From 546dabd7aa96fc4986b0f45fa6d6381cb14264e1 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 31 May 2018 18:20:51 +0300 Subject: [PATCH 001/504] Add 'installbox' configuration. --- installbox.yml | 24 ++++++ roles/dhcp-dns-dnsmasq/handlers/main.yml | 3 + roles/dhcp-dns-dnsmasq/tasks/main.yml | 10 +++ .../templates/dnsmasq-transparent-proxy.j2 | 2 + roles/preseed-installer/tasks/main.yml | 27 ++++++ roles/preseed-installer/templates/preseed.cfg | 37 ++++++++ .../tftp-netboot-installer/handlers/main.yml | 3 + roles/tftp-netboot-installer/tasks/main.yml | 28 ++++++ .../dnsmasq-tftp-netboot-installer.j2 | 5 ++ .../files/store_id_regex.conf | 2 + roles/transparent-squid/handlers/main.yml | 3 + roles/transparent-squid/tasks/main.yml | 62 +++++++++++++ .../two-interface-shorewall/handlers/main.yml | 7 ++ roles/two-interface-shorewall/tasks/main.yml | 86 +++++++++++++++++++ .../templates/interfaces-static.j2 | 5 ++ roles/up2date-debian/tasks/main.yml | 19 ++++ 16 files changed, 323 insertions(+) create mode 100644 installbox.yml create mode 100644 roles/dhcp-dns-dnsmasq/handlers/main.yml create mode 100644 roles/dhcp-dns-dnsmasq/tasks/main.yml create mode 100644 roles/dhcp-dns-dnsmasq/templates/dnsmasq-transparent-proxy.j2 create mode 100644 roles/preseed-installer/tasks/main.yml create mode 100644 roles/preseed-installer/templates/preseed.cfg create mode 100644 roles/tftp-netboot-installer/handlers/main.yml create mode 100644 roles/tftp-netboot-installer/tasks/main.yml create mode 100644 roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 create mode 100644 roles/transparent-squid/files/store_id_regex.conf create mode 100644 roles/transparent-squid/handlers/main.yml create mode 100644 roles/transparent-squid/tasks/main.yml create mode 100644 roles/two-interface-shorewall/handlers/main.yml create mode 100644 roles/two-interface-shorewall/tasks/main.yml create mode 100644 roles/two-interface-shorewall/templates/interfaces-static.j2 create mode 100644 roles/up2date-debian/tasks/main.yml diff --git a/installbox.yml b/installbox.yml new file mode 100644 index 0000000..7f4e9cc --- /dev/null +++ b/installbox.yml @@ -0,0 +1,24 @@ +--- +# This playbook deploys the installbox on a minimal installation. + +- name: apply configuration to the installbox + hosts: installboxes + remote_user: ansible + become: yes + vars: + hostname: installbox + di_dist: "stretch" + if_lan: "ens8" + if_wan: "{{ ansible_default_ipv4.interface }}" + ipaddr_lan: 192.168.0.10 + dhcp_range: 192.168.0.50,192.168.0.150,2h + tftp_root: "/var/lib/tftpboot" + deb_mirror: "ftp-stud.hs-esslingen.de" + + roles: + - up2date-debian + - two-interface-shorewall + - dhcp-dns-dnsmasq + - transparent-squid + - tftp-netboot-installer + - preseed-installer diff --git a/roles/dhcp-dns-dnsmasq/handlers/main.yml b/roles/dhcp-dns-dnsmasq/handlers/main.yml new file mode 100644 index 0000000..f549f18 --- /dev/null +++ b/roles/dhcp-dns-dnsmasq/handlers/main.yml @@ -0,0 +1,3 @@ +- name: restart dnsmasq + service: name=dnsmasq state=restarted enabled=yes + listen: "restart dnsmasq" diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dhcp-dns-dnsmasq/tasks/main.yml new file mode 100644 index 0000000..840a4d7 --- /dev/null +++ b/roles/dhcp-dns-dnsmasq/tasks/main.yml @@ -0,0 +1,10 @@ +- name: install dns-firewall packages + apt: + name: dnsmasq + state: latest + +- name: configure dnsmasq + template: + src: dnsmasq-transparent-proxy.j2 + dest: /etc/dnsmasq.d/transparent-proxy + notify: "restart dnsmasq" diff --git a/roles/dhcp-dns-dnsmasq/templates/dnsmasq-transparent-proxy.j2 b/roles/dhcp-dns-dnsmasq/templates/dnsmasq-transparent-proxy.j2 new file mode 100644 index 0000000..a6ca62b --- /dev/null +++ b/roles/dhcp-dns-dnsmasq/templates/dnsmasq-transparent-proxy.j2 @@ -0,0 +1,2 @@ +interface={{ if_lan }} +dhcp-range={{ dhcp_range }} diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml new file mode 100644 index 0000000..326b857 --- /dev/null +++ b/roles/preseed-installer/tasks/main.yml @@ -0,0 +1,27 @@ +- name: make preseed directory available + file: + path: "{{ tftp_root }}/d-i/{{ di_dist }}" + state: directory + +- name: provide preseed file + template: + src: preseed.cfg + dest: "{{ tftp_root }}/d-i/{{ di_dist }}" + +- name: make installbox resolvable in /etc/hosts from LAN + replace: + dest: /etc/hosts + regexp: '(127.0.1.1\s+)installbox' + replace: '\1localhost\n{{ ipaddr_lan }} installbox' + +- name: add auto boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/pxelinux.HEAD + insertbefore: EOF + block: | + LABEL quick + MENU LABEL Debian Installer ({{ di_dist }} ; amd64 + Preseed) + kernel ::/di-netboot-pkg/images/9/amd64/text/debian-installer/amd64/linux + append initrd=::/di-netboot-pkg/images/9/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://installbox + TIMEOUT 100 + notify: "rebuild di-netboot-assistant menu" diff --git a/roles/preseed-installer/templates/preseed.cfg b/roles/preseed-installer/templates/preseed.cfg new file mode 100644 index 0000000..e544344 --- /dev/null +++ b/roles/preseed-installer/templates/preseed.cfg @@ -0,0 +1,37 @@ +#### Preconfiguration file +## For more examples and comments: +## https://www.debian.org/releases/stable/example-preseed.txt + +## To change default values: +#d-i foo/bar string value +#d-i foo/bar seen false + +## Use this as boot parameter: +## DEBCONF_DEBUG=5 +## Boot parameter locale?=de_DE + +# Preseeding only locale sets language, country and locale: +d-i debian-installer/locale string de_DE +d-i keyboard-configuration/xkb-keymap select de + +## Skip root account: +d-i passwd/root-login boolean false + +### Apt setup +d-i apt-setup/non-free boolean true +d-i apt-setup/contrib boolean true +d-i mirror/http/mirror string {{ deb_mirror }} + +### Ansible User +d-i passwd/user-fullname string Ansible User +d-i passwd/username string ansible +d-i passwd/user-password password insecure +d-i passwd/user-password-again password insecure +#d-i passwd/user-password-crypted password [crypt(3) hash] + +### Package selection +tasksel tasksel/desktop multiselect standard openssh-server +tasksel tasksel/desktop seen false + +# Individual additional packages to install +d-i pkgsel/include string firmware-linux diff --git a/roles/tftp-netboot-installer/handlers/main.yml b/roles/tftp-netboot-installer/handlers/main.yml new file mode 100644 index 0000000..9aee0b2 --- /dev/null +++ b/roles/tftp-netboot-installer/handlers/main.yml @@ -0,0 +1,3 @@ +- name: rebuild di-netboot-assistant menu + command: di-netboot-assistant rebuild-menu + listen: rebuild di-netboot-assistant menu diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/tftp-netboot-installer/tasks/main.yml new file mode 100644 index 0000000..cb71006 --- /dev/null +++ b/roles/tftp-netboot-installer/tasks/main.yml @@ -0,0 +1,28 @@ +- name: install tftp-netboot-installer packages + apt: + name: + - di-netboot-assistant + - debian-installer-9-netboot-amd64 + +- name: bind mount images + mount: + name: "{{ tftp_root }}/di-netboot-pkg/" + src: /usr/lib/debian-installer/ + fstype: none + opts: bind +# state: mounted BEGINN WORKAROUND + state: present + register: fstab + +- name: Reload fstab + command: mount -a + when: fstab.changed +# https://github.com/ansible/ansible/issues/23487 END WORKAROUND + +- name: configure dnsmasq + template: + src: dnsmasq-tftp-netboot-installer.j2 + dest: /etc/dnsmasq.d/tftp-netboot-installer + notify: + - restart dnsmasq + - rebuild di-netboot-assistant menu diff --git a/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 b/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 new file mode 100644 index 0000000..3e627d8 --- /dev/null +++ b/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 @@ -0,0 +1,5 @@ +enable-tftp +tftp-root={{ tftp_root }} +dhcp-boot=debian-installer/pxelinux.0 +dhcp-match=set:efi-x86_64,option:client-arch,7 +dhcp-boot=tag:efi-x86_64,debian-installer/bootnetx64.efi diff --git a/roles/transparent-squid/files/store_id_regex.conf b/roles/transparent-squid/files/store_id_regex.conf new file mode 100644 index 0000000..3d88f21 --- /dev/null +++ b/roles/transparent-squid/files/store_id_regex.conf @@ -0,0 +1,2 @@ +^http:\/\/.+\/(.+\.deb) http://debian.mirrors.squid.internal/Archive-http/$1 +^http:\/\/.+\/(.+\.udeb) http://debian.mirrors.squid.internal/Archive-http/$1 diff --git a/roles/transparent-squid/handlers/main.yml b/roles/transparent-squid/handlers/main.yml new file mode 100644 index 0000000..c103a79 --- /dev/null +++ b/roles/transparent-squid/handlers/main.yml @@ -0,0 +1,3 @@ +- name: restart squid + service: name=squid state=restarted enabled=yes + listen: "restart squid" diff --git a/roles/transparent-squid/tasks/main.yml b/roles/transparent-squid/tasks/main.yml new file mode 100644 index 0000000..581acc9 --- /dev/null +++ b/roles/transparent-squid/tasks/main.yml @@ -0,0 +1,62 @@ +- name: install squid package + apt: + name: squid + state: latest + +- name: configure squid extra lines + lineinfile: + dest: /etc/squid/squid.conf + line: "{{ item.line }}" + insertafter: "{{ item.insertafter }}" + with_items: + - { line: "acl localnet src 192.168.0.0/16", insertafter: "#acl localnet src 192.168.0.0/16" } + - { line: "http_access allow localnet", insertafter: "#http_access allow localnet" } + - { line: "http_port 3129 intercept", insertafter: "http_port 3128" } + - { line: "maximum_object_size_in_memory 10240 KB", insertafter: "# maximum_object_size_in_memory" } + - { line: "maximum_object_size 512 MB", insertafter: "# maximum_object_size" } + - { line: "cache_dir aufs /var/spool/squid 20000 16 256", insertafter: "#cache_dir ufs /var/spool/squid" } + notify: "restart squid" + +- name: configure squid store IDs + blockinfile: + dest: /etc/squid/squid.conf + insertbefore: "TAG: store_miss" + block: | + store_id_program /usr/lib/squid/storeid_file_rewrite /etc/squid/store_id_regex.conf + store_id_bypass off + acl Ordinary http_status 200-299 + send_hit deny !Ordinary + store_miss deny !Ordinary + marker: "# {mark} ANSIBLE MANAGED BLOCK store_id" + notify: "restart squid" + +- name: provide store_id_regex.conf + copy: + src: store_id_regex.conf + dest: /etc/squid/store_id_regex.conf + notify: "restart squid" + +- name: configure squid as package cache + blockinfile: + dest: /etc/squid/squid.conf + insertbefore: "# Add any of your own refresh_pattern entries above these." + block: | + # refresh pattern for debs and udebs + refresh_pattern deb$ 129600 100% 129600 + refresh_pattern udeb$ 129600 100% 129600 + refresh_pattern tar.gz$ 129600 100% 129600 + refresh_pattern tar.xz$ 129600 100% 129600 + refresh_pattern tar.bz2$ 129600 100% 129600 + # always refresh Packages and Release files + refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims + refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims + refresh_pattern \/InRelease$ 0 0% 0 refresh-ims + refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 + marker: "# {mark} ANSIBLE MANAGED BLOCK refresh_pattern" + notify: "restart squid" + +- name: redirect www traffic in shorewall + lineinfile: + dest: /etc/shorewall/rules + line: "REDIRECT loc 3129 tcp www" + notify: "restart shorewall" diff --git a/roles/two-interface-shorewall/handlers/main.yml b/roles/two-interface-shorewall/handlers/main.yml new file mode 100644 index 0000000..58e1a17 --- /dev/null +++ b/roles/two-interface-shorewall/handlers/main.yml @@ -0,0 +1,7 @@ +- name: restart networking + service: name=networking state=restarted enabled=yes + listen: restart networking + +- name: restart shorewall + service: name=shorewall state=restarted enabled=yes + listen: restart shorewall diff --git a/roles/two-interface-shorewall/tasks/main.yml b/roles/two-interface-shorewall/tasks/main.yml new file mode 100644 index 0000000..e2a273e --- /dev/null +++ b/roles/two-interface-shorewall/tasks/main.yml @@ -0,0 +1,86 @@ +- name: add if_lan with static address + template: + src: interfaces-static.j2 + dest: /etc/network/interfaces.d/static + +- name: make if_wan auto start + lineinfile: + dest: /etc/network/interfaces + line: "auto {{ if_wan }}" + insertbefore: "iface\\s+{{ if_wan }}\\s+inet\\s+dhcp" + notify: restart networking + +- name: install shorewall packages + apt: name=shorewall state=latest + +- name: copy shorewall configuration + command: cp {{ item }} /etc/shorewall/ + args: + chdir: /usr/share/doc/shorewall/examples/two-interfaces/ + creates: "/etc/shorewall/{{ item }}" + with_items: + - interfaces + - snat + - policy + - rules + - stoppedrules + - zones + notify: restart shorewall + +- name: find files in /etc/shorewall/ + find: + paths: /etc/shorewall/ + use_regex: yes + pattern: '.