https://api.github.com/repos/helm/helm/releases/latest | jq -r '.tag_name')
|
||||||
|
helmVersion=${helmVersion:-v3.13.0}
|
||||||
|
curl --silent --compressed -L -XGET https://get.helm.sh/helm-${helmVersion}-linux-amd64.tar.gz -o helm.tar.gz
|
||||||
|
tar -zxf helm.tar.gz
|
||||||
|
install --group=root --mode=755 --owner=root linux-amd64/helm /usr/local/bin && rm -rf linux-amd64 helm.tar.gz
|
||||||
|
|
||||||
|
- name: '[custom] install Docker CE repository'
|
||||||
|
block:
|
||||||
|
- name: '[apt key] retrieve GPG key'
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
ansible.builtin.shell: |-
|
||||||
|
curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
||||||
|
chmod a+r /etc/apt/keyrings/docker.gpg
|
||||||
|
|
||||||
|
- name: '[apt key] add source'
|
||||||
|
ansible.builtin.apt_repository:
|
||||||
|
repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[Apt Key] refresh repository'
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
force_apt_get: true
|
||||||
|
cache_valid_time: 0
|
||||||
|
|
||||||
|
- name: '[Apt] install Docker CE'
|
||||||
|
become: yes
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
force_apt_get: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
pkg:
|
||||||
|
- docker-ce
|
||||||
|
- docker-ce-cli
|
||||||
|
- containerd.io
|
||||||
|
state: present
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
localhost
|
||||||
|
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
# vars file for development
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
security_clamav_version: 1.2.1
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
- name: '[ssh] restart service'
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: sshd.service
|
||||||
|
enabled: true
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: '[clamav] daemon reload'
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
daemon_reload: true
|
||||||
|
|
||||||
|
- name: '[freshclam] restart service'
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: sshd.service
|
||||||
|
enabled: true
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: '[clamd] wait for signatures'
|
||||||
|
ansible.builtin.wait_for:
|
||||||
|
path: /var/lib/clamav/bytecode.cvd
|
||||||
|
timeout: 600
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[clamd] restart service'
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: sshd.service
|
||||||
|
enabled: true
|
||||||
|
state: restarted
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
author: Florian L.
|
||||||
|
namespace: nullified
|
||||||
|
description: Deploy security tweaks to systems
|
||||||
|
# issue_tracker_url: http://example.com/issue/tracker
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: 2.15
|
||||||
|
|
||||||
|
# https://galaxy.ansible.com/api/v1/platforms/
|
||||||
|
platforms:
|
||||||
|
- name: Debian
|
||||||
|
versions:
|
||||||
|
- bookworm
|
||||||
|
|
||||||
|
galaxy_tags:
|
||||||
|
- github
|
||||||
|
- assets
|
||||||
|
- utils
|
||||||
|
- system
|
||||||
|
|
||||||
|
dependencies: []
|
||||||
|
|
@ -0,0 +1,166 @@
|
||||||
|
---
|
||||||
|
- name: '[setup] gather facts is not already done'
|
||||||
|
setup:
|
||||||
|
gather_subset:
|
||||||
|
- distribution
|
||||||
|
|
||||||
|
- name: '[ssh] hardening sshd'
|
||||||
|
become: yes
|
||||||
|
block:
|
||||||
|
- name: '[ssh] setup sshd_config'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/openssh-server/sshd_config.j2
|
||||||
|
dest: /etc/ssh/sshd_config
|
||||||
|
mode: 644
|
||||||
|
notify:
|
||||||
|
- '[ssh] restart service'
|
||||||
|
- name: '[ssh] setup sshd_config.d'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/openssh-server/sshd_config.d/encryption.conf.j2
|
||||||
|
dest: /etc/ssh/sshd_config.d/encryption.conf
|
||||||
|
mode: 644
|
||||||
|
notify:
|
||||||
|
- 'security : [ssh] restart service'
|
||||||
|
|
||||||
|
- name: '[utils] install security and audit tools'
|
||||||
|
become: yes
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
force_apt_get: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
pkg:
|
||||||
|
- lsof # rkhunter
|
||||||
|
- rkhunter
|
||||||
|
- unhide # rkhunter
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[system] configure rkhunter'
|
||||||
|
become: yes
|
||||||
|
block:
|
||||||
|
- name: '[rkhunter] create include dir'
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/rkhunter.d
|
||||||
|
state: directory
|
||||||
|
mode: '0750'
|
||||||
|
- name: '[rkhunter] copy configuration'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/rkhunter/rkhunter.conf.local.j2
|
||||||
|
dest: /etc/rkhunter.conf.local
|
||||||
|
mode: '0640'
|
||||||
|
- name: '[rkhunter] setup cronjob'
|
||||||
|
ansible.builtin.cron:
|
||||||
|
name: rkhunter check
|
||||||
|
minute: 0
|
||||||
|
hour: 4
|
||||||
|
day: "*/3"
|
||||||
|
job: "/usr/bin/rkhunter -c 2>&1"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[system] clamav'
|
||||||
|
become: yes
|
||||||
|
block:
|
||||||
|
- name: '[clamav] retrieve and install clamav package'
|
||||||
|
ansible.builtin.apt:
|
||||||
|
deb: https://www.clamav.net/downloads/production/clamav-{{ security_clamav_version }}.linux.x86_64.deb
|
||||||
|
force_apt_get: true
|
||||||
|
state: present
|
||||||
|
- name: '[clamav] add clamav group'
|
||||||
|
ansible.builtin.group:
|
||||||
|
name: clamav
|
||||||
|
system: true
|
||||||
|
state: present
|
||||||
|
- name: '[clamav] add clamav user'
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: clamav
|
||||||
|
comment: clamav
|
||||||
|
create_home: false
|
||||||
|
expires: -1
|
||||||
|
group: clamav
|
||||||
|
shell: /bin/false
|
||||||
|
system: true
|
||||||
|
state: present
|
||||||
|
- name: '[clamav] setup directories'
|
||||||
|
block:
|
||||||
|
- name: '[clamav] ensure /etc/clamav dir exists'
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/clamav
|
||||||
|
state: directory
|
||||||
|
owner: clamav
|
||||||
|
group: clamav
|
||||||
|
mode: '0750'
|
||||||
|
- name: '[clamav] ensure /var/lib/clamav dir exists'
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /var/lib/clamav
|
||||||
|
state: directory
|
||||||
|
owner: clamav
|
||||||
|
group: clamav
|
||||||
|
mode: '0750'
|
||||||
|
- name: '[clamav] ensure /var/lib/clamav/quarantine dir exists'
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /var/lib/clamav/quarantine
|
||||||
|
state: directory
|
||||||
|
owner: clamav
|
||||||
|
group: clamav
|
||||||
|
mode: '0750'
|
||||||
|
- name: '[clamav] ensure /var/log/clamav dir exists'
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /var/log/clamav
|
||||||
|
state: directory
|
||||||
|
owner: clamav
|
||||||
|
group: clamav
|
||||||
|
mode: '0750'
|
||||||
|
- name: '[clamav] copy clamd.conf'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: '../templates/clamav/clamd.conf.j2'
|
||||||
|
dest: /etc/clamav/clamd.conf
|
||||||
|
owner: clamav
|
||||||
|
group: clamav
|
||||||
|
mode: '0640'
|
||||||
|
- name: '[clamav] copy freshclam.conf'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: '../templates/clamav/freshclam.conf.j2'
|
||||||
|
dest: /etc/clamav/freshclam.conf
|
||||||
|
owner: clamav
|
||||||
|
group: clamav
|
||||||
|
mode: '0640'
|
||||||
|
- name: '[clamav] setup freshclam service'
|
||||||
|
block:
|
||||||
|
- name: '[clamav] copy freshclam service file'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: '../templates/clamav/clamav-freshclam.service.j2'
|
||||||
|
dest: /usr/lib/systemd/system/clamav-freshclam.service
|
||||||
|
mode: '0644'
|
||||||
|
- name: '[clamav] setup clamd service'
|
||||||
|
block:
|
||||||
|
- name: '[clamav] copy clamd service file'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: '../templates/clamav/clamav-clamd.service.j2'
|
||||||
|
dest: /usr/lib/systemd/system/clamav-clamd.service
|
||||||
|
mode: '0644'
|
||||||
|
- name: '[clamav] setup cron job'
|
||||||
|
ansible.builtin.cron:
|
||||||
|
name: clamav full system scan
|
||||||
|
minute: 30
|
||||||
|
hour: 5
|
||||||
|
weekday: 0
|
||||||
|
job: "/usr/local/bin/clamscan --recursive --infected --exclude-dir='^/(sys|proc)' --database=/var/lib/clamav --move=/var/lib/clamav/quarantine --log=/var/log/clamav/weekly.log / 2>&1"
|
||||||
|
state: present
|
||||||
|
notify:
|
||||||
|
- 'security : [clamav] daemon reload'
|
||||||
|
- 'security : [freshclam] restart service'
|
||||||
|
- 'security : [clamd] wait for signatures'
|
||||||
|
- 'security : [clamd] restart service'
|
||||||
|
|
||||||
|
- name: '[system] hardening system'
|
||||||
|
become: yes
|
||||||
|
block:
|
||||||
|
- name: '[system] login.defs'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: '../templates/system/{{ ansible_distribution | lower }}/login.defs.j2'
|
||||||
|
dest: /etc/login.defs
|
||||||
|
mode: '0644'
|
||||||
|
- name: '[system] limits.conf'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: '../templates/system/{{ ansible_distribution | lower }}/limits.conf.j2'
|
||||||
|
dest: /etc/security/limits.conf
|
||||||
|
mode: '0644'
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
[Unit]
|
||||||
|
Description=ClamAV virus scanner
|
||||||
|
Documentation=man:clamd(1) man:clamd.conf(5) https://docs.clamav.net/
|
||||||
|
ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
|
||||||
|
ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=clamav
|
||||||
|
Group=clamav
|
||||||
|
Type=simple
|
||||||
|
ExecStart=/usr/local/sbin/clamd --foreground=true --config-file=/etc/clamav/clamd.conf
|
||||||
|
ExecReload=/bin/kill -USR2 $MAINPID
|
||||||
|
TimeoutStartSec=300
|
||||||
|
RuntimeDirectory=clamav
|
||||||
|
RuntimeDirectoryMode=0755
|
||||||
|
LogsDirectory=clamav
|
||||||
|
LogsDirectoryMode=0750
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
[Unit]
|
||||||
|
Description=ClamAV virus database updater
|
||||||
|
Documentation=man:freshclam(1) man:freshclam.conf(5) https://docs.clamav.net/
|
||||||
|
ConditionPathExists=!/etc/cron.d/clamav-freshclam
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStart=/usr/local/bin/freshclam -d --foreground=true --config-file=/etc/clamav/freshclam.conf
|
||||||
|
LogsDirectory=clamav
|
||||||
|
LogsDirectoryMode=0750
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
|
@ -0,0 +1,298 @@
|
||||||
|
##
|
||||||
|
## Example config file for clamav-milter
|
||||||
|
##
|
||||||
|
|
||||||
|
# Comment or remove the line below.
|
||||||
|
Example
|
||||||
|
|
||||||
|
|
||||||
|
##
|
||||||
|
## Main options
|
||||||
|
##
|
||||||
|
|
||||||
|
# Define the interface through which we communicate with sendmail
|
||||||
|
# This option is mandatory! Possible formats are:
|
||||||
|
# [[unix|local]:]/path/to/file - to specify a unix domain socket
|
||||||
|
# inet:port@[hostname|ip-address] - to specify an ipv4 socket
|
||||||
|
# inet6:port@[hostname|ip-address] - to specify an ipv6 socket
|
||||||
|
#
|
||||||
|
# Default: no default
|
||||||
|
#MilterSocket /run/clamav/clamav-milter.sock
|
||||||
|
#MilterSocket /tmp/clamav-milter.sock
|
||||||
|
#MilterSocket inet:7357
|
||||||
|
|
||||||
|
# Define the group ownership for the (unix) milter socket.
|
||||||
|
# Default: disabled (the primary group of the user running clamd)
|
||||||
|
#MilterSocketGroup virusgroup
|
||||||
|
|
||||||
|
# Sets the permissions on the (unix) milter socket to the specified mode.
|
||||||
|
# Default: disabled (obey umask)
|
||||||
|
#MilterSocketMode 660
|
||||||
|
|
||||||
|
# Remove stale socket after unclean shutdown.
|
||||||
|
#
|
||||||
|
# Default: yes
|
||||||
|
#FixStaleSocket yes
|
||||||
|
|
||||||
|
# Run as another user (clamav-milter must be started by root for this option
|
||||||
|
# to work)
|
||||||
|
#
|
||||||
|
# Default: unset (don't drop privileges)
|
||||||
|
#User clamav
|
||||||
|
|
||||||
|
# Waiting for data from clamd will timeout after this time (seconds).
|
||||||
|
# Value of 0 disables the timeout.
|
||||||
|
#
|
||||||
|
# Default: 120
|
||||||
|
#ReadTimeout 300
|
||||||
|
|
||||||
|
# Don't fork into background.
|
||||||
|
#
|
||||||
|
# Default: no
|
||||||
|
#Foreground yes
|
||||||
|
|
||||||
|
# Chroot to the specified directory.
|
||||||
|
# Chrooting is performed just after reading the config file and before
|
||||||
|
# dropping privileges.
|
||||||
|
#
|
||||||
|
# Default: unset (don't chroot)
|
||||||
|
#Chroot /newroot
|
||||||
|
|
||||||
|
# This option allows you to save a process identifier of the listening
|
||||||
|
# daemon.
|
||||||
|
# This file will be owned by root, as long as clamav-milter was started by
|
||||||
|
# root. It is recommended that the directory where this file is stored is
|
||||||
|
# also owned by root to keep other users from tampering with it.
|
||||||
|
#
|
||||||
|
# Default: disabled
|
||||||
|
#PidFile /run/clamav/clamav-milter.pid
|
||||||
|
|
||||||
|
# Optional path to the global temporary directory.
|
||||||
|
# Default: system specific (usually /tmp or /var/tmp).
|
||||||
|
#
|
||||||
|
#TemporaryDirectory /var/tmp
|
||||||
|
|
||||||
|
##
|
||||||
|
## Clamd options
|
||||||
|
##
|
||||||
|
|
||||||
|
# Define the clamd socket to connect to for scanning.
|
||||||
|
# This option is mandatory! Syntax:
|
||||||
|
# ClamdSocket unix:path
|
||||||
|
# ClamdSocket tcp:host:port
|
||||||
|
# The first syntax specifies a local unix socket (needs an absolute path) e.g.:
|
||||||
|
# ClamdSocket unix:/run/clamav/clamd.sock
|
||||||
|
# The second syntax specifies a tcp local or remote tcp socket: the
|
||||||
|
# host can be a hostname or an ip address; the ":port" field is only required
|
||||||
|
# for IPv6 addresses, otherwise it defaults to 3310, e.g.:
|
||||||
|
# ClamdSocket tcp:192.168.0.1
|
||||||
|
#
|
||||||
|
# This option can be repeated several times with different sockets or even
|
||||||
|
# with the same socket: clamd servers will be selected in a round-robin
|
||||||
|
# fashion.
|
||||||
|
#
|
||||||
|
# Default: no default
|
||||||
|
#ClamdSocket tcp:scanner.mydomain:7357
|
||||||
|
#ClamdSocket unix:/run/clamav/clamd.sock
|
||||||
|
|
||||||
|
|
||||||
|
##
|
||||||
|
## Exclusions
|
||||||
|
##
|
||||||
|
|
||||||
|
# Messages originating from these hosts/networks will not be scanned
|
||||||
|
# This option takes a host(name)/mask pair in CIRD notation and can be
|
||||||
|
# repeated several times. If "/mask" is omitted, a host is assumed.
|
||||||
|
# To specify a locally originated, non-smtp, email use the keyword "local"
|
||||||
|
#
|
||||||
|
# Default: unset (scan everything regardless of the origin)
|
||||||
|
#LocalNet local
|
||||||
|
#LocalNet 192.168.0.0/24
|
||||||
|
#LocalNet 1111:2222:3333::/48
|
||||||
|
|
||||||
|
# This option specifies a file which contains a list of basic POSIX regular
|
||||||
|
# expressions. Addresses (sent to or from - see below) matching these regexes
|
||||||
|
# will not be scanned. Optionally each line can start with the string "From:"
|
||||||
|
# or "To:" (note: no whitespace after the colon) indicating if it is,
|
||||||
|
# respectively, the sender or recipient that is to be allowed.
|
||||||
|
# If the field is missing, "To:" is assumed.
|
||||||
|
# Lines starting with #, : or ! are ignored.
|
||||||
|
#
|
||||||
|
# Default unset (no exclusion applied)
|
||||||
|
#AllowList /etc/allowed_addresses
|
||||||
|
|
||||||
|
# Messages from authenticated SMTP users matching this extended POSIX
|
||||||
|
# regular expression (egrep-like) will not be scanned.
|
||||||
|