+[^~]$' + contains: '.*(eth0|eth1).*' + register: find_result + notify: restart shorewall + +- name: fix WAN interface name in shorewall configuration + replace: + dest: "{{ item.path }}" + regexp: 'eth0' + replace: "{{ if_wan }}" + backup: yes + with_items: "{{ find_result.files }}" + notify: restart shorewall + +- name: fix LAN interface name in shorewall configuration + replace: + dest: "{{ item.path }}" + regexp: 'eth1' + replace: "{{ if_lan }}" + backup: yes + with_items: "{{ find_result.files }}" + notify: restart shorewall + +- name: configure forwarding in shorewall.conf + replace: + dest: /etc/shorewall/shorewall.conf + regexp: 'IP_FORWARDING=Keep' + replace: 'IP_FORWARDING=Yes' + backup: yes + notify: restart shorewall + +- name: configure shorewall policy + replace: + dest: /etc/shorewall/policy + regexp: 'loc(\s+)net(\s+)ACCEPT' + replace: 'loc\1all\2ACCEPT\n$FW\1all\2ACCEPT' + backup: yes + notify: restart shorewall + +- name: configure shorewall rules + replace: + dest: /etc/shorewall/rules + regexp: '(SSH\(ACCEPT\)\s+)loc(\s+\$FW)' + replace: '\1all\2' + backup: yes + notify: restart shorewall + +- name: enable shorewall in /etc/defaults/shorewall + replace: + dest: /etc/default/shorewall + regexp: 'startup=0' + replace: 'startup=1' + notify: restart shorewall diff --git a/roles/two-interface-shorewall/templates/interfaces-static.j2 b/roles/two-interface-shorewall/templates/interfaces-static.j2 new file mode 100644 index 0000000..6c0fd53 --- /dev/null +++ b/roles/two-interface-shorewall/templates/interfaces-static.j2 @@ -0,0 +1,5 @@ +auto {{ if_lan }} +allow-hotplug {{ if_lan }} +iface {{ if_lan }} inet static + address {{ ipaddr_lan }} + netmask 255.255.255.0 diff --git a/roles/up2date-debian/tasks/main.yml b/roles/up2date-debian/tasks/main.yml new file mode 100644 index 0000000..81d2d5c --- /dev/null +++ b/roles/up2date-debian/tasks/main.yml @@ -0,0 +1,19 @@ +# Update lists and upgrade packages. + +- name: update apt package lists + apt: + update_cache: yes + cache_valid_time: 86400 + +- name: upgrade packages + apt: + upgrade: dist + autoremove: yes + +- name: install some packages + apt: name={{ item }} state=latest + with_items: + - etckeeper + +#- name: clean apt package cache +# command: apt clean From d203da49c2de673a557a07823d691656395786ec Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 31 May 2018 18:24:15 +0300 Subject: [PATCH 002/504] Add 'kiosk' configuration. --- kiosk.yml | 29 ++++++++++++ local.yml | 28 ++++++++++++ roles/gnome/files/defaults | 32 ++++++++++++++ roles/gnome/files/user | 2 + roles/gnome/handlers/main.yml | 3 ++ roles/gnome/tasks/main.yml | 21 +++++++++ roles/kiosk/handlers/main.yml | 30 +++++++++++++ roles/kiosk/tasks/main.yml | 83 +++++++++++++++++++++++++++++++++++ roles/kiosk/templates/wifi.j2 | 18 ++++++++ 9 files changed, 246 insertions(+) create mode 100644 kiosk.yml create mode 100644 local.yml create mode 100644 roles/gnome/files/defaults create mode 100644 roles/gnome/files/user create mode 100644 roles/gnome/handlers/main.yml create mode 100644 roles/gnome/tasks/main.yml create mode 100644 roles/kiosk/handlers/main.yml create mode 100644 roles/kiosk/tasks/main.yml create mode 100644 roles/kiosk/templates/wifi.j2 diff --git a/kiosk.yml b/kiosk.yml new file mode 100644 index 0000000..dd5c6a3 --- /dev/null +++ b/kiosk.yml @@ -0,0 +1,29 @@ +--- +# This playbook deploys a kiosk-computer + +- name: apply configuration to the machines + hosts: kiosk-computers + remote_user: ansible + become: yes + vars: + auto_user: debi + #wifi_ssid: "YOUR SSID HERE" + wifi_ssid: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 64613961373330306237356337323836343032646539353137363039613632373739326565613366 + 3339623632663536363339376638316434623035373538330a383634386133656639633932626436 + 36613139616136346564663363376266323131353037376237343434393136633035326636363666 + 3761623833343064370a633765653166393737326235383231313731623366323963393836616264 + 3532 + #wifi_passwd: "YOUR WIFI-PW HERE" + wifi_passwd: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 64633036633163363237373937313935653466346630363565313233393864306534306631363763 + 3035373034653730656238656133366566613266393536650a376431396164303861616432316338 + 62396133306136653861643336626539666433646234653161616265663631376637333561363730 + 6534633964353363380a313339383166383064656431633062396461376336646263346233303739 + 3435 + roles: + - up2date-debian + - gnome + - kiosk diff --git a/local.yml b/local.yml new file mode 100644 index 0000000..f6851b0 --- /dev/null +++ b/local.yml @@ -0,0 +1,28 @@ +--- +# This playbook deploys a kiosk-computer + +- name: apply configuration to the machines + hosts: localhost + remote_user: root + vars: + auto_user: debi + #wifi_ssid: "YOUR SSID HERE" + wifi_ssid: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 64613961373330306237356337323836343032646539353137363039613632373739326565613366 + 3339623632663536363339376638316434623035373538330a383634386133656639633932626436 + 36613139616136346564663363376266323131353037376237343434393136633035326636363666 + 3761623833343064370a633765653166393737326235383231313731623366323963393836616264 + 3532 + #wifi_passwd: "YOUR WIFI-PW HERE" + wifi_passwd: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 64633036633163363237373937313935653466346630363565313233393864306534306631363763 + 3035373034653730656238656133366566613266393536650a376431396164303861616432316338 + 62396133306136653861643336626539666433646234653161616265663631376637333561363730 + 6534633964353363380a313339383166383064656431633062396461376336646263346233303739 + 3435 + roles: + - up2date-debian + - gnome + - kiosk diff --git a/roles/gnome/files/defaults b/roles/gnome/files/defaults new file mode 100644 index 0000000..2714a65 --- /dev/null +++ b/roles/gnome/files/defaults @@ -0,0 +1,32 @@ +[org/gnome/shell] +enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com'] + +[org/gnome/desktop/background] +show-desktop-icons=true + +[org/gnome/desktop/input-sources] +sources=[('xkb', 'tr'), ('xkb', 'de'), ('xkb', 'us')] + +[org/gnome/desktop/peripherals/touchpad] +natural-scroll=false +edge-scrolling-enabled=true +tap-to-click=true + +[org/gnome/nautilus/desktop] +home-icon-visible=false + +[org/gnome/nautilus/preferences] +default-folder-viewer='list-view' + +[org/gnome/nautilus/list-view] +use-tree-view=true + +[org/gnome/settings-daemon/plugins/power] +power-button-action='hibernate' +sleep-inactive-battery-timeout=900 +sleep-inactive-battery-type='hibernate' +sleep-inactive-ac-timeout=7200 +sleep-inactive-ac-type='suspend' + +[org/gnome/desktop/screensaver] +lock-enabled=false diff --git a/roles/gnome/files/user b/roles/gnome/files/user new file mode 100644 index 0000000..aca0641 --- /dev/null +++ b/roles/gnome/files/user @@ -0,0 +1,2 @@ +user-db:user +system-db:local diff --git a/roles/gnome/handlers/main.yml b/roles/gnome/handlers/main.yml new file mode 100644 index 0000000..5274a2c --- /dev/null +++ b/roles/gnome/handlers/main.yml @@ -0,0 +1,3 @@ +- name: update dconf + command: dconf update + listen: update dconf diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml new file mode 100644 index 0000000..3607118 --- /dev/null +++ b/roles/gnome/tasks/main.yml @@ -0,0 +1,21 @@ +#- name: gnome hibernate by default +# apt: name=gnome-shell-extension-suspend-button state=latest + +- name: make sure /etc/dconf/profile/ exists + file: path=/etc/dconf/profile/ state=directory recurse=yes + +- name: prepare for gnome customized defaults + copy: + src: user + dest: /etc/dconf/profile/user + notify: update dconf + + +- name: make sure /etc/dconf/db/local.d/ exists + file: path=/etc/dconf/db/local.d/ state=directory recurse=yes + +- name: modify gnome defaults + copy: + src: defaults + dest: /etc/dconf/db/local.d/defaults + notify: update dconf diff --git a/roles/kiosk/handlers/main.yml b/roles/kiosk/handlers/main.yml new file mode 100644 index 0000000..7c9de36 --- /dev/null +++ b/roles/kiosk/handlers/main.yml @@ -0,0 +1,30 @@ +- name: run update-grub + command: update-grub + listen: update grub + +- name: reload NetworkManager + when: not run_in_installer|default(false)|bool + systemd: + daemon_reload: yes + name: NetworkManager + state: reloaded + enabled: yes + listen: reload NetworkManager + +# fails in installer with stretch, workaround below: +#- name: enable tmp.mount +# systemd: +# daemon_reload: yes +# name: tmp.mount +# enabled: yes + +- name: make sure local-fs.target.wants exists + file: path=/etc/systemd/system/local-fs.target.wants/ state=directory + listen: enable tmp.mount + +- name: enable tmp.mount + file: + src: /etc/systemd/system/tmp.mount + dest: /etc/systemd/system/local-fs.target.wants/tmp.mount + state: link + listen: enable tmp.mount diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml new file mode 100644 index 0000000..91d8cd1 --- /dev/null +++ b/roles/kiosk/tasks/main.yml @@ -0,0 +1,83 @@ +- name: check if gdm3 is installed + stat: path=/etc/gdm3/daemon.conf + register: gdm3 + +- name: enable auto login + when: gdm3.stat.exists == true + lineinfile: + dest: /etc/gdm3/daemon.conf + insertafter: '^#\s*AutomaticLoginEnable = true' + line: 'AutomaticLoginEnable = true' + +- name: auto login user + when: gdm3.stat.exists == true + lineinfile: + dest: /etc/gdm3/daemon.conf + insertafter: '^#\s*AutomaticLogin = ' + line: 'AutomaticLogin = {{ auto_user }}' + +- name: graphics quirk + when: ansible_product_name == "HP 500" + lineinfile: + dest: /etc/default/grub + regexp: '^(GRUB_CMDLINE_LINUX_DEFAULT=).*' + line: '\1"video=SVIDEO-1:d"' + backrefs: yes + notify: update grub + +- name: grub timeout + lineinfile: + dest: /etc/default/grub + regexp: '^(GRUB_TIMEOUT=).*' + line: '\g<1>1' + backrefs: yes + notify: update grub + +- name: keyboard compose key + lineinfile: + dest: /etc/default/keyboard + regexp: '^(XKBOPTIONS=).