# As an alternative, a file containing a plain (not regex) list of names (one
|
||||||
|
# per line) can be specified using the prefix "file:".
|
||||||
|
# e.g. SkipAuthenticated file:/etc/good_guys
|
||||||
|
#
|
||||||
|
# Note: this is the AUTH login name!
|
||||||
|
#
|
||||||
|
# Default: unset (no allowing based on SMTP auth)
|
||||||
|
#SkipAuthenticated ^(tom|dick|henry)$
|
||||||
|
|
||||||
|
# Messages larger than this value won't be scanned.
|
||||||
|
# Make sure this value is lower or equal than StreamMaxLength in clamd.conf
|
||||||
|
#
|
||||||
|
# Default: 25M
|
||||||
|
#MaxFileSize 10M
|
||||||
|
|
||||||
|
|
||||||
|
##
|
||||||
|
## Actions
|
||||||
|
##
|
||||||
|
|
||||||
|
# The following group of options controls the delivery process under
|
||||||
|
# different circumstances.
|
||||||
|
# The following actions are available:
|
||||||
|
# - Accept
|
||||||
|
# The message is accepted for delivery
|
||||||
|
# - Reject
|
||||||
|
# Immediately refuse delivery (a 5xx error is returned to the peer)
|
||||||
|
# - Defer
|
||||||
|
# Return a temporary failure message (4xx) to the peer
|
||||||
|
# - Blackhole (not available for OnFail)
|
||||||
|
# Like Accept but the message is sent to oblivion
|
||||||
|
# - Quarantine (not available for OnFail)
|
||||||
|
# Like Accept but message is quarantined instead of being delivered
|
||||||
|
#
|
||||||
|
# NOTE: In Sendmail the quarantine queue can be examined via mailq -qQ
|
||||||
|
# For Postfix this causes the message to be placed on hold
|
||||||
|
#
|
||||||
|
# Action to be performed on clean messages (mostly useful for testing)
|
||||||
|
# Default: Accept
|
||||||
|
#OnClean Accept
|
||||||
|
|
||||||
|
# Action to be performed on infected messages
|
||||||
|
# Default: Quarantine
|
||||||
|
#OnInfected Quarantine
|
||||||
|
|
||||||
|
# Action to be performed on error conditions (this includes failure to
|
||||||
|
# allocate data structures, no scanners available, network timeouts,
|
||||||
|
# unknown scanner replies and the like)
|
||||||
|
# Default: Defer
|
||||||
|
#OnFail Defer
|
||||||
|
|
||||||
|
# This option allows to set a specific rejection reason for infected messages
|
||||||
|
# and it's therefore only useful together with "OnInfected Reject"
|
||||||
|
# The string "%v", if present, will be replaced with the virus name.
|
||||||
|
# Default: MTA specific
|
||||||
|
#RejectMsg
|
||||||
|
|
||||||
|
# If this option is set to "Replace" (or "Yes"), an "X-Virus-Scanned" and an
|
||||||
|
# "X-Virus-Status" headers will be attached to each processed message, possibly
|
||||||
|
# replacing existing headers.
|
||||||
|
# If it is set to Add, the X-Virus headers are added possibly on top of the
|
||||||
|
# existing ones.
|
||||||
|
# Note that while "Replace" can potentially break DKIM signatures, "Add" may
|
||||||
|
# confuse procmail and similar filters.
|
||||||
|
# Default: no
|
||||||
|
#AddHeader Replace
|
||||||
|
|
||||||
|
# When AddHeader is in use, this option allows to arbitrary set the reported
|
||||||
|
# hostname. This may be desirable in order to avoid leaking internal names.
|
||||||
|
# If unset the real machine name is used.
|
||||||
|
# Default: disabled
|
||||||
|
#ReportHostname my.mail.server.name
|
||||||
|
|
||||||
|
# Execute a command (possibly searching PATH) when an infected message is
|
||||||
|
# found.
|
||||||
|
# The following parameters are passed to the invoked program in this order:
|
||||||
|
# virus name, queue id, sender, destination, subject, message id, message date.
|
||||||
|
# Note #1: this requires MTA macroes to be available (see LogInfected below)
|
||||||
|
# Note #2: the process is invoked in the context of clamav-milter
|
||||||
|
# Note #3: clamav-milter will wait for the process to exit. Be quick or fork to
|
||||||
|
# avoid unnecessary delays in email delivery
|
||||||
|
# Default: disabled
|
||||||
|
#VirusAction /usr/local/bin/my_infected_message_handler
|
||||||
|
|
||||||
|
##
|
||||||
|
## Logging options
|
||||||
|
##
|
||||||
|
|
||||||
|
# Uncomment this option to enable logging.
|
||||||
|
# LogFile must be writable for the user running daemon.
|
||||||
|
# A full path is required.
|
||||||
|
#
|
||||||
|
# Default: disabled
|
||||||
|
#LogFile /tmp/clamav-milter.log
|
||||||
|
|
||||||
|
# By default the log file is locked for writing - the lock protects against
|
||||||
|
# running clamav-milter multiple times.
|
||||||
|
# This option disables log file locking.
|
||||||
|
#
|
||||||
|
# Default: no
|
||||||
|
#LogFileUnlock yes
|
||||||
|
|
||||||
|
# Maximum size of the log file.
|
||||||
|
# Value of 0 disables the limit.
|
||||||
|
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
|
||||||
|
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
|
||||||
|
# in bytes just don't use modifiers. If LogFileMaxSize is enabled, log
|
||||||
|
# rotation (the LogRotate option) will always be enabled.
|
||||||
|
#
|
||||||
|
# Default: 1M
|
||||||
|
#LogFileMaxSize 2M
|
||||||
|
|
||||||
|
# Log time with each message.
|
||||||
|
#
|
||||||
|
# Default: no
|
||||||
|
#LogTime yes
|
||||||
|
|
||||||
|
# Use system logger (can work together with LogFile).
|
||||||
|
#
|
||||||
|
# Default: no
|
||||||
|
#LogSyslog yes
|
||||||
|
|
||||||
|
# Specify the type of syslog messages - please refer to 'man syslog'
|
||||||
|
# for facility names.
|
||||||
|
#
|
||||||
|
# Default: LOG_LOCAL6
|
||||||
|
#LogFacility LOG_MAIL
|
||||||
|
|
||||||
|
# Enable verbose logging.
|
||||||
|
#
|
||||||
|
# Default: no
|
||||||
|
#LogVerbose yes
|
||||||
|
|
||||||
|
# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
|
||||||
|
# Default: no
|
||||||
|
#LogRotate yes
|
||||||
|
|
||||||
|
# This option allows to tune what is logged when a message is infected.
|
||||||
|
# Possible values are Off (the default - nothing is logged),
|
||||||
|
# Basic (minimal info logged), Full (verbose info logged)
|
||||||
|
# Note:
|
||||||
|
# For this to work properly in sendmail, make sure the msg_id, mail_addr,
|
||||||
|
# rcpt_addr and i macroes are available in eom. In other words add a line like:
|
||||||
|
# Milter.macros.eom={msg_id}, {mail_addr}, {rcpt_addr}, i
|
||||||
|
# to your .cf file. Alternatively use the macro:
|
||||||
|
# define(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i')
|
||||||
|
# Postfix should be working fine with the default settings.
|
||||||
|
#
|
||||||
|
# Default: disabled
|
||||||
|
#LogInfected Basic
|
||||||
|
|
||||||
|
# This option allows to tune what is logged when no threat is found in
|
||||||
|
# a scanned message.
|
||||||
|
# See LogInfected for possible values and caveats.
|
||||||
|
# Useful in debugging but drastically increases the log size.
|
||||||
|
# Default: disabled
|
||||||
|
#LogClean Basic
|
||||||
|
|
||||||
|
# This option affects the behaviour of LogInfected, LogClean and VirusAction
|
||||||
|
# when a message with multiple recipients is scanned:
|
||||||
|
# If SupportMultipleRecipients is off (the default)
|
||||||
|
# then one single log entry is generated for the message and, in case the
|
||||||
|
# message is determined to be malicious, the command indicated by VirusAction
|
||||||
|
# is executed just once. In both cases only the last recipient is reported.
|
||||||
|
# If SupportMultipleRecipients is on:
|
||||||
|
# then one line is logged for each recipient and the command indicated
|
||||||
|
# by VirusAction is also executed once for each recipient.
|
||||||
|
#
|
||||||
|
# Note: although it's probably a good idea to enable this option, the default
|
||||||
|
# value
|
||||||
|
# is currently set to off for legacy reasons.
|
||||||
|
# Default: no
|
||||||
|
#SupportMultipleRecipients yes
|
||||||
|
|
@ -0,0 +1,250 @@
|
||||||
|
LogFile /var/log/clamav/clamd.log
|
||||||
|
LogFileUnlock no
|
||||||
|
LogFileMaxSize 2M
|
||||||
|
LogTime yes
|
||||||
|
LogClean no
|
||||||
|
LogSyslog no
|
||||||
|
LogFacility LOG_LOCAL6
|
||||||
|
LogVerbose no
|
||||||
|
LogRotate no
|
||||||
|
PreludeEnable no
|
||||||
|
PreludeAnalyzerName ClamAV
|
||||||
|
ExtendedDetectionInfo yes
|
||||||
|
TemporaryDirectory /tmp
|
||||||
|
DatabaseDirectory /var/lib/clamav
|
||||||
|
OfficialDatabaseOnly no
|
||||||
|
#FailIfCvdOlderThan 7
|
||||||
|
|
||||||
|
User clamav
|
||||||
|
# Default: disabled (must be specified by a user)
|
||||||
|
LocalSocket /var/run/clamav/clamd.sock
|
||||||
|
#LocalSocket /tmp/clamd.sock
|
||||||
|
# Default: disabled (the primary group of the user running clamd)
|
||||||
|
LocalSocketGroup clamav
|
||||||
|
# Default: disabled (socket is world accessible)
|
||||||
|
#LocalSocketMode 660
|
||||||
|
#FixStaleSocket yes
|
||||||
|
|
||||||
|
# Default: no
|
||||||
|
#TCPSocket 3310
|
||||||
|
# Default: no
|
||||||
|
#TCPAddr localhost
|
||||||
|
# Default: 200
|
||||||
|
#MaxConnectionQueueLength 30
|
||||||
|
# Default: 100M
|
||||||
|
#StreamMaxLength 25M
|
||||||
|
# Default: 1024
|
||||||
|
#StreamMinPort 30000
|
||||||
|
# Default: 2048
|
||||||
|
#StreamMaxPort 32000
|
||||||
|
# Default: 10
|
||||||
|
#MaxThreads 20
|
||||||
|
# Default: 120
|
||||||
|
#ReadTimeout 300
|
||||||
|
CommandReadTimeout 30
|
||||||
|
# Default: 500
|
||||||
|
#SendBufTimeout 200
|
||||||
|
|
||||||
|
# Maximum number of queued items (including those being processed by
|
||||||
|
# MaxThreads threads).
|
||||||
|
# It is recommended to have this value at least twice MaxThreads if possible.
|
||||||
|
# WARNING: you shouldn't increase this too much to avoid running out of file
|
||||||
|
# descriptors, the following condition should hold:
|
||||||
|
# MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual
|
||||||
|
# max is 1024).
|
||||||
|
#
|
||||||
|
# Default: 100
|
||||||
|
#MaxQueue 200
|
||||||
|
|
||||||
|
# Default: 30
|
||||||
|
#IdleTimeout 60
|
||||||
|
# Default: scan all
|
||||||
|
ExcludePath ^/proc/
|
||||||
|
ExcludePath ^/sys/
|
||||||
|
MaxDirectoryRecursion 20
|
||||||
|
# Default: no
|
||||||
|
#FollowDirectorySymlinks yes
|
||||||
|
# Default: no
|
||||||
|
#FollowFileSymlinks yes
|
||||||
|
CrossFilesystems yes
|
||||||
|
SelfCheck 600
|
||||||
|
# Default: yes
|
||||||
|
#ConcurrentDatabaseReload no
|
||||||
|
# Default: no
|
||||||
|
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v in %f"
|
||||||
|
#ExitOnOOM yes
|
||||||
|
# Default: no
|
||||||
|
#Foreground yes
|
||||||
|
# Default: no
|
||||||
|
#Debug yes
|
||||||
|
# Default: no
|
||||||
|
#LeaveTemporaryFiles yes
|
||||||
|
# Default: no
|
||||||
|
#GenerateMetadataJson yes
|
||||||
|
# Default: yes
|
||||||
|
#AllowAllMatchScan no
|
||||||
|
DetectPUA yes
|
||||||
|