*' + line: '\1"compose:caps"' + backrefs: yes + +- name: hibernate when lid is closed + lineinfile: + dest: /etc/systemd/logind.conf + insertafter: '^#\s*HandleLidSwitch=' + line: 'HandleLidSwitch=hibernate' + +- name: tmp on tmpfs + shell: cp /usr/share/systemd/tmp.mount /etc/systemd/system/ + args: + creates: /etc/systemd/system/tmp.mount + notify: enable tmp.mount + +- name: mount tmpfs on /home/{{ auto_user }} + mount: + name: /home/{{ auto_user }} + src: tmpfs + fstype: tmpfs + opts: uid=1001,gid=1001,mode=755,size=4G + state: mounted + +- name: add autologin user + user: + name: "{{ auto_user }}" + comment: "Autologin Debian User,,," + shell: /bin/bash + createhome: no + password: '*' + +- name: check if NetworkManager is installed + stat: path=/etc/NetworkManager/system-connections + register: NetworkManager + +- name: add wifi config + when: NetworkManager.stat.exists == true + template: + src: wifi.j2 + dest: /etc/NetworkManager/system-connections/{{ wifi_ssid }} + owner: root + group: root + mode: '0600' + notify: reload NetworkManager diff --git a/roles/kiosk/templates/wifi.j2 b/roles/kiosk/templates/wifi.j2 new file mode 100644 index 0000000..e4bc20e --- /dev/null +++ b/roles/kiosk/templates/wifi.j2 @@ -0,0 +1,18 @@ +[connection] +id={{ wifi_ssid }} +uuid=a9064ab4-e5fc-49d7-bb6d-8a6073c0e757 +type=wifi + +[wifi] +ssid={{ wifi_ssid }} +security=802-11-wireless-security + +[wifi-security] +key-mgmt=wpa-psk +psk={{ wifi_passwd }} + +[ipv4] +method=auto + +[ipv6] +method=auto From b1af7d31ec2c1968783eb0fbfe3eaef552a7edae Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 31 May 2018 18:32:53 +0300 Subject: [PATCH 003/504] Add 'cloudbox' configuration. --- cloudbox.yml | 35 +++++++++++++++++++ roles/ddns-update/files/ddns-update | 30 ++++++++++++++++ roles/ddns-update/files/ddns-update.service | 6 ++++ roles/ddns-update/files/ddns-update.timer | 11 ++++++ roles/ddns-update/handlers/main.yml | 7 ++++ roles/ddns-update/tasks/main.yml | 24 +++++++++++++ .../ddns-update/templates/ddns-update.conf.j2 | 2 ++ roles/low-power/files/powertop.service | 6 ++++ roles/low-power/files/powertop.timer | 9 +++++ roles/low-power/handlers/main.yml | 5 +++ roles/low-power/tasks/main.yml | 15 ++++++++ roles/systemd-networkd/files/10-dhcp.network | 5 +++ roles/systemd-networkd/handlers/main.yml | 13 +++++++ roles/systemd-networkd/tasks/main.yml | 19 ++++++++++ .../templates/20-static.network.j2 | 7 ++++ roles/web-server/tasks/main.yml | 6 ++++ 16 files changed, 200 insertions(+) create mode 100644 cloudbox.yml create mode 100755 roles/ddns-update/files/ddns-update create mode 100644 roles/ddns-update/files/ddns-update.service create mode 100644 roles/ddns-update/files/ddns-update.timer create mode 100644 roles/ddns-update/handlers/main.yml create mode 100644 roles/ddns-update/tasks/main.yml create mode 100644 roles/ddns-update/templates/ddns-update.conf.j2 create mode 100644 roles/low-power/files/powertop.service create mode 100644 roles/low-power/files/powertop.timer create mode 100644 roles/low-power/handlers/main.yml create mode 100644 roles/low-power/tasks/main.yml create mode 100644 roles/systemd-networkd/files/10-dhcp.network create mode 100644 roles/systemd-networkd/handlers/main.yml create mode 100644 roles/systemd-networkd/tasks/main.yml create mode 100644 roles/systemd-networkd/templates/20-static.network.j2 create mode 100644 roles/web-server/tasks/main.yml diff --git a/cloudbox.yml b/cloudbox.yml new file mode 100644 index 0000000..31dd692 --- /dev/null +++ b/cloudbox.yml @@ -0,0 +1,35 @@ +--- +# This playbook deploys the cloudbox on a minimal installation. + +- name: apply configuration to the cloudbox + hosts: cloudboxes + remote_user: ansible + become: yes + vars: + if_lan: "enp1s0" + ipaddr: "192.168.2.50/24" + gateway: "192.168.2.1" + DNS: "192.168.2.1" + #ddns_domain: "something.ddnss.de" + ddns_domain: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 30653335326332666539326461623064383432653133383832313065386231663366383862393961 + 3339356432643139653939323832633839626631396431340a623438333335333765383035666133 + 34313631663938386432326665313331383865616361633465336333613534626262633864613133 + 3934376631343736380a353337303937656638633035666331646563326562363130633534376335 + 6636 + #ddns_updkey: "138638.some.key.here.635620" + ddns_updkey: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35333062366532643235343839313962393038313631663239336138393566643433326535313132 + 3761303730653339616333623534343131333838303036310a343634623739623663623566336233 + 37666466356363646464323335643261346563643564333631626432323963396136643039336531 + 3662653436373564310a663061613032343332373031613831343365643039313034353636613938 + 31663437393564656334663336633234666237386662323661623266396166616235306531333861 + 3831656434613434333337376262396631363336643766323932 + roles: + - up2date-debian + - systemd-networkd + - web-server + - ddns-update + - low-power diff --git a/roles/ddns-update/files/ddns-update b/roles/ddns-update/files/ddns-update new file mode 100755 index 0000000..3285250 --- /dev/null +++ b/roles/ddns-update/files/ddns-update @@ -0,0 +1,30 @@ +#!/bin/bash +set -eu + +. /etc/ddns-update/ddns-update.conf + +DDHOST="https://www.ddnss.de/upd.php" + +if ! DNSRESULT="$(host $DDNSNAME)" ; then + echo "Could not resolve IP address for '$DDNSNAME', no update." + exit 0 +fi + +DNSIP4="$(echo \\"$DNSRESULT\\" | grep -m 1 -oE '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$' || true )" +DNSIP6="$(echo \\"$DNSRESULT\\" | grep -m 1 -oE '[0-9a-f]{1,4}:.+:[0-9a-f]{1,4}' || true )" + +REALIP4="$(wget -q -O - https://ip4.ddnss.de/meineip.php | \ + grep -m 1 -oE '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}' || true )" +REALIP6="$(wget -q -O - https://ip6.ddnss.de/meineip.php | \ + grep -m 1 -oE '[0-9a-f]{1,4}:.+:[0-9a-f]{1,4}' || true )" + +echo "Current DNS: IPv4=$DNSIP4, IPv6=$DNSIP6." +echo "Detected: IPv4=$REALIP4, IPv6=$REALIP6." + +if [ "$REALIP4" == "$DNSIP4" -a "$REALIP6" == "$DNSIP6" ] ; then + echo "IP address unchanged, no update." +else + echo "IP address changed: $DNSIP4 → ${REALIP4}, $DNSIP6 → ${REALIP6}, updating ddns." + wget -q -O - $DDHOST'?key='$KEYAUTH'&host='$DDNSNAME'&ip='$REALIP4'&ip6='$REALIP6 \ + | grep -oE "Updated .+ hostname." || echo "Update not confirmed, it might have failed." +fi diff --git a/roles/ddns-update/files/ddns-update.service b/roles/ddns-update/files/ddns-update.service new file mode 100644 index 0000000..6c1da59 --- /dev/null +++ b/roles/ddns-update/files/ddns-update.service @@ -0,0 +1,6 @@ +[Unit] +Description=Update ddns + +[Service] +Type=oneshot +ExecStart=/usr/local/bin/ddns-update diff --git a/roles/ddns-update/files/ddns-update.timer b/roles/ddns-update/files/ddns-update.timer new file mode 100644 index 0000000..28e8e2a --- /dev/null +++ b/roles/ddns-update/files/ddns-update.timer @@ -0,0 +1,11 @@ +[Unit] +Description=Update ddns IP-address + +[Timer] +OnBootSec=0 +OnUnitActiveSec=15min +AccuracySec=3min + + +[Install] +WantedBy=timers.target diff --git a/roles/ddns-update/handlers/main.yml b/roles/ddns-update/handlers/main.yml new file mode 100644 index 0000000..a1700e2 --- /dev/null +++ b/roles/ddns-update/handlers/main.yml @@ -0,0 +1,7 @@ +- name: enable ddns-update timer + systemd: + name: ddns-update.timer + state: restarted + daemon_reload: yes + enabled: yes + listen: "enable ddns-update timer" diff --git a/roles/ddns-update/tasks/main.yml b/roles/ddns-update/tasks/main.yml new file mode 100644 index 0000000..54e3412 --- /dev/null +++ b/roles/ddns-update/tasks/main.yml @@ -0,0 +1,24 @@ +- name: make sure /etc/ddns-update/ exists + file: path=/etc/ddns-update/ state=directory recurse=yes + +- name: install ddns-update config + template: + src: ddns-update.conf.j2 + dest: /etc/ddns-update/ddns-update.conf + +- name: install ddns-update script + copy: + src: ddns-update + dest: /usr/local/bin/ddns-update + mode: 0755 + +- name: install ddns-update.service + copy: + src: ddns-update.service + dest: /etc/systemd/system/ddns-update.service + +- name: install ddns-update.timer + copy: + src: ddns-update.timer + dest: /etc/systemd/system/ddns-update.timer + notify: enable ddns-update timer diff --git a/roles/ddns-update/templates/ddns-update.conf.j2 b/roles/ddns-update/templates/ddns-update.conf.j2 new file mode 100644 index 0000000..cd84e74 --- /dev/null +++ b/roles/ddns-update/templates/ddns-update.conf.j2 @@ -0,0 +1,2 @@ +DDNSNAME="{{ ddns_domain }}" +KEYAUTH="{{ ddns_updkey }}" diff --git a/roles/low-power/files/powertop.service b/roles/low-power/files/powertop.service new file mode 100644 index 0000000..150c2ff --- /dev/null +++ b/roles/low-power/files/powertop.service @@ -0,0 +1,6 @@ +[Unit] +Description=Run powertop --auto-tune + +[Service] +Type=oneshot +ExecStart=/usr/sbin/powertop --auto-tune diff --git a/roles/low-power/files/powertop.timer b/roles/low-power/files/powertop.timer new file mode 100644 index 0000000..4cd5f71 --- /dev/null +++ b/roles/low-power/files/powertop.timer @@ -0,0 +1,9 @@ +[Unit] +Description=Run powertop --auto-tune after boot + +[Timer] +OnBootSec=1min +AccuracySec=1min + +[Install] +WantedBy=timers.target diff --git a/roles/low-power/handlers/main.yml b/roles/low-power/handlers/main.yml new file mode 100644 index 0000000..601c75f --- /dev/null +++ b/roles/low-power/handlers/main.yml @@ -0,0 +1,5 @@ +- name: enable powertop timer + systemd: + name: powertop.timer + enabled: yes + listen: "enable powertop timer" diff --git a/roles/low-power/tasks/main.yml b/roles/low-power/tasks/main.yml new file mode 100644 index 0000000..7a2edd8 --- /dev/null +++ b/roles/low-power/tasks/main.yml @@ -0,0 +1,15 @@ +- name: install some packages + apt: name={{ item }} state=latest + with_items: + - powertop + +- name: install powertop.service + copy: + src: powertop.service + dest: /etc/systemd/system/powertop.service + +- name: install powertop.timer + copy: + src: powertop.timer + dest: /etc/systemd/system/powertop.timer + notify: enable powertop timer diff --git a/roles/systemd-networkd/files/10-dhcp.network b/roles/systemd-networkd/files/10-dhcp.network new file mode 100644 index 0000000..aec1849 --- /dev/null +++ b/roles/systemd-networkd/files/10-dhcp.network @@ -0,0 +1,5 @@ +[Match] +Name=en* + +[Network] +DHCP=yes diff --git a/roles/systemd-networkd/handlers/main.yml b/roles/systemd-networkd/handlers/main.yml new file mode 100644 index 0000000..8d3068c --- /dev/null +++ b/roles/systemd-networkd/handlers/main.yml @@ -0,0 +1,13 @@ +- name: enable systemd-networkd + systemd: + name: systemd-networkd + enabled: yes + daemon_reload: yes + listen: "enable systemd-networkd" + +- name: enable systemd-resolved + systemd: + name: systemd-resolved + enabled: yes + daemon_reload: yes + listen: "enable systemd-resolved" diff --git a/roles/systemd-networkd/tasks/main.yml b/roles/systemd-networkd/tasks/main.yml new file mode 100644 index 0000000..28426e6 --- /dev/null +++ b/roles/systemd-networkd/tasks/main.yml @@ -0,0 +1,19 @@ +- name: install dynamic configuration for networkd + copy: + src: 10-dhcp.network + dest: /etc/systemd/network/10-dhcp.network + notify: "enable systemd-networkd" + +#- name: install static configuration for networkd +# template: +# src: 20-static.network.j2 +# dest: /etc/systemd/network/20-static.network +# notify: "enable systemd-networkd" + +- name: prepare systemd-resolved + file: + src: /run/systemd/resolve/resolv.conf + dest: /etc/resolv.conf + state: link + force: yes + notify: "enable systemd-resolved" diff --git a/roles/systemd-networkd/templates/20-static.network.j2 b/roles/systemd-networkd/templates/20-static.network.j2 new file mode 100644 index 0000000..04195a9 --- /dev/null +++ b/roles/systemd-networkd/templates/20-static.network.j2 @@ -0,0 +1,7 @@ +[Match] +Name={{ if_lan }} + +[Network] +Address={{ ipaddr }} +Gateway={{ gateway }} +DNS={{ DNS }} diff --git a/roles/web-server/tasks/main.yml b/roles/web-server/tasks/main.yml new file mode 100644 index 0000000..c0d073c --- /dev/null +++ b/roles/web-server/tasks/main.yml @@ -0,0 +1,6 @@ +- name: install some packages + apt: name={{ item }} state=latest + with_items: + - unattended-upgrades + - screen + - python-certbot-apache From e37f9fa03ddb02f0b06136c4adced33d9facbc2e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 4 Jun 2018 18:00:25 +0300 Subject: [PATCH 004/504] Update/fix 'installbox' configuration. --- installbox.yml | 16 +++++++--- roles/dhcp-dns-dnsmasq/tasks/main.yml | 2 +- roles/preseed-installer/tasks/main.yml | 32 +++++++++++++------ .../tftp-netboot-installer/handlers/main.yml | 5 ++- roles/tftp-netboot-installer/tasks/main.yml | 17 ++++++++-- .../dnsmasq-tftp-netboot-installer.j2 | 4 +-- roles/two-interface-shorewall/tasks/main.yml | 6 ---- 7 files changed, 55 insertions(+), 27 deletions(-) diff --git a/installbox.yml b/installbox.yml index 7f4e9cc..46f4466 100644 --- a/installbox.yml +++ b/installbox.yml @@ -2,18 +2,24 @@ # This playbook deploys the installbox on a minimal installation. - name: apply configuration to the installbox - hosts: installboxes + hosts: all remote_user: ansible become: yes vars: - hostname: installbox - di_dist: "stretch" - if_lan: "ens8" + if_lan: "" # ← interface name here, like: ens3 or enp2s0" if_wan: "{{ ansible_default_ipv4.interface }}" + hostname: "{{ ansible_hostname }}" ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h tftp_root: "/var/lib/tftpboot" - deb_mirror: "ftp-stud.hs-esslingen.de" + deb_mirror: "ftp.debian.org" + di_dist: "stretch" + + pre_tasks: + - name: validate if interface is available + fail: + msg: "Interface {{ if_lan }} does not exist or is already used." + when: if_lan not in ansible_interfaces or if_lan == if_wan roles: - up2date-debian diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dhcp-dns-dnsmasq/tasks/main.yml index 840a4d7..c254a79 100644 --- a/roles/dhcp-dns-dnsmasq/tasks/main.yml +++ b/roles/dhcp-dns-dnsmasq/tasks/main.yml @@ -1,4 +1,4 @@ -- name: install dns-firewall packages +- name: install dnsmasq package apt: name: dnsmasq state: latest diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml index 326b857..3403f1a 100644 --- a/roles/preseed-installer/tasks/main.yml +++ b/roles/preseed-installer/tasks/main.yml @@ -4,24 +4,36 @@ state: directory - name: provide preseed file - template: - src: preseed.cfg + copy: + src: /usr/share/doc/di-netboot-assistant/examples/preseed.cfg dest: "{{ tftp_root }}/d-i/{{ di_dist }}" + force: no -- name: make installbox resolvable in /etc/hosts from LAN +- name: make the hostname resolvable from the LAN replace: dest: /etc/hosts - regexp: '(127.0.1.1\s+)installbox' - replace: '\1localhost\n{{ ipaddr_lan }} installbox' + regexp: '(127.0.1.1\s+){{ hostname }}' + replace: '\1localhost\n{{ ipaddr_lan }} {{ hostname }}' -- name: add auto boot entry to di-netboot-assistant +- name: add auto pxe boot entry to di-netboot-assistant blockinfile: dest: /etc/di-netboot-assistant/pxelinux.HEAD insertbefore: EOF block: | - LABEL quick - MENU LABEL Debian Installer ({{ di_dist }} ; amd64 + Preseed) - kernel ::/di-netboot-pkg/images/9/amd64/text/debian-installer/amd64/linux - append initrd=::/di-netboot-pkg/images/9/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://installbox TIMEOUT 100 + LABEL autoinstall + MENU LABEL Debian {{ di_dist }} (amd64) + preseed + kernel ::/d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} + notify: "rebuild di-netboot-assistant menu" + +- name: add auto efi boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/grub.cfg.HEAD + insertbefore: EOF + block: | + menuentry 'Debian stable (amd64) + preseed' { + linux /d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} + initrd /d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/initrd.gz + } notify: "rebuild di-netboot-assistant menu" diff --git a/roles/tftp-netboot-installer/handlers/main.yml b/roles/tftp-netboot-installer/handlers/main.yml index 9aee0b2..4cc836c 100644 --- a/roles/tftp-netboot-installer/handlers/main.yml +++ b/roles/tftp-netboot-installer/handlers/main.yml @@ -1,3 +1,6 @@ - name: rebuild di-netboot-assistant menu - command: di-netboot-assistant rebuild-menu + command: "{{ item }}" + with_items: + - di-netboot-assistant rebuild-menu + - di-netboot-assistant rebuild-grub listen: rebuild di-netboot-assistant menu diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/tftp-netboot-installer/tasks/main.yml index cb71006..aac8c29 100644 --- a/roles/tftp-netboot-installer/tasks/main.yml +++ b/roles/tftp-netboot-installer/tasks/main.yml @@ -1,12 +1,23 @@ -- name: install tftp-netboot-installer packages +- name: add stretch-backports + apt_repository: + repo: deb http://deb.debian.org/debian/ stretch-backports main + state: present + +- name: install di-netboot-assistant from backports apt: name: - di-netboot-assistant + default_release: stretch-backports + update_cache: yes + +- name: add installer package + apt: + name: - debian-installer-9-netboot-amd64 - name: bind mount images mount: - name: "{{ tftp_root }}/di-netboot-pkg/" + path: "{{ tftp_root }}/d-i/n-pkg/" src: /usr/lib/debian-installer/ fstype: none opts: bind @@ -14,6 +25,8 @@ state: present register: fstab +- file: path="{{ tftp_root }}/d-i/n-pkg/" state=directory recurse=yes + - name: Reload fstab command: mount -a when: fstab.changed diff --git a/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 b/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 index 3e627d8..2289ac9 100644 --- a/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 +++ b/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 @@ -1,5 +1,5 @@ enable-tftp tftp-root={{ tftp_root }} -dhcp-boot=debian-installer/pxelinux.0 +dhcp-boot=d-i/n-a/pxelinux.0 dhcp-match=set:efi-x86_64,option:client-arch,7 -dhcp-boot=tag:efi-x86_64,debian-installer/bootnetx64.efi +dhcp-boot=tag:efi-x86_64,d-i/n-a/bootnetx64.efi diff --git a/roles/two-interface-shorewall/tasks/main.yml b/roles/two-interface-shorewall/tasks/main.yml index e2a273e..30db436 100644 --- a/roles/two-interface-shorewall/tasks/main.yml +++ b/roles/two-interface-shorewall/tasks/main.yml @@ -2,12 +2,6 @@ template: src: interfaces-static.j2 dest: /etc/network/interfaces.d/static - -- name: make if_wan auto start - lineinfile: - dest: /etc/network/interfaces - line: "auto {{ if_wan }}" - insertbefore: "iface\\s+{{ if_wan }}\\s+inet\\s+dhcp" notify: restart networking - name: install shorewall packages From e86d1a5903fb6b63a89f5353e5632c147c7a3190 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 7 Jun 2018 23:51:55 +0300 Subject: [PATCH 005/504] Fix 'kiosk' configuration. --- kiosk.yml | 19 +++---------------- local.yml | 19 +++---------------- roles/gnome/tasks/main.yml | 5 +++++ 3 files changed, 11 insertions(+), 32 deletions(-) diff --git a/kiosk.yml b/kiosk.yml index dd5c6a3..c01ea65 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -7,22 +7,9 @@ become: yes vars: auto_user: debi - #wifi_ssid: "YOUR SSID HERE" - wifi_ssid: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 64613961373330306237356337323836343032646539353137363039613632373739326565613366 - 3339623632663536363339376638316434623035373538330a383634386133656639633932626436 - 36613139616136346564663363376266323131353037376237343434393136633035326636363666 - 3761623833343064370a633765653166393737326235383231313731623366323963393836616264 - 3532 - #wifi_passwd: "YOUR WIFI-PW HERE" - wifi_passwd: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 64633036633163363237373937313935653466346630363565313233393864306534306631363763 - 3035373034653730656238656133366566613266393536650a376431396164303861616432316338 - 62396133306136653861643336626539666433646234653161616265663631376637333561363730 - 6534633964353363380a313339383166383064656431633062396461376336646263346233303739 - 3435 + wifi_ssid: "YOUR SSID HERE" + wifi_passwd: "YOUR WIFI-PW HERE" + roles: - up2date-debian - gnome diff --git a/local.yml b/local.yml index f6851b0..200ea21 100644 --- a/local.yml +++ b/local.yml @@ -6,22 +6,9 @@ remote_user: root vars: auto_user: debi - #wifi_ssid: "YOUR SSID HERE" - wifi_ssid: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 64613961373330306237356337323836343032646539353137363039613632373739326565613366 - 3339623632663536363339376638316434623035373538330a383634386133656639633932626436 - 36613139616136346564663363376266323131353037376237343434393136633035326636363666 - 3761623833343064370a633765653166393737326235383231313731623366323963393836616264 - 3532 - #wifi_passwd: "YOUR WIFI-PW HERE" - wifi_passwd: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 64633036633163363237373937313935653466346630363565313233393864306534306631363763 - 3035373034653730656238656133366566613266393536650a376431396164303861616432316338 - 62396133306136653861643336626539666433646234653161616265663631376637333561363730 - 6534633964353363380a313339383166383064656431633062396461376336646263346233303739 - 3435 + wifi_ssid: "YOUR SSID HERE" + wifi_passwd: "YOUR WIFI-PW HERE" + roles: - up2date-debian - gnome diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index 3607118..acf08dc 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -1,6 +1,11 @@ #- name: gnome hibernate by default # apt: name=gnome-shell-extension-suspend-button state=latest +- name: gnome desktop + apt: + name: task-gnome-desktop + state: latest + - name: make sure /etc/dconf/profile/ exists file: path=/etc/dconf/profile/ state=directory recurse=yes From 7b310eba63846722a27d6a4796810189a9310a9f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 7 Jun 2018 17:51:18 +0300 Subject: [PATCH 006/504] Add 'installbox2kiosk' role. --- installbox.yml | 2 + roles/installbox2kiosk/handlers/main.yml | 7 ++ roles/installbox2kiosk/tasks/main.yml | 80 +++++++++++++++++++ roles/installbox2kiosk/templates/git-repo.j2 | 12 +++ roles/preseed-installer/templates/preseed.cfg | 37 --------- 5 files changed, 101 insertions(+), 37 deletions(-) create mode 100644 roles/installbox2kiosk/handlers/main.yml create mode 100644 roles/installbox2kiosk/tasks/main.yml create mode 100644 roles/installbox2kiosk/templates/git-repo.j2 delete mode 100644 roles/preseed-installer/templates/preseed.cfg diff --git a/installbox.yml b/installbox.yml index 46f4466..02782dd 100644 --- a/installbox.yml +++ b/installbox.yml @@ -14,6 +14,7 @@ tftp_root: "/var/lib/tftpboot" deb_mirror: "ftp.debian.org" di_dist: "stretch" + repo_dir: "/home/ansible/kiosk" pre_tasks: - name: validate if interface is available @@ -28,3 +29,4 @@ - transparent-squid - tftp-netboot-installer - preseed-installer +# - installbox2kiosk # enable this to install kiosk automatically diff --git a/roles/installbox2kiosk/handlers/main.yml b/roles/installbox2kiosk/handlers/main.yml new file mode 100644 index 0000000..e24c8f9 --- /dev/null +++ b/roles/installbox2kiosk/handlers/main.yml @@ -0,0 +1,7 @@ +- name: reload xinetd + systemd: + daemon_reload: yes + name: xinetd + state: reloaded + enabled: yes + listen: reload xinetd diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml new file mode 100644 index 0000000..fb2c515 --- /dev/null +++ b/roles/installbox2kiosk/tasks/main.yml @@ -0,0 +1,80 @@ +- name: generate ssh key + command: "su -l {{ ansible_user }} -c \"ssh-keygen -t rsa -f /home/{{ ansible_user }}/.ssh/id_rsa -P ''\"" + args: + creates: "/home/{{ ansible_user }}/.ssh/id_rsa" + warn: False + +- name: slurp public key + slurp: + src: "/home/{{ ansible_user }}/.ssh/id_rsa.pub" + register: sshpubkey + +# The following seems to be necessary to get rid of a newline: +- set_fact: + sshpubkey: "{{ sshpubkey['content'] | b64decode | replace('\n', '') }}" + +- name: set debian mirror in preseed file + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(d-i mirror/http/hostname string deb.debian.org)$' + replace: '#\1\nd-i mirror/http/hostname string {{ deb_mirror }}' + +- name: enable backports in preseed file + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^#(apt-setup-udeb.*)$' + replace: '\1' + +- name: preseed client - add gnome-desktop, print-server + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(tasksel tasksel/first multiselect standard, ssh-server)$' + replace: '#\1\ntasksel tasksel/first multiselect standard, ssh-server, gnome-desktop, print-server' + +- name: preseed client - add firmware-linux, ansible/stretch-backports, git + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(d-i pkgsel/include string firmware-linux)$' + replace: '#\1\nd-i pkgsel/include string firmware-linux ansible git' + +- name: insert start of managed block + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(### This command is run just before the install finishes:)' + replace: '#\1\n# BEGIN ANSIBLE MANAGED BLOCK preseed/late_command' + +- name: insert end of managed block + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(## When installing.