# Default: Load all categories (if DetectPUA is activated)
|
||||||
|
ExcludePUA Tool
|
||||||
|
ForceToDisk no
|
||||||
|
# Default: no
|
||||||
|
#DisableCache yes
|
||||||
|
#CacheSize 65536
|
||||||
|
HeuristicAlerts yes
|
||||||
|
# Default: no
|
||||||
|
#HeuristicScanPrecedence yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Heuristic Alerts
|
||||||
|
##
|
||||||
|
# Default: no
|
||||||
|
#AlertBrokenExecutables yes
|
||||||
|
# Default: no
|
||||||
|
#AlertBrokenMedia yes
|
||||||
|
# Default: no
|
||||||
|
#AlertEncrypted yes
|
||||||
|
# Default: no
|
||||||
|
#AlertEncryptedArchive yes
|
||||||
|
# Default: no
|
||||||
|
#AlertEncryptedDoc yes
|
||||||
|
# Default: no
|
||||||
|
AlertOLE2Macros yes
|
||||||
|
# Default: no
|
||||||
|
#AlertPhishingSSLMismatch yes
|
||||||
|
# Default: no
|
||||||
|
#AlertPhishingCloak yes
|
||||||
|
# Default: no
|
||||||
|
#AlertPartitionIntersection yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Executable files
|
||||||
|
##
|
||||||
|
# Default: yes
|
||||||
|
ScanPE yes
|
||||||
|
# Default: no
|
||||||
|
#DisableCertCheck yes
|
||||||
|
# Default: yes
|
||||||
|
ScanELF yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Documents
|
||||||
|
##
|
||||||
|
ScanOLE2 yes
|
||||||
|
ScanPDF yes
|
||||||
|
ScanSWF yes
|
||||||
|
ScanXMLDOCS yes
|
||||||
|
ScanHWP3 yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Mail files
|
||||||
|
##
|
||||||
|
ScanMail yes
|
||||||
|
# Default: no
|
||||||
|
#ScanPartialMessages yes
|
||||||
|
PhishingSignatures yes
|
||||||
|
PhishingScanURLs yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Data Loss Prevention (DLP)
|
||||||
|
##
|
||||||
|
# Default: No
|
||||||
|
#StructuredDataDetection yes
|
||||||
|
# Default: 3
|
||||||
|
StructuredMinCreditCardCount 5
|
||||||
|
# Default: no
|
||||||
|
#StructuredCCOnly yes
|
||||||
|
# Default: 3
|
||||||
|
StructuredMinSSNCount 5
|
||||||
|
StructuredSSNFormatNormal yes
|
||||||
|
StructuredSSNFormatStripped yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## HTML
|
||||||
|
##
|
||||||
|
ScanHTML yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Archives
|
||||||
|
##
|
||||||
|
ScanArchive yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## Limits
|
||||||
|
##
|
||||||
|
# Default: 120000
|
||||||
|
#MaxScanTime 300000
|
||||||
|
# Default: 400M
|
||||||
|
MaxScanSize 500M
|
||||||
|
# Default: 100M
|
||||||
|
MaxFileSize 400M
|
||||||
|
# Default: 17
|
||||||
|
#MaxRecursion 10
|
||||||
|
# Default: 10000
|
||||||
|
#MaxFiles 15000
|
||||||
|
# Default: 40M
|
||||||
|
MaxEmbeddedPE 80M
|
||||||
|
# Default: 40M
|
||||||
|
#MaxHTMLNormalize 100M
|
||||||
|
# Default: 8M
|
||||||
|
#MaxHTMLNoTags 16M
|
||||||
|
# Default: 20M
|
||||||
|
#MaxScriptNormalize 50M
|
||||||
|
# Default: 1M
|
||||||
|
#MaxZipTypeRcg 1M
|
||||||
|
# Default: 50
|
||||||
|
#MaxPartitions 128
|
||||||
|
# Default: 100
|
||||||
|
#MaxIconsPE 200
|
||||||
|
# Default: 16
|
||||||
|
#MaxRecHWP3 16
|
||||||
|
# Default: 100000
|
||||||
|
#PCREMatchLimit 20000
|
||||||
|
# Default: 2000
|
||||||
|
#PCRERecMatchLimit 10000
|
||||||
|
# Default: 100M
|
||||||
|
#PCREMaxFileSize 400M
|
||||||
|
# Default: no
|
||||||
|
AlertExceedsMax yes
|
||||||
|
|
||||||
|
##
|
||||||
|
## On-access Scan Settings
|
||||||
|
##
|
||||||
|
# Default: 5M
|
||||||
|
#OnAccessMaxFileSize 10M
|
||||||
|
# Default: 5
|
||||||
|
#OnAccessMaxThreads 10
|
||||||
|
# Default: 5000 (5 seconds)
|
||||||
|
# OnAccessCurlTimeout 10000
|
||||||
|
# Default: no
|
||||||
|
#OnAccessDisableDDD yes
|
||||||
|
# Default: disabled
|
||||||
|
#OnAccessIncludePath /home
|
||||||
|
#OnAccessIncludePath /students
|
||||||
|
# Default: disabled
|
||||||
|
#OnAccessExcludePath /home/user
|
||||||
|
# Default: no
|
||||||
|
OnAccessPrevention yes
|
||||||
|
# Default: no
|
||||||
|
#OnAccessDenyOnError yes
|
||||||
|
# Default: no
|
||||||
|
#OnAccessExtraScanning yes
|
||||||
|
# Default: disabled
|
||||||
|
#OnAccessMountPath /
|
||||||
|
#OnAccessMountPath /home/user
|
||||||
|
# Default: no
|
||||||
|
#OnAccessExcludeRootUID no
|
||||||
|
# Default: disabled
|
||||||
|
#OnAccessExcludeUID -1
|
||||||
|
# Default: disabled
|
||||||
|
OnAccessExcludeUname clamav
|
||||||
|
# Default: 0
|
||||||
|
#OnAccessRetryAttempts 3
|
||||||
|
|
||||||
|
##
|
||||||
|
## Bytecode
|
||||||
|
##
|
||||||
|
Bytecode yes
|
||||||
|
BytecodeSecurity TrustSigned
|
||||||
|
BytecodeUnsigned no
|
||||||
|
# Default: 10000
|
||||||
|
# BytecodeTimeout 1000
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
DatabaseOwner clamav
|
||||||
|
UpdateLogFile /var/log/clamav/freshclam.log
|
||||||
|
LogVerbose false
|
||||||
|
LogSyslog false
|
||||||
|
LogFacility LOG_LOCAL6
|
||||||
|
LogFileMaxSize 0
|
||||||
|
LogRotate true
|
||||||
|
LogTime true
|
||||||
|
Foreground false
|
||||||
|
Debug false
|
||||||
|
MaxAttempts 5
|
||||||
|
DatabaseDirectory /var/lib/clamav
|
||||||
|
DNSDatabaseInfo current.cvd.clamav.net
|
||||||
|
ConnectTimeout 30
|
||||||
|
ReceiveTimeout 0
|
||||||
|
TestDatabases yes
|
||||||
|
ScriptedUpdates yes
|
||||||
|
CompressLocalDatabase no
|
||||||
|
Bytecode true
|
||||||
|
NotifyClamd /etc/clamav/clamd.conf
|
||||||
|
Checks 24
|
||||||
|
DatabaseMirror db.local.clamav.net
|
||||||
|
DatabaseMirror database.clamav.net
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
|
||||||
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
|
||||||
|
MACs hmac-sha2-512-etm@openssh.com
|
||||||
|
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
AcceptEnv LANG LC_*
|
||||||
|
AddressFamily inet
|
||||||
|
AllowAgentForwarding no
|
||||||
|
ChallengeResponseAuthentication no
|
||||||
|
ClientAliveCountMax 2
|
||||||
|
ClientAliveInterval 300
|
||||||
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||||
|
IgnoreRhosts yes
|
||||||
|
LogLevel VERBOSE
|
||||||
|
MaxAuthTries 3
|
||||||
|
MaxSessions 3
|
||||||
|
PermitEmptyPasswords no
|
||||||
|
PermitRootLogin no
|
||||||
|
PrintMotd yes
|
||||||
|
Protocol 2
|
||||||
|
PubkeyAuthentication yes
|
||||||
|
Port 22
|
||||||
|
TCPKeepAlive no
|
||||||
|
UseDNS no
|
||||||
|
UsePAM yes
|
||||||
|
X11Forwarding no
|
||||||
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||||
|
|
||||||
|
Include /etc/ssh/sshd_config.d/*.conf
|
||||||
|
|
@ -0,0 +1,76 @@
|
||||||
|
# No end-of-line comments;
|
||||||
|
# No quotes around path names;
|
||||||
|
# To unset previous configuration, set it to "" (empty) beforehand;
|
||||||
|
# Some options allow multiple definitions, leads to a concatenation;
|
||||||
|
|
||||||
|
ROTATE_MIRRORS=1
|
||||||
|
UPDATE_MIRRORS=1
|
||||||
|
MIRRORS_MODE=0
|
||||||
|
MAIL-ON-WARNING=naeikindus@pounce.tech
|
||||||
|
MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
|
||||||
|
TMPDIR=/var/lib/rkhunter/tmp
|
||||||
|
DBDIR=/var/lib/rkhunter/db
|
||||||
|
SCRIPTDIR=/usr/share/rkhunter/scripts
|
||||||
|
BINDIR=/bin /usr/bin /sbin /usr/sbin
|
||||||
|
BINDIR=+/usr/local/bin +/usr/local/sbin
|
||||||
|
UPDATE_LANG="en"
|
||||||
|
LOGFILE=/var/log/rkhunter.log
|
||||||
|
APPEND_LOG=0
|
||||||
|
COPY_LOG_ON_ERROR=0
|
||||||
|
USE_SYSLOG=authpriv.warning
|
||||||
|
AUTO_X_DETECT=0
|
||||||
|
ALLOW_SSH_ROOT_USER=no
|
||||||
|
ALLOW_SSH_PROT_V1=0
|
||||||
|
|
||||||
|
ENABLE_TESTS=ALL
|
||||||
|
DISABLE_TESTS=NONE
|
||||||
|
HASH_CMD=SHA256
|
||||||
|
PKGMGR=NONE
|
||||||
|
|
||||||
|
USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf
|
||||||
|
USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf.local
|
||||||
|
|
||||||
|
EXISTWHITELIST=""
|
||||||
|
ATTRWHITELIST=""
|
||||||
|
WRITEWHITELIST=""
|
||||||
|
|
||||||
|
SCRIPTWHITELIST=/usr/bin/egrep
|
||||||
|
SCRIPTWHITELIST=/usr/bin/lwp-request
|
||||||
|
SCRIPTWHITELIST=/usr/bin/fgrep
|
||||||
|
SCRIPTWHITELIST=/usr/bin/which
|
||||||
|
SCRIPTWHITELIST=/usr/bin/ldd
|
||||||
|
SCRIPTWHITELIST=/usr/bin/which.debianutils
|
||||||
|
SCRIPTWHITELIST=/usr/sbin/adduser
|
||||||
|
|
||||||
|
IMMUTABLE_SET=0
|
||||||
|
SKIP_INODE_CHECK=0
|
||||||
|
ALLOWPROMISCIF=""
|
||||||
|
|
||||||
|
SCAN_MODE_DEV=THOROUGH
|
||||||
|
ALLOWDEVFILE=""
|
||||||
|
ALLOW_SYSLOG_REMOTE_LOGGING=0
|
||||||
|
|
||||||
|
### Needs update to add user-controller dirs like upload and user generated content dirs from webserver
|
||||||
|
SUSPSCAN_DIRS=/tmp /var/tmp
|
||||||
|
SUSPSCAN_TEMP=/dev/shm
|
||||||
|
SUSPSCAN_MAXSIZE=1024000
|
||||||
|
SUSPSCAN_THRESH=200
|
||||||
|
SUSPSCAN_WHITELIST=""
|
||||||
|
|
||||||
|
# Examples:
|
||||||
|
#
|
||||||
|
# PORT_WHITELIST=TCP:2001 UDP:32011
|
||||||
|
# PORT_PATH_WHITELIST=/usr/sbin/squid
|
||||||
|
# PORT_PATH_WHITELIST=/usr/sbin/squid:TCP:3801
|
||||||
|
PORT_WHITELIST=""
|
||||||
|
PORT_PATH_WHITELIST=""
|
||||||
|
|
||||||
|
WARN_ON_OS_CHANGE=1
|
||||||
|
|
||||||
|
USE_LOCKING=1
|
||||||
|
LOCK_TIMEOUT=300
|
||||||
|
SCANROOTKITMODE=""
|
||||||
|
|
||||||
|
SHOW_SUMMARY_WARNINGS_NUMBER=1
|
||||||
|
GLOBSTAR=0
|
||||||
|
INSTALLDIR=/usr
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
* soft core 0
|
||||||
|
* hard core 0
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
# Based on Debian 12 manual
|
||||||
|
CHFN_RESTRICT rwh
|
||||||
|
DEFAULT_HOME yes
|
||||||
|
ENCRYPT_METHOD YESCRYPT
|
||||||
|
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
|
||||||
|
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||||
|
ERASECHAR 0177
|
||||||
|
FAILLOG_ENAB yes
|
||||||
|
FTMP_FILE /var/log/btmp
|
||||||
|
GID_MAX 60000
|
||||||
|
GID_MIN 1000
|
||||||
|
HOME_MODE 0700
|
||||||
|
HUSHLOGIN_FILE .hushlogin
|
||||||
|
KILLCHAR 025
|
||||||
|
LOGIN_RETRIES 3
|
||||||
|
LOGIN_TIMEOUT 60
|
||||||
|
LOG_OK_LOGINS yes
|
||||||
|
LOG_UNKFAIL_ENAB no
|
||||||
|
MAIL_DIR /var/mail
|
||||||
|
NONEXISTENT /nonexistent
|
||||||
|
PASS_MAX_DAYS 99999
|
||||||
|
PASS_MIN_DAYS 0
|
||||||
|
PASS_WARN_AGE 7
|
||||||
|
PREVENT_NO_AUTH yes
|
||||||
|
SUB_GID_COUNT 65536
|
||||||
|
SUB_GID_MAX 600100000
|
||||||
|
SUB_GID_MIN 100000
|
||||||
|
SUB_UID_COUNT 65536
|
||||||
|
SUB_UID_MAX 600100000
|
||||||
|
SUB_UID_MIN 100000
|
||||||
|
SU_NAME su
|
||||||
|
SYSLOG_SG_ENAB yes
|
||||||
|
SYSLOG_SU_ENAB yes
|
||||||
|
TTYGROUP tty
|
||||||
|
TTYPERM 0600
|
||||||
|
UID_MAX 60000
|
||||||
|
UID_MIN 1000
|
||||||
|
UMASK 027
|
||||||
|
USERGROUPS_ENAB yes
|
||||||
|
YESCRYPT_COST_FACTOR 10
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
localhost
|
||||||
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
# defaults file for tooling
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
author: Florian L.
|
||||||
|
namespace: nullified
|
||||||
|
description: Install server related configuration and tooling
|
||||||
|
# issue_tracker_url: http://example.com/issue/tracker
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: 2.15
|
||||||
|
|
||||||
|
# https://galaxy.ansible.com/api/v1/platforms/
|
||||||
|
platforms:
|
||||||
|
- name: Debian
|
||||||
|
versions:
|
||||||
|
- bookworm
|
||||||
|
|
||||||
|
galaxy_tags:
|
||||||
|
- github
|
||||||
|
- assets
|
||||||
|
- utils
|
||||||
|
- system
|
||||||
|
|
||||||
|
dependencies: []
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
# TODO: Add monitoring roles
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
localhost
|
||||||
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
custom_base_user_account: "root"
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
---
|
||||||
|
# handlers file for development
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
author: Florian L.
|
||||||
|
namespace: nullified
|
||||||
|
description: Install workstation environment
|
||||||
|
# issue_tracker_url: http://example.com/issue/tracker
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: 2.15
|
||||||
|
|
||||||
|
# https://galaxy.ansible.com/api/v1/platforms/
|
||||||
|
platforms:
|
||||||
|
- name: Debian
|
||||||
|
versions:
|
||||||
|
- bookworm
|
||||||
|
|
||||||
|
galaxy_tags:
|
||||||
|
- github
|
||||||
|
- assets
|
||||||
|
- utils
|
||||||
|
- system
|
||||||
|
|
||||||
|
dependencies: []
|
||||||
|
|
@ -0,0 +1,25 @@
|
||||||
|
---
|
||||||
|
- name: '[APT] install dependencies and tools'
|
||||||
|
become: yes
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
force_apt_get: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
pkg:
|
||||||
|
- curl
|
||||||
|
- flatpak
|
||||||
|
- gnupg
|
||||||
|
- pwgen
|
||||||
|
- sudo
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: '[Setup] setup Flatpak'
|
||||||
|
become: yes
|
||||||
|
become_user: "{{ custom_base_user_account }}"
|
||||||
|
become_method: su
|
||||||
|
tags:
|
||||||
|
- molecule-idempotence-notest
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
|
||||||
|
flatpak install --noninteractive flathub com.discordapp.Discord
|
||||||
|
flatpak install --noninteractive flathub md.obsidian.Obsidian
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
localhost
|
||||||
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
---
|
||||||
|
modules:
|
||||||
|
python_requires: '>= 3.9'
|
||||||
20
images/Dockerfile-debian-bookworm
Normal file
20
images/Dockerfile-debian-bookworm
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
FROM debian:bookworm
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update && \
|
||||||
|
apt-get upgrade -y; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
python3 \
|
||||||
|
python3-dev \
|
||||||
|
sudo \
|
||||||
|
systemd \
|
||||||
|
systemd-sysv \
|
||||||
|
; \
|
||||||
|
rm -rf /var/lib/apt/lists/* \
|
||||||
|
;
|
||||||
|
|
||||||
|
STOPSIGNAL SIGRTMIN+3
|
||||||
|
VOLUME ["/run", "/run/lock", "/tmp"]
|
||||||
|
CMD ["/sbin/init"]
|
||||||
0
inventory/group_vars/.gitkeep
Normal file
0
inventory/group_vars/.gitkeep
Normal file
2
inventory/group_vars/all.yml
Normal file
2
inventory/group_vars/all.yml
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
custom_base_user_account: '{{ vault_custom_base_user_account }}'
|
||||||
|
custom_github_token: '{{ vault_custom_github_token }}'
|
||||||
0
inventory/host_vars/.gitkeep
Normal file
0
inventory/host_vars/.gitkeep
Normal file
2
inventory/inventory.yml.dist
Normal file
2
inventory/inventory.yml.dist
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
all:
|
||||||
|
hosts:
|
||||||
2
inventory/vault.yml.dist
Normal file
2
inventory/vault.yml.dist
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
vault_custom_base_user_account:
|
||||||
|
vault_custom_github_token:
|
||||||
9
playbooks/external.yml
Normal file
9
playbooks/external.yml
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
---
|
||||||
|
- name: setup external infrastructure
|
||||||
|
hosts: external
|
||||||
|
gather_facts: false
|
||||||
|
vars_files: ../inventory/vault.yml
|
||||||
|
tasks:
|
||||||
|
- include_vars: ../inventory/vault.yml
|
||||||
|
|
||||||
|
- ansible.builtin.import_playbook: nullified.infrastructure.server
|
||||||
1
playbooks/internal.yml
Normal file
1
playbooks/internal.yml
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
---
|
||||||
14
requirements.txt
Normal file
14
requirements.txt
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
ansible==8.3.0
|
||||||
|
ansible-compat==4.1.6
|
||||||
|
ansible-core==2.15.3
|
||||||
|
ansible-lint==6.17.2
|
||||||
|
docker==6.1.3
|
||||||
|
Jinja2==3.1.2
|
||||||
|
jsonschema==4.19.0
|
||||||
|
molecule==6.0.1
|
||||||
|
molecule-plugins==23.5.0
|
||||||
|
paramiko==3.3.1
|
||||||
|
pycurl==7.45.2
|
||||||
|
Pygments==2.16.1
|
||||||
|
pylint==2.17.5
|
||||||
|
yamllint==1.32.0
|
||||||
117
scripts/generate_ansible_config.sh
Executable file
117
scripts/generate_ansible_config.sh
Executable file
|
|
@ -0,0 +1,117 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -o pipefail -o noclobber
|
||||||
|
|
||||||
|
function usage() {
|
||||||
|
cat <<EOF
|
||||||
|
DESCRIPTION
|
||||||
|
This command generates an ansible configuration file to use with this repository; it is tailored for the user calling ansible commands,
|
||||||
|
not to be used as a boilerplate for Molecule and \`ansible-test\` environments.
|
||||||
|
|
||||||
|
USAGE
|
||||||
|
\$> ./$(basename "$0") [option [option...]] [file_path]
|
||||||
|
|
||||||
|
ARGUMENTS
|
||||||
|
file_path file path where the file will be saved; defaults to '\$HOME/.ansible.cfg';
|
||||||
|
if neither this argument nor the environment variable \$ANSIBLE_CFG_PATH is provided, the
|
||||||
|
content will be printed on stdout.
|
||||||
|
|
||||||
|
OPTIONS
|
||||||
|
-h, --help show this output
|
||||||
|
-o, --overwrite allow overwriting of a pre-existing file
|
||||||
|
|
||||||
|
ENVIRONMENT
|
||||||
|
The following environment variables are supported for overrides:
|
||||||
|
ANSIBLE_CFG_PATH: path where the ansible config file should be stored (current: "${ANSIBLE_CFG_PATH:-stdout}" or argument)
|
||||||
|
TMPL_PROJECT_ROOT: path where this project is located; defaults to where '../' leads (current: "$TMPL_PROJECT_ROOT")
|
||||||
|
TMPL_INVENTORY_FILE: path where the main inventory file is located (current: "$TMPL_INVENTORY_FILE")
|
||||||
|
TMPL_CONNECTION_TIMEOUT: default connection timeout when connecting to hosts (current: $TMPL_CONNECTION_TIMEOUT)
|
||||||
|
TMPL_PLAYBOOK_DIR: path where the playbooks are located (current: "$TMPL_PLAYBOOK_DIR")
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
ANSIBLE_CFG_PATH=${ANSIBLE_CFG_PATH:=}
|
||||||
|
OVERWRITE_CFG=0
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
|
||||||
|
# Template variables
|
||||||
|
TMPL_PROJECT_ROOT=$(realpath "${TMPL_PROJECT_ROOT:-"${SCRIPT_DIR}/.."}")
|
||||||
|
TMPL_INVENTORY_FILE=$(realpath "${TMPL_INVENTORY_FILE:-"${TMPL_PROJECT_ROOT}/inventory/inventory.yml"}")
|
||||||
|
TMPL_CONNECTION_TIMEOUT=${TMPL_CONNECTION_TIMEOUT:-30}
|
||||||
|
TMPL_PLAYBOOK_DIR=$(realpath "${TMPL_PLAYBOOK_DIR:-"${TMPL_PROJECT_ROOT}/playbooks"}")
|
||||||
|
|
||||||
|
OPTS=ho
|
||||||
|
LONGOPTS=help,overwrite
|
||||||
|
! getopt --test > /dev/null
|
||||||
|
if [[ ${PIPESTATUS[0]} -ne 4 ]]; then
|
||||||
|
echo -e "Getopt is not available, please install linux-utils or a similar package and ensure your bash is up-to-date."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
! PARSED=$(getopt --options=${OPTS} --longoptions=${LONGOPTS} --name "$0" -- "$@")
|
||||||
|
if [[ ${PIPESTATUS[0]} -ne 0 ]]; then
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
eval set -- "${PARSED}"
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
case "$1" in
|
||||||
|
-h|--help)
|
||||||
|
usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
-o|--overwrite)
|
||||||
|
OVERWRITE_CFG=1
|
||||||
|
shift
|
||||||
|
;;
|
||||||
|
--)
|
||||||
|
shift
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unsupported option: ${1}"
|
||||||
|
exit 2
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ -n "${1}" ]; then
|
||||||
|
ANSIBLE_CFG_PATH=$1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -e "${ANSIBLE_CFG_PATH}" ] && [ $OVERWRITE_CFG -eq 0 ]; then
|
||||||
|
printf "Configuration file already exists, not overwriting (file: '%s')\n" "${ANSIBLE_CFG_PATH}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
CFG_TEMPLATE=$(cat <<EOF
|
||||||
|
[defaults]
|
||||||
|
cow_selection = random
|
||||||
|
error_on_undefined_vars = True
|
||||||
|
home = ${TMPL_PROJECT_ROOT}
|
||||||
|
inventory = ${TMPL_INVENTORY_FILE}
|
||||||
|
local_tmp = /tmp
|
||||||
|
nocolor = 0
|
||||||
|
nocows = 0
|
||||||
|
playbook_dir = ${TMPL_PLAYBOOK_DIR}
|
||||||
|
remote_tmp = /tmp
|
||||||
|
|
||||||
|
[inventory]
|
||||||
|
enable_plugins = yaml
|
||||||
|
|
||||||
|
[privilege_escalation]
|
||||||
|
become_method = su
|
||||||
|
become_flags = "-l"
|
||||||
|
|
||||||
|
[persistent_connection]
|
||||||
|
connect_timeout = ${TMPL_CONNECTION_TIMEOUT}
|
||||||
|
|
||||||
|
[galaxy]
|
||||||
|
display_progress = True
|
||||||
|
EOF
|
||||||
|
)
|
||||||
|
|
||||||
|
if [ -z "${ANSIBLE_CFG_PATH}" ]; then
|
||||||
|
echo -e "$CFG_TEMPLATE"
|
||||||
|
else
|
||||||
|
echo -e "$CFG_TEMPLATE" > "${ANSIBLE_CFG_PATH}"
|
||||||
|
fi
|
||||||
9
scripts/python_wrapper.sh
Executable file
9
scripts/python_wrapper.sh
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
|
||||||
|
test -d "$SCRIPT_DIR"/../venv || (printf "Python virtualenv not found (%s)\n" "$SCRIPT_DIR"/../venv && exit 1)
|
||||||
|
source "$SCRIPT_DIR"/../venv/bin/activate
|
||||||
|
|
||||||
|
exec $@
|
||||||
Loading…
Add table
Reference in a new issue