*)' + replace: '# END ANSIBLE MANAGED BLOCK preseed/late_command\n#\1' + +- name: insert block + blockinfile: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + insertafter: "^### This command is run just before the install finishes:" + block: | + d-i preseed/late_command string \ + mkdir -p /target/home/ansible/.ssh && \ + echo "{{ sshpubkey }}" >> /target/home/ansible/.ssh/authorized_keys ; \ + in-target chown -R ansible:ansible /home/ansible/.ssh/ ; \ + in-target chmod -R og= /home/ansible/.ssh/ ; \ + in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" --url=git://{{ hostname }}/.git + marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" + +- name: provide git repo if not available already + git: + repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' + dest: "{{ repo_dir }}" + update: no + become_user: "ansible" + +- name: install xinetd + apt: + name: xinetd + +- name: enable git repo + template: + src: git-repo.j2 + dest: "/etc/xinetd.d/git-repo" + notify: "reload xinetd" diff --git a/roles/installbox2kiosk/templates/git-repo.j2 b/roles/installbox2kiosk/templates/git-repo.j2 new file mode 100644 index 0000000..61aaf54 --- /dev/null +++ b/roles/installbox2kiosk/templates/git-repo.j2 @@ -0,0 +1,12 @@ +# Access to git repository. +service git +{ + disable = no + type = UNLISTED + port = 9418 + socket_type = stream + wait = no + user = nobody + server = /usr/bin/git + server_args = daemon --inetd --export-all --base-path={{ repo_dir }} +} diff --git a/roles/preseed-installer/templates/preseed.cfg b/roles/preseed-installer/templates/preseed.cfg deleted file mode 100644 index e544344..0000000 --- a/roles/preseed-installer/templates/preseed.cfg +++ /dev/null @@ -1,37 +0,0 @@ -#### Preconfiguration file -## For more examples and comments: -## https://www.debian.org/releases/stable/example-preseed.txt - -## To change default values: -#d-i foo/bar string value -#d-i foo/bar seen false - -## Use this as boot parameter: -## DEBCONF_DEBUG=5 -## Boot parameter locale?=de_DE - -# Preseeding only locale sets language, country and locale: -d-i debian-installer/locale string de_DE -d-i keyboard-configuration/xkb-keymap select de - -## Skip root account: -d-i passwd/root-login boolean false - -### Apt setup -d-i apt-setup/non-free boolean true -d-i apt-setup/contrib boolean true -d-i mirror/http/mirror string {{ deb_mirror }} - -### Ansible User -d-i passwd/user-fullname string Ansible User -d-i passwd/username string ansible -d-i passwd/user-password password insecure -d-i passwd/user-password-again password insecure -#d-i passwd/user-password-crypted password [crypt(3) hash] - -### Package selection -tasksel tasksel/desktop multiselect standard openssh-server -tasksel tasksel/desktop seen false - -# Individual additional packages to install -d-i pkgsel/include string firmware-linux From 2c4ef85dcaccb77f821ea693301d66e29b0e2e65 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 9 Jun 2018 12:17:32 +0300 Subject: [PATCH 007/504] Add README. --- README | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 README diff --git a/README b/README new file mode 100644 index 0000000..a1ba3ac --- /dev/null +++ b/README @@ -0,0 +1,33 @@ + + Run Debian in your Local Area Network + ======================================= + +Installbox +~~~~~~~~~~ + • Debian installation: + - user 'ansible' in sudo group + - WAN interface configured and connected + - LAN interface not configured/managed + + • Customize installbox.yml: + - set if_lan + - modify deb_mirror (optional) + - enable installbox2kiosk task (optinal) + + • Run ansible: + ssh-copy-id ansible@1.2.3.4 + ansible-playbook installbox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + + +Kiosk +~~~~~ + • Debian installation: + - user 'ansible' in sudo group + + • Customize kiosk.yml: + - WiFi parameters (optional) + - desktop environment (optional) + + • Run ansible: + ssh-copy-id ansible@1.2.3.4 + ansible-playbook kiosk.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, From 9010cf710b3c2f0533cd222ccfe3c08e2f0b71c6 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 9 Jun 2018 19:48:41 +0300 Subject: [PATCH 008/504] Add extra package selection. --- README | 11 ++++++----- kiosk.yml | 7 ++++++- roles/kiosk/tasks/main.yml | 14 ++++++++++++++ 3 files changed, 26 insertions(+), 6 deletions(-) diff --git a/README b/README index a1ba3ac..6f3c21a 100644 --- a/README +++ b/README @@ -10,9 +10,9 @@ Installbox - LAN interface not configured/managed • Customize installbox.yml: - - set if_lan - - modify deb_mirror (optional) - - enable installbox2kiosk task (optinal) + - set if_lan (mandatory) + - modify deb_mirror + - enable installbox2kiosk task • Run ansible: ssh-copy-id ansible@1.2.3.4 @@ -25,8 +25,9 @@ Kiosk - user 'ansible' in sudo group • Customize kiosk.yml: - - WiFi parameters (optional) - - desktop environment (optional) + - WiFi parameters + - package selection: extra_pkgs and extra_pkgs_bpo for backports + - desktop environment • Run ansible: ssh-copy-id ansible@1.2.3.4 diff --git a/kiosk.yml b/kiosk.yml index c01ea65..e782774 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -2,13 +2,18 @@ # This playbook deploys a kiosk-computer - name: apply configuration to the machines - hosts: kiosk-computers + hosts: all remote_user: ansible become: yes vars: auto_user: debi wifi_ssid: "YOUR SSID HERE" wifi_passwd: "YOUR WIFI-PW HERE" + extra_pkgs: + - unattended-upgrades + - xul-ext-ublock-origin + extra_pkgs_bpo: + - libreoffice roles: - up2date-debian diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index 91d8cd1..288c461 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -1,3 +1,17 @@ +- name: add stretch-backports + apt_repository: + repo: deb http://deb.debian.org/debian/ stretch-backports main + state: present + update_cache: yes + +- name: install extra packages from stable + apt: name={{ item }} state=latest + with_items: "{{ extra_pkgs }}" + +- name: install extra packages from backports + apt: name={{ item }} state=latest default_release=stretch-backports + with_items: "{{ extra_pkgs_bpo }}" + - name: check if gdm3 is installed stat: path=/etc/gdm3/daemon.conf register: gdm3 From 27ac5a8d30d1b21407af58237921b482d5d83b02 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 9 Jun 2018 19:49:30 +0300 Subject: [PATCH 009/504] Improved gnome defaults. --- roles/gnome/files/defaults | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/roles/gnome/files/defaults b/roles/gnome/files/defaults index 2714a65..e612540 100644 --- a/roles/gnome/files/defaults +++ b/roles/gnome/files/defaults @@ -1,5 +1,5 @@ [org/gnome/shell] -enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com'] +enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com'] [org/gnome/desktop/background] show-desktop-icons=true @@ -7,6 +7,9 @@ show-desktop-icons=true [org/gnome/desktop/input-sources] sources=[('xkb', 'tr'), ('xkb', 'de'), ('xkb', 'us')] +[org/gnome/desktop/wm/preferences] +button-layout='appmenu:minimize,maximize,close' + [org/gnome/desktop/peripherals/touchpad] natural-scroll=false edge-scrolling-enabled=true From 47f16792e83e26b362020b53f8d9e4ac69fbaae6 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 10 Jun 2018 20:57:40 +0300 Subject: [PATCH 010/504] Add abstract to README. --- README | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/README b/README index 6f3c21a..7544db7 100644 --- a/README +++ b/README @@ -2,6 +2,37 @@ Run Debian in your Local Area Network ======================================= +The goal of the "Debian Local Area Network"-project is to make setting +up Debian in a local area network as easy as possible. This repository +offers ansible playbooks and instructions for the following machines: + + • Installbox: + - set up as gateway to some external network (WAN) + - providing TFTP installation on the LAN interface + - automatic installs: preseeding and ansible playbooks + - squid package cache + use case: orchestration of automatic installs in the LAN + + • Kiosk: + - auto login user + - reasonable defaults + - temporary home directory on tmpfs, reset at boot + use case: school's computer, hackerspace, … + + • Cloudbox: + - setup of a home cloud server + - dynamic DNS name + - … + use case: nextcloud server in the basement + +Contributions like patches, suggestions, pull requests and/or further +profiles are highly appreciated! + +---------------------------- + + Instructions +============== + Installbox ~~~~~~~~~~ • Debian installation: From ff070a94659f02b8a6ae25a6af5c36a28e66a3df Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 30 Mar 2019 18:12:31 +0300 Subject: [PATCH 011/504] Allow print job management from gnome GUI. --- roles/gnome/tasks/main.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index acf08dc..591eb7e 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -15,7 +15,6 @@ dest: /etc/dconf/profile/user notify: update dconf - - name: make sure /etc/dconf/db/local.d/ exists file: path=/etc/dconf/db/local.d/ state=directory recurse=yes @@ -24,3 +23,10 @@ src: defaults dest: /etc/dconf/db/local.d/defaults notify: update dconf + +## Bug #698504 +- name: allow print job management + replace: + dest: "/etc/cups/cups-files.conf" + regexp: '^(SystemGroup lpadmin)$' + replace: '\1 root' From b119c75c98233f2938bc8dd4a6efe5f91ec045b4 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 30 Mar 2019 18:39:12 +0300 Subject: [PATCH 012/504] Fixes for the DDNS setup. --- roles/ddns-update/files/ddns-update | 9 +++++++-- roles/ddns-update/files/ddns-update.timer | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/roles/ddns-update/files/ddns-update b/roles/ddns-update/files/ddns-update index 3285250..00c4bc8 100755 --- a/roles/ddns-update/files/ddns-update +++ b/roles/ddns-update/files/ddns-update @@ -10,14 +10,19 @@ if ! DNSRESULT="$(host $DDNSNAME)" ; then exit 0 fi -DNSIP4="$(echo \\"$DNSRESULT\\" | grep -m 1 -oE '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$' || true )" -DNSIP6="$(echo \\"$DNSRESULT\\" | grep -m 1 -oE '[0-9a-f]{1,4}:.+:[0-9a-f]{1,4}' || true )" +DNSIP4="$(echo "$DNSRESULT" | grep -m 1 -oE '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$' || true )" +DNSIP6="$(echo "$DNSRESULT" | grep -m 1 -oE '[0-9a-f]{1,4}:.+:[0-9a-f]{1,4}' || true )" REALIP4="$(wget -q -O - https://ip4.ddnss.de/meineip.php | \ grep -m 1 -oE '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}' || true )" REALIP6="$(wget -q -O - https://ip6.ddnss.de/meineip.php | \ grep -m 1 -oE '[0-9a-f]{1,4}:.+:[0-9a-f]{1,4}' || true )" +if [ -z "$REALIP4" -a -z "$REALIP6" ] ; then + echo "Could not detect real IP addresses, exiting." + exit 0 +fi + echo "Current DNS: IPv4=$DNSIP4, IPv6=$DNSIP6." echo "Detected: IPv4=$REALIP4, IPv6=$REALIP6." diff --git a/roles/ddns-update/files/ddns-update.timer b/roles/ddns-update/files/ddns-update.timer index 28e8e2a..0fb72ec 100644 --- a/roles/ddns-update/files/ddns-update.timer +++ b/roles/ddns-update/files/ddns-update.timer @@ -3,7 +3,7 @@ Description=Update ddns IP-address [Timer] OnBootSec=0 -OnUnitActiveSec=15min +OnUnitActiveSec=20min AccuracySec=3min From 7d299549f845a3cb45db86eb09f632c93749f423 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 30 Mar 2019 18:41:04 +0300 Subject: [PATCH 013/504] Update package selection. --- kiosk.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kiosk.yml b/kiosk.yml index e782774..408485b 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -11,7 +11,8 @@ wifi_passwd: "YOUR WIFI-PW HERE" extra_pkgs: - unattended-upgrades - - xul-ext-ublock-origin + - webext-privacy-badger + - webext-ublock-origin extra_pkgs_bpo: - libreoffice From ad70eb60349a585220cb06d02df9bb713a767b01 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 30 Mar 2019 18:51:27 +0300 Subject: [PATCH 014/504] Prefer simpler setup without ansible vaults. --- cloudbox.yml | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/cloudbox.yml b/cloudbox.yml index 31dd692..6580f35 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -10,23 +10,8 @@ ipaddr: "192.168.2.50/24" gateway: "192.168.2.1" DNS: "192.168.2.1" - #ddns_domain: "something.ddnss.de" - ddns_domain: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 30653335326332666539326461623064383432653133383832313065386231663366383862393961 - 3339356432643139653939323832633839626631396431340a623438333335333765383035666133 - 34313631663938386432326665313331383865616361633465336333613534626262633864613133 - 3934376631343736380a353337303937656638633035666331646563326562363130633534376335 - 6636 - #ddns_updkey: "138638.some.key.here.635620" - ddns_updkey: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 35333062366532643235343839313962393038313631663239336138393566643433326535313132 - 3761303730653339616333623534343131333838303036310a343634623739623663623566336233 - 37666466356363646464323335643261346563643564333631626432323963396136643039336531 - 3662653436373564310a663061613032343332373031613831343365643039313034353636613938 - 31663437393564656334663336633234666237386662323661623266396166616235306531333861 - 3831656434613434333337376262396631363336643766323932 + ddns_domain: "something.ddnss.de" + ddns_updkey: "138638.some.key.here.635620" roles: - up2date-debian - systemd-networkd From a72fae8d389bcc867b5758c4d54a8b59279a2c6e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 1 Apr 2019 11:47:55 +0300 Subject: [PATCH 015/504] Updates for buster and gnome desktop. --- kiosk.yml | 5 +++-- local.yml | 8 ++++++++ roles/gnome/files/defaults | 8 +------- roles/kiosk/tasks/main.yml | 16 ++++++++-------- roles/up2date-debian/tasks/main.yml | 6 +++--- 5 files changed, 23 insertions(+), 20 deletions(-) diff --git a/kiosk.yml b/kiosk.yml index 408485b..2df8628 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -6,6 +6,7 @@ remote_user: ansible become: yes vars: + deb_release: "buster" auto_user: debi wifi_ssid: "YOUR SSID HERE" wifi_passwd: "YOUR WIFI-PW HERE" @@ -13,8 +14,8 @@ - unattended-upgrades - webext-privacy-badger - webext-ublock-origin - extra_pkgs_bpo: - - libreoffice + + extra_pkgs_bpo: [] #[ libreoffice ] roles: - up2date-debian diff --git a/local.yml b/local.yml index 200ea21..dba6a24 100644 --- a/local.yml +++ b/local.yml @@ -5,6 +5,7 @@ hosts: localhost remote_user: root vars: + deb_release: "buster" auto_user: debi wifi_ssid: "YOUR SSID HERE" wifi_passwd: "YOUR WIFI-PW HERE" @@ -13,3 +14,10 @@ - up2date-debian - gnome - kiosk + + extra_pkgs: + - unattended-upgrades + - webext-privacy-badger + - webext-ublock-origin + + extra_pkgs_bpo: [] # [ libreoffice ] diff --git a/roles/gnome/files/defaults b/roles/gnome/files/defaults index e612540..fce297b 100644 --- a/roles/gnome/files/defaults +++ b/roles/gnome/files/defaults @@ -1,8 +1,5 @@ [org/gnome/shell] -enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com'] - -[org/gnome/desktop/background] -show-desktop-icons=true +enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com'] [org/gnome/desktop/input-sources] sources=[('xkb', 'tr'), ('xkb', 'de'), ('xkb', 'us')] @@ -15,9 +12,6 @@ natural-scroll=false edge-scrolling-enabled=true tap-to-click=true -[org/gnome/nautilus/desktop] -home-icon-visible=false - [org/gnome/nautilus/preferences] default-folder-viewer='list-view' diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index 288c461..c7d478c 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -1,16 +1,16 @@ -- name: add stretch-backports +- name: install extra packages from stable + apt: name={{ extra_pkgs }} state=latest + +- name: add {{ deb_release }}-backports apt_repository: - repo: deb http://deb.debian.org/debian/ stretch-backports main + repo: deb http://deb.debian.org/debian/ {{ deb_release }}-backports main state: present update_cache: yes - -- name: install extra packages from stable - apt: name={{ item }} state=latest - with_items: "{{ extra_pkgs }}" + when: extra_pkgs_bpo|length - name: install extra packages from backports - apt: name={{ item }} state=latest default_release=stretch-backports - with_items: "{{ extra_pkgs_bpo }}" + apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ deb_release }}-backports + when: extra_pkgs_bpo|length - name: check if gdm3 is installed stat: path=/etc/gdm3/daemon.conf diff --git a/roles/up2date-debian/tasks/main.yml b/roles/up2date-debian/tasks/main.yml index 81d2d5c..85b734b 100644 --- a/roles/up2date-debian/tasks/main.yml +++ b/roles/up2date-debian/tasks/main.yml @@ -11,9 +11,9 @@ autoremove: yes - name: install some packages - apt: name={{ item }} state=latest - with_items: - - etckeeper + apt: + name: etckeeper + state: latest #- name: clean apt package cache # command: apt clean From 6f5556e37f8dfbad9fd2c2015d64168dc0981ad4 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 4 Apr 2019 19:17:35 +0300 Subject: [PATCH 016/504] Fixes and improvements gnome and kiosk profile. --- kiosk.yml | 1 - local.yml | 12 +++++------- roles/gnome/files/defaults | 6 +++++- roles/gnome/tasks/main.yml | 5 ++++- 4 files changed, 14 insertions(+), 10 deletions(-) diff --git a/kiosk.yml b/kiosk.yml index 2df8628..b9cd5e3 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -14,7 +14,6 @@ - unattended-upgrades - webext-privacy-badger - webext-ublock-origin - extra_pkgs_bpo: [] #[ libreoffice ] roles: diff --git a/local.yml b/local.yml index dba6a24..cd01cab 100644 --- a/local.yml +++ b/local.yml @@ -9,15 +9,13 @@ auto_user: debi wifi_ssid: "YOUR SSID HERE" wifi_passwd: "YOUR WIFI-PW HERE" + extra_pkgs: + - unattended-upgrades + - webext-privacy-badger + - webext-ublock-origin + extra_pkgs_bpo: [] # [ libreoffice ] roles: - up2date-debian - gnome - kiosk - - extra_pkgs: - - unattended-upgrades - - webext-privacy-badger - - webext-ublock-origin - - extra_pkgs_bpo: [] # [ libreoffice ] diff --git a/roles/gnome/files/defaults b/roles/gnome/files/defaults index fce297b..3f6b1d1 100644 --- a/roles/gnome/files/defaults +++ b/roles/gnome/files/defaults @@ -1,5 +1,5 @@ [org/gnome/shell] -enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com'] +enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com', 'desktop-icons@csoriano'] [org/gnome/desktop/input-sources] sources=[('xkb', 'tr'), ('xkb', 'de'), ('xkb', 'us')] @@ -27,3 +27,7 @@ sleep-inactive-ac-type='suspend' [org/gnome/desktop/screensaver] lock-enabled=false + +[org/gnome/desktop/interface] +clock-show-date=true +clock-show-seconds=true diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index 591eb7e..01b6d7c 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -3,7 +3,10 @@ - name: gnome desktop apt: - name: task-gnome-desktop + name: + - task-gnome-desktop + - gnome-shell-extension-desktop-icons + - cups state: latest - name: make sure /etc/dconf/profile/ exists From 1e83a0f1f67b1d3ba747c2ed8bb804fb56841a2d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 18 May 2019 18:26:10 +0300 Subject: [PATCH 017/504] Add splash screen to the gnome role. --- roles/gnome/handlers/main.yml | 4 ++++ roles/gnome/tasks/main.yml | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/roles/gnome/handlers/main.yml b/roles/gnome/handlers/main.yml index 5274a2c..c29a95b 100644 --- a/roles/gnome/handlers/main.yml +++ b/roles/gnome/handlers/main.yml @@ -1,3 +1,7 @@ - name: update dconf command: dconf update listen: update dconf + +- name: update grub + command: update-grub + listen: update grub diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index 01b6d7c..32b985d 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -27,9 +27,16 @@ dest: /etc/dconf/db/local.d/defaults notify: update dconf -## Bug #698504 +## Bug #698504 - name: allow print job management replace: dest: "/etc/cups/cups-files.conf" regexp: '^(SystemGroup lpadmin)$' replace: '\1 root' + +- name: enable splash screen + replace: + dest: "/etc/default/grub" + regexp: '"quiet"$' + replace: '"quiet splash"' + notify: update grub From c1b498c973cf4eea1c3055c1bd7de964d49d1b76 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 20 May 2019 18:57:39 +0300 Subject: [PATCH 018/504] Fix graphics quirk and add HP 550. --- roles/kiosk/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index c7d478c..fd5e413 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -31,10 +31,10 @@ line: 'AutomaticLogin = {{ auto_user }}' - name: graphics quirk - when: ansible_product_name == "HP 500" + when: ansible_product_name == "HP 500" or ansible_product_name == "HP 550" lineinfile: dest: /etc/default/grub - regexp: '^(GRUB_CMDLINE_LINUX_DEFAULT=).*' + regexp: '^(GRUB_CMDLINE_LINUX=)""' line: '\1"video=SVIDEO-1:d"' backrefs: yes notify: update grub From f6471d8556164aff8ad895acfe035d36fd1cc0a5 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 21 May 2019 19:14:21 +0300 Subject: [PATCH 019/504] Remove unattended-upgrades and make local.yml a symlink. --- kiosk.yml | 3 +-- local.yml | 22 +--------------------- 2 files changed, 2 insertions(+), 23 deletions(-) mode change 100644 => 120000 local.yml diff --git a/kiosk.yml b/kiosk.yml index b9cd5e3..9c56c8c 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -11,10 +11,9 @@ wifi_ssid: "YOUR SSID HERE" wifi_passwd: "YOUR WIFI-PW HERE" extra_pkgs: - - unattended-upgrades - webext-privacy-badger - webext-ublock-origin - extra_pkgs_bpo: [] #[ libreoffice ] + extra_pkgs_bpo: [] # [ libreoffice ] roles: - up2date-debian diff --git a/local.yml b/local.yml deleted file mode 100644 index cd01cab..0000000 --- a/local.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# This playbook deploys a kiosk-computer - -- name: apply configuration to the machines - hosts: localhost - remote_user: root - vars: - deb_release: "buster" - auto_user: debi - wifi_ssid: "YOUR SSID HERE" - wifi_passwd: "YOUR WIFI-PW HERE" - extra_pkgs: - - unattended-upgrades - - webext-privacy-badger - - webext-ublock-origin - extra_pkgs_bpo: [] # [ libreoffice ] - - roles: - - up2date-debian - - gnome - - kiosk diff --git a/local.yml b/local.yml new file mode 120000 index 0000000..ebbef3f --- /dev/null +++ b/local.yml @@ -0,0 +1 @@ +kiosk.yml \ No newline at end of file From d7a1a146ddba81ebeadc68f60ba8f7be04692ade Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 24 May 2019 17:26:15 +0300 Subject: [PATCH 020/504] Updates and fixes for buster. --- installbox.yml | 8 +++-- roles/installbox2kiosk/tasks/main.yml | 3 +- .../tftp-netboot-installer/handlers/main.yml | 9 +++++ roles/tftp-netboot-installer/tasks/main.yml | 35 +++---------------- roles/transparent-squid/tasks/main.yml | 1 - roles/two-interface-shorewall/tasks/main.yml | 7 ---- 6 files changed, 21 insertions(+), 42 deletions(-) diff --git a/installbox.yml b/installbox.yml index 02782dd..8d8667c 100644 --- a/installbox.yml +++ b/installbox.yml @@ -12,9 +12,11 @@ ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h tftp_root: "/var/lib/tftpboot" - deb_mirror: "ftp.debian.org" - di_dist: "stretch" - repo_dir: "/home/ansible/kiosk" + deb_mirror: "deb.debian.org" + di_dist: "buster" + di_pkg: debian-installer-10-netboot-amd64 + ansible_user: ansible + repo_dir: "/home/{{ ansible_user }}/kiosk" pre_tasks: - name: validate if interface is available diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml index fb2c515..c2fe199 100644 --- a/roles/installbox2kiosk/tasks/main.yml +++ b/roles/installbox2kiosk/tasks/main.yml @@ -14,6 +14,7 @@ sshpubkey: "{{ sshpubkey['content'] | b64decode | replace('\n', '') }}" - name: set debian mirror in preseed file + when: deb_mirror != "deb.debian.org" replace: dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" regexp: '^(d-i mirror/http/hostname string deb.debian.org)$' @@ -31,7 +32,7 @@ regexp: '^(tasksel tasksel/first multiselect standard, ssh-server)$' replace: '#\1\ntasksel tasksel/first multiselect standard, ssh-server, gnome-desktop, print-server' -- name: preseed client - add firmware-linux, ansible/stretch-backports, git +- name: preseed client - add firmware-linux, ansible and git replace: dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" regexp: '^(d-i pkgsel/include string firmware-linux)$' diff --git a/roles/tftp-netboot-installer/handlers/main.yml b/roles/tftp-netboot-installer/handlers/main.yml index 4cc836c..75ce256 100644 --- a/roles/tftp-netboot-installer/handlers/main.yml +++ b/roles/tftp-netboot-installer/handlers/main.yml @@ -1,3 +1,12 @@ +- name: bind mount images + mount: + path: "{{ tftp_root }}/d-i/n-pkg/" + src: /usr/lib/debian-installer/ + fstype: none + state: mounted + opts: bind + listen: bind mount images + - name: rebuild di-netboot-assistant menu command: "{{ item }}" with_items: diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/tftp-netboot-installer/tasks/main.yml index aac8c29..31df608 100644 --- a/roles/tftp-netboot-installer/tasks/main.yml +++ b/roles/tftp-netboot-installer/tasks/main.yml @@ -1,36 +1,11 @@ -- name: add stretch-backports - apt_repository: - repo: deb http://deb.debian.org/debian/ stretch-backports main - state: present - -- name: install di-netboot-assistant from backports +- name: install di-netboot-assistant and installer package apt: name: - di-netboot-assistant - default_release: stretch-backports - update_cache: yes - -- name: add installer package - apt: - name: - - debian-installer-9-netboot-amd64 - -- name: bind mount images - mount: - path: "{{ tftp_root }}/d-i/n-pkg/" - src: /usr/lib/debian-installer/ - fstype: none - opts: bind -# state: mounted BEGINN WORKAROUND - state: present - register: fstab - -- file: path="{{ tftp_root }}/d-i/n-pkg/" state=directory recurse=yes - -- name: Reload fstab - command: mount -a - when: fstab.changed -# https://github.com/ansible/ansible/issues/23487 END WORKAROUND + - "{{ di_pkg }}" + notify: + - bind mount images + - rebuild di-netboot-assistant menu - name: configure dnsmasq template: diff --git a/roles/transparent-squid/tasks/main.yml b/roles/transparent-squid/tasks/main.yml index 581acc9..f4a046e 100644 --- a/roles/transparent-squid/tasks/main.yml +++ b/roles/transparent-squid/tasks/main.yml @@ -9,7 +9,6 @@ line: "{{ item.line }}" insertafter: "{{ item.insertafter }}" with_items: - - { line: "acl localnet src 192.168.0.0/16", insertafter: "#acl localnet src 192.168.0.0/16" } - { line: "http_access allow localnet", insertafter: "#http_access allow localnet" } - { line: "http_port 3129 intercept", insertafter: "http_port 3128" } - { line: "maximum_object_size_in_memory 10240 KB", insertafter: "# maximum_object_size_in_memory" } diff --git a/roles/two-interface-shorewall/tasks/main.yml b/roles/two-interface-shorewall/tasks/main.yml index 30db436..e92f99c 100644 --- a/roles/two-interface-shorewall/tasks/main.yml +++ b/roles/two-interface-shorewall/tasks/main.yml @@ -71,10 +71,3 @@ replace: '\1all\2' backup: yes notify: restart shorewall - -- name: enable shorewall in /etc/defaults/shorewall - replace: - dest: /etc/default/shorewall - regexp: 'startup=0' - replace: 'startup=1' - notify: restart shorewall From e51f6c5e2d20fc6b72b11c5feca8cd57e6e2a427 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 24 May 2019 19:58:20 +0300 Subject: [PATCH 021/504] Use systemd service for git repository. --- roles/installbox2kiosk/handlers/main.yml | 8 +++--- roles/installbox2kiosk/tasks/main.yml | 10 ++----- roles/installbox2kiosk/templates/git-repo.j2 | 30 ++++++++++++-------- 3 files changed, 25 insertions(+), 23 deletions(-) diff --git a/roles/installbox2kiosk/handlers/main.yml b/roles/installbox2kiosk/handlers/main.yml index e24c8f9..3d30c45 100644 --- a/roles/installbox2kiosk/handlers/main.yml +++ b/roles/installbox2kiosk/handlers/main.yml @@ -1,7 +1,7 @@ -- name: reload xinetd +- name: start git-repo systemd: daemon_reload: yes - name: xinetd - state: reloaded + name: git-repo + state: started enabled: yes - listen: reload xinetd + listen: start git-repo diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml index c2fe199..b42ea35 100644 --- a/roles/installbox2kiosk/tasks/main.yml +++ b/roles/installbox2kiosk/tasks/main.yml @@ -70,12 +70,8 @@ update: no become_user: "ansible" -- name: install xinetd - apt: - name: xinetd - -- name: enable git repo +- name: start git-repo template: src: git-repo.j2 - dest: "/etc/xinetd.d/git-repo" - notify: "reload xinetd" + dest: "/etc/systemd/system/git-repo.service" + notify: start git-repo diff --git a/roles/installbox2kiosk/templates/git-repo.j2 b/roles/installbox2kiosk/templates/git-repo.j2 index 61aaf54..be9f853 100644 --- a/roles/installbox2kiosk/templates/git-repo.j2 +++ b/roles/installbox2kiosk/templates/git-repo.j2 @@ -1,12 +1,18 @@ -# Access to git repository. -service git -{ - disable = no - type = UNLISTED - port = 9418 - socket_type = stream - wait = no - user = nobody - server = /usr/bin/git - server_args = daemon --inetd --export-all --base-path={{ repo_dir }} -} +[Unit] +Description=Start Git Daemon + +[Service] +ExecStart=/usr/bin/git daemon --reuseaddr --export-all --base-path={{ repo_dir }} + +Restart=always +RestartSec=500ms + +StandardOutput=syslog +StandardError=syslog +SyslogIdentifier=git-daemon + +User=nobody +Group=nogroup + +[Install] +WantedBy=multi-user.target From 8118b980ecb6b44f563a7fe13309b1e939e26d3f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 24 May 2019 22:17:33 +0300 Subject: [PATCH 022/504] Use variable for installer version. --- installbox.yml | 3 ++- roles/preseed-installer/tasks/main.yml | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/installbox.yml b/installbox.yml index 8d8667c..b4c0477 100644 --- a/installbox.yml +++ b/installbox.yml @@ -14,7 +14,8 @@ tftp_root: "/var/lib/tftpboot" deb_mirror: "deb.debian.org" di_dist: "buster" - di_pkg: debian-installer-10-netboot-amd64 + di_version: "10" + di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" ansible_user: ansible repo_dir: "/home/{{ ansible_user }}/kiosk" diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml index 3403f1a..e1160e1 100644 --- a/roles/preseed-installer/tasks/main.yml +++ b/roles/preseed-installer/tasks/main.yml @@ -23,8 +23,8 @@ TIMEOUT 100 LABEL autoinstall MENU LABEL Debian {{ di_dist }} (amd64) + preseed - kernel ::/d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/linux - append initrd=::/d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} notify: "rebuild di-netboot-assistant menu" - name: add auto efi boot entry to di-netboot-assistant @@ -33,7 +33,7 @@ insertbefore: EOF block: | menuentry 'Debian stable (amd64) + preseed' { - linux /d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} - initrd /d-i/n-pkg/images/9/amd64/text/debian-installer/amd64/initrd.gz + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } notify: "rebuild di-netboot-assistant menu" From b75f508adff00c0320de63fde0a558149dbde71a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 24 May 2019 22:24:17 +0300 Subject: [PATCH 023/504] Use systemd module to enable service. --- roles/two-interface-shorewall/handlers/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/two-interface-shorewall/handlers/main.yml b/roles/two-interface-shorewall/handlers/main.yml index 58e1a17..7d41138 100644 --- a/roles/two-interface-shorewall/handlers/main.yml +++ b/roles/two-interface-shorewall/handlers/main.yml @@ -1,7 +1,7 @@ - name: restart networking - service: name=networking state=restarted enabled=yes + systemd: name=networking state=restarted enabled=yes listen: restart networking - name: restart shorewall - service: name=shorewall state=restarted enabled=yes + systemd: name=shorewall state=restarted enabled=yes listen: restart shorewall From fdfd702130737dfd81a588c03f2429d7d1ef3d23 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 24 May 2019 22:38:53 +0300 Subject: [PATCH 024/504] Fix ansible-pull. --- roles/installbox2kiosk/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml index b42ea35..cef242d 100644 --- a/roles/installbox2kiosk/tasks/main.yml +++ b/roles/installbox2kiosk/tasks/main.yml @@ -60,7 +60,7 @@ echo "{{ sshpubkey }}" >> /target/home/ansible/.ssh/authorized_keys ; \ in-target chown -R ansible:ansible /home/ansible/.ssh/ ; \ in-target chmod -R og= /home/ansible/.ssh/ ; \ - in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" --url=git://{{ hostname }}/.git + in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" -i localhost, --url=git://{{ hostname }}/.git marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" - name: provide git repo if not available already From 7404d7ace4db0e543518bb5c54c4c9c39c1a67ee Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 25 May 2019 10:39:32 +0300 Subject: [PATCH 025/504] Cleanup and minor improvements. --- roles/installbox2kiosk/tasks/main.yml | 3 ++- roles/preseed-installer/tasks/main.yml | 14 ++++++++++++-- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml index cef242d..d17d0be 100644 --- a/roles/installbox2kiosk/tasks/main.yml +++ b/roles/installbox2kiosk/tasks/main.yml @@ -60,7 +60,8 @@ echo "{{ sshpubkey }}" >> /target/home/ansible/.ssh/authorized_keys ; \ in-target chown -R ansible:ansible /home/ansible/.ssh/ ; \ in-target chmod -R og= /home/ansible/.ssh/ ; \ - in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" -i localhost, --url=git://{{ hostname }}/.git + in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" \ + -i localhost, --url=git://{{ hostname }}/.git marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" - name: provide git repo if not available already diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml index e1160e1..f5c12cf 100644 --- a/roles/preseed-installer/tasks/main.yml +++ b/roles/preseed-installer/tasks/main.yml @@ -22,9 +22,14 @@ block: | TIMEOUT 100 LABEL autoinstall - MENU LABEL Debian {{ di_dist }} (amd64) + preseed + MENU LABEL Debian {{ di_version }} (amd64) + preseed kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} + + #LABEL daily + #MENU LABEL Debian daily (amd64) + preseed + #kernel ::/d-i/n-a/daily/amd64/linux + #append initrd=::/d-i/n-a/daily/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} notify: "rebuild di-netboot-assistant menu" - name: add auto efi boot entry to di-netboot-assistant @@ -32,8 +37,13 @@ dest: /etc/di-netboot-assistant/grub.cfg.HEAD insertbefore: EOF block: | - menuentry 'Debian stable (amd64) + preseed' { + menuentry 'Debian {{ di_version }} (amd64) + preseed' { linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } + + #menuentry 'Debian daily (amd64) + preseed' { + # linux /d-i/n-a/daily/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} + # initrd /d-i/n-a/daily/amd64/initrd.gz + #} notify: "rebuild di-netboot-assistant menu" From dd89bbb9a4c60d0a7134424d1f0fdaa834cf23e8 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 25 May 2019 22:44:59 +0300 Subject: [PATCH 026/504] Generate IP address list automatically. --- installbox.yml | 1 + roles/dhcp-dns-dnsmasq/tasks/main.yml | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/installbox.yml b/installbox.yml index b4c0477..ee58bd6 100644 --- a/installbox.yml +++ b/installbox.yml @@ -11,6 +11,7 @@ hostname: "{{ ansible_hostname }}" ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h + dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" tftp_root: "/var/lib/tftpboot" deb_mirror: "deb.debian.org" di_dist: "buster" diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dhcp-dns-dnsmasq/tasks/main.yml index c254a79..9d553f7 100644 --- a/roles/dhcp-dns-dnsmasq/tasks/main.yml +++ b/roles/dhcp-dns-dnsmasq/tasks/main.yml @@ -3,6 +3,13 @@ name: dnsmasq state: latest +- name: add client hostnames and IP addresses to /etc/hosts + lineinfile: + dest: /etc/hosts + line: "{{ item.1 }}\t{{ 'debian%03d' | format(item.0) }}" + with_indexed_items: "{{ dhcp_list }}" + notify: "restart dnsmasq" + - name: configure dnsmasq template: src: dnsmasq-transparent-proxy.j2 From 44a426c383abe6ae2d05dd0e7e65401d97753532 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 27 May 2019 18:04:01 +0300 Subject: [PATCH 027/504] Fix and simplify package caching. --- installbox.yml | 2 +- roles/transparent-squid/tasks/main.yml | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/installbox.yml b/installbox.yml index ee58bd6..50718ec 100644 --- a/installbox.yml +++ b/installbox.yml @@ -13,7 +13,7 @@ dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" tftp_root: "/var/lib/tftpboot" - deb_mirror: "deb.debian.org" + deb_mirror: "cdn-fastly.deb.debian.org" # SRV records ("deb.debian.org") do not work with squid di_dist: "buster" di_version: "10" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" diff --git a/roles/transparent-squid/tasks/main.yml b/roles/transparent-squid/tasks/main.yml index f4a046e..d5df254 100644 --- a/roles/transparent-squid/tasks/main.yml +++ b/roles/transparent-squid/tasks/main.yml @@ -22,10 +22,6 @@ insertbefore: "TAG: store_miss" block: | store_id_program /usr/lib/squid/storeid_file_rewrite /etc/squid/store_id_regex.conf - store_id_bypass off - acl Ordinary http_status 200-299 - send_hit deny !Ordinary - store_miss deny !Ordinary marker: "# {mark} ANSIBLE MANAGED BLOCK store_id" notify: "restart squid" From 0d534d893936900d3b69564725b76ae1d389c8e6 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 7 Jun 2019 10:14:51 +0200 Subject: [PATCH 028/504] Define playbook explicitly in preseeded command. --- local.yml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 local.yml diff --git a/local.yml b/local.yml deleted file mode 120000 index ebbef3f..0000000 --- a/local.yml +++ /dev/null @@ -1 +0,0 @@ -kiosk.yml \ No newline at end of file From f0004b6fe962a5d4f1091cd307ef4165b9a4de96 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 8 Jun 2019 23:24:25 +0200 Subject: [PATCH 029/504] Make sure hostname can be set manually, cleanup/fixes. --- installbox.yml | 19 ++++++++++++++++++- roles/preseed-installer/tasks/main.yml | 8 ++++---- roles/up2date-debian/tasks/main.yml | 6 ++---- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/installbox.yml b/installbox.yml index 50718ec..27aeb82 100644 --- a/installbox.yml +++ b/installbox.yml @@ -8,7 +8,7 @@ vars: if_lan: "" # ← interface name here, like: ens3 or enp2s0" if_wan: "{{ ansible_default_ipv4.interface }}" - hostname: "{{ ansible_hostname }}" + hostname: "{{ ansible_hostname }}" # change this to not use the DNS-provided name ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" @@ -34,3 +34,20 @@ - tftp-netboot-installer - preseed-installer # - installbox2kiosk # enable this to install kiosk automatically + + post_tasks: + - name: make sure hostname is set correctly in /etc/hosts + replace: + path: /etc/hosts + regexp: '(127.0.1.1\s+){{ ansible_hostname }}(\s+.*)?$' + replace: '\1{{ hostname }}\2' + + - name: make sure hostname is set correctly in /etc/hostname + replace: + path: /etc/hostname + regexp: '{{ ansible_hostname }}' + replace: '{{ hostname }}' + + - name: set hostname + hostname: + name: "{{ hostname }}" diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml index f5c12cf..72e1de6 100644 --- a/roles/preseed-installer/tasks/main.yml +++ b/roles/preseed-installer/tasks/main.yml @@ -10,10 +10,10 @@ force: no - name: make the hostname resolvable from the LAN - replace: - dest: /etc/hosts - regexp: '(127.0.1.1\s+){{ hostname }}' - replace: '\1localhost\n{{ ipaddr_lan }} {{ hostname }}' + lineinfile: + path: /etc/hosts + insertafter: '^127.0.1.1' + line: '{{ ipaddr_lan }} {{ hostname }}' - name: add auto pxe boot entry to di-netboot-assistant blockinfile: diff --git a/roles/up2date-debian/tasks/main.yml b/roles/up2date-debian/tasks/main.yml index 85b734b..8cb8dcc 100644 --- a/roles/up2date-debian/tasks/main.yml +++ b/roles/up2date-debian/tasks/main.yml @@ -9,11 +9,9 @@ apt: upgrade: dist autoremove: yes + autoclean: yes -- name: install some packages +- name: install etckeeper apt: name: etckeeper state: latest - -#- name: clean apt package cache -# command: apt clean From 4fdd640d6e620e5b2a1e84f1a2efc35d0298cfab Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 12 Jun 2019 22:24:16 +0200 Subject: [PATCH 030/504] Move variables only relevant for the installation before '---', playbook variable. --- installbox.yml | 2 +- roles/installbox2kiosk/tasks/main.yml | 2 +- roles/preseed-installer/tasks/main.yml | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/installbox.yml b/installbox.yml index 27aeb82..fac5ea7 100644 --- a/installbox.yml +++ b/installbox.yml @@ -33,7 +33,7 @@ - transparent-squid - tftp-netboot-installer - preseed-installer -# - installbox2kiosk # enable this to install kiosk automatically + - installbox2kiosk post_tasks: - name: make sure hostname is set correctly in /etc/hosts diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml index d17d0be..0da71cf 100644 --- a/roles/installbox2kiosk/tasks/main.yml +++ b/roles/installbox2kiosk/tasks/main.yml @@ -61,7 +61,7 @@ in-target chown -R ansible:ansible /home/ansible/.ssh/ ; \ in-target chmod -R og= /home/ansible/.ssh/ ; \ in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" \ - -i localhost, --url=git://{{ hostname }}/.git + -i localhost, --url=git://{{ hostname }}/.git $playbook marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" - name: provide git repo if not available already diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml index 72e1de6..3a37138 100644 --- a/roles/preseed-installer/tasks/main.yml +++ b/roles/preseed-installer/tasks/main.yml @@ -24,12 +24,12 @@ LABEL autoinstall MENU LABEL Debian {{ di_version }} (amd64) + preseed kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux - append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- #LABEL daily #MENU LABEL Debian daily (amd64) + preseed #kernel ::/d-i/n-a/daily/amd64/linux - #append initrd=::/d-i/n-a/daily/amd64/initrd.gz --- auto=true priority=critical url=tftp://{{ hostname }} + #append initrd=::/d-i/n-a/daily/amd64/initrd.gz auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- notify: "rebuild di-netboot-assistant menu" - name: add auto efi boot entry to di-netboot-assistant @@ -38,12 +38,12 @@ insertbefore: EOF block: | menuentry 'Debian {{ di_version }} (amd64) + preseed' { - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } #menuentry 'Debian daily (amd64) + preseed' { - # linux /d-i/n-a/daily/amd64/linux --- auto=true priority=critical url=tftp://{{ hostname }} + # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- # initrd /d-i/n-a/daily/amd64/initrd.gz #} notify: "rebuild di-netboot-assistant menu" From 8ae165e842e459e830a4273d51373b4302983101 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 20 Oct 2019 17:20:37 +0200 Subject: [PATCH 031/504] Add minimal role to test only preseeding. --- minimal.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 minimal.yml diff --git a/minimal.yml b/minimal.yml new file mode 100644 index 0000000..c31c0c8 --- /dev/null +++ b/minimal.yml @@ -0,0 +1,9 @@ +--- +# This playbook does almost nothing. Useful for testing only preseeding. + +- name: apply a minimal configuration to the machine + hosts: all + remote_user: ansible + become: yes + roles: + - up2date-debian From cce0dfcafb2cab268133373690d6e86ffde5fcda Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 24 Oct 2019 20:27:35 +0200 Subject: [PATCH 032/504] Switch from squid to apt-cacher-ng and from shorewall to firewalld. --- README | 2 +- installbox.yml | 20 +++--- roles/apt-cacher/files/apt.conf | 1 + roles/apt-cacher/handlers/main.yml | 3 + roles/apt-cacher/tasks/main.yml | 13 ++++ roles/dhcp-dns-dnsmasq/tasks/main.yml | 4 +- ...q-transparent-proxy.j2 => dnsmasq-dhcp.j2} | 0 roles/preseed-installer/tasks/main.yml | 20 ++++-- .../two-interface-firewalld/handlers/main.yml | 9 +++ roles/two-interface-firewalld/tasks/main.yml | 69 +++++++++++++++++++ .../templates/interfaces-static.j2 | 4 ++ 11 files changed, 127 insertions(+), 18 deletions(-) create mode 100644 roles/apt-cacher/files/apt.conf create mode 100644 roles/apt-cacher/handlers/main.yml create mode 100644 roles/apt-cacher/tasks/main.yml rename roles/dhcp-dns-dnsmasq/templates/{dnsmasq-transparent-proxy.j2 => dnsmasq-dhcp.j2} (100%) create mode 100644 roles/two-interface-firewalld/handlers/main.yml create mode 100644 roles/two-interface-firewalld/tasks/main.yml create mode 100644 roles/two-interface-firewalld/templates/interfaces-static.j2 diff --git a/README b/README index 7544db7..2c60c4f 100644 --- a/README +++ b/README @@ -10,7 +10,7 @@ offers ansible playbooks and instructions for the following machines: - set up as gateway to some external network (WAN) - providing TFTP installation on the LAN interface - automatic installs: preseeding and ansible playbooks - - squid package cache + - package cache use case: orchestration of automatic installs in the LAN • Kiosk: diff --git a/installbox.yml b/installbox.yml index fac5ea7..56cc456 100644 --- a/installbox.yml +++ b/installbox.yml @@ -6,33 +6,37 @@ remote_user: ansible become: yes vars: - if_lan: "" # ← interface name here, like: ens3 or enp2s0" + ## this interface provides the default route: if_wan: "{{ ansible_default_ipv4.interface }}" - hostname: "{{ ansible_hostname }}" # change this to not use the DNS-provided name + ## use the first remaining interface for the LAN: + if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first}}" + ## change this to not use the DNS-provided name: + hostname: "{{ ansible_hostname }}" ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" tftp_root: "/var/lib/tftpboot" - deb_mirror: "cdn-fastly.deb.debian.org" # SRV records ("deb.debian.org") do not work with squid + deb_mirror: "deb.debian.org" di_dist: "buster" di_version: "10" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" ansible_user: ansible repo_dir: "/home/{{ ansible_user }}/kiosk" + ansible_python_interpreter: "/usr/bin/python3" # needed for firewalld module pre_tasks: - - name: validate if interface is available + - name: validate if interfaces are available fail: - msg: "Interface {{ if_lan }} does not exist or is already used." - when: if_lan not in ansible_interfaces or if_lan == if_wan + msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." + when: if_lan not in ansible_interfaces or if_wan not in ansible_interfaces or if_lan == if_wan roles: - up2date-debian - - two-interface-shorewall + - two-interface-firewalld - dhcp-dns-dnsmasq - - transparent-squid - tftp-netboot-installer - preseed-installer + - apt-cacher - installbox2kiosk post_tasks: diff --git a/roles/apt-cacher/files/apt.conf b/roles/apt-cacher/files/apt.conf new file mode 100644 index 0000000..d5e98b3 --- /dev/null +++ b/roles/apt-cacher/files/apt.conf @@ -0,0 +1 @@ +Acquire::http::Proxy "http://localhost:3142"; diff --git a/roles/apt-cacher/handlers/main.yml b/roles/apt-cacher/handlers/main.yml new file mode 100644 index 0000000..2d70698 --- /dev/null +++ b/roles/apt-cacher/handlers/main.yml @@ -0,0 +1,3 @@ +- name: start apt-cacher-ng + service: name=apt-cacher-ng state=started enabled=yes + listen: "start apt-cacher-ng" diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml new file mode 100644 index 0000000..c54a3a9 --- /dev/null +++ b/roles/apt-cacher/tasks/main.yml @@ -0,0 +1,13 @@ +- name: install apt-cacher-ng package + apt: + name: apt-cacher-ng + state: latest + +- name: enable apt-cacher-ng for localhost + copy: + src: apt.conf + dest: /etc/apt/apt.conf + backup: yes + notify: "start apt-cacher-ng" + +- meta: flush_handlers diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dhcp-dns-dnsmasq/tasks/main.yml index 9d553f7..0a0997a 100644 --- a/roles/dhcp-dns-dnsmasq/tasks/main.yml +++ b/roles/dhcp-dns-dnsmasq/tasks/main.yml @@ -12,6 +12,6 @@ - name: configure dnsmasq template: - src: dnsmasq-transparent-proxy.j2 - dest: /etc/dnsmasq.d/transparent-proxy + src: dnsmasq-dhcp.j2 + dest: /etc/dnsmasq.d/dnsmasq-dhcp notify: "restart dnsmasq" diff --git a/roles/dhcp-dns-dnsmasq/templates/dnsmasq-transparent-proxy.j2 b/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 similarity index 100% rename from roles/dhcp-dns-dnsmasq/templates/dnsmasq-transparent-proxy.j2 rename to roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml index 3a37138..8435208 100644 --- a/roles/preseed-installer/tasks/main.yml +++ b/roles/preseed-installer/tasks/main.yml @@ -9,11 +9,17 @@ dest: "{{ tftp_root }}/d-i/{{ di_dist }}" force: no +- name: enable apt-cacher-ng for install-clients + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(d-i mirror/http/proxy string.*)$' + replace: 'd-i mirror/http/proxy string http://{{ hostname }}:3142/' + - name: make the hostname resolvable from the LAN - lineinfile: + replace: path: /etc/hosts - insertafter: '^127.0.1.1' - line: '{{ ipaddr_lan }} {{ hostname }}' + regexp: '^(127\.0\.1\.1.*)$' + replace: '#\1\n{{ ipaddr_lan }} {{ hostname }}' - name: add auto pxe boot entry to di-netboot-assistant blockinfile: @@ -22,12 +28,12 @@ block: | TIMEOUT 100 LABEL autoinstall - MENU LABEL Debian {{ di_version }} (amd64) + preseed + MENU LABEL Debian {{ di_version }} (amd64) + preseed + kiosk.yml kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- #LABEL daily - #MENU LABEL Debian daily (amd64) + preseed + #MENU LABEL Debian daily (amd64) + preseed + kiosk.yml #kernel ::/d-i/n-a/daily/amd64/linux #append initrd=::/d-i/n-a/daily/amd64/initrd.gz auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- notify: "rebuild di-netboot-assistant menu" @@ -37,12 +43,12 @@ dest: /etc/di-netboot-assistant/grub.cfg.HEAD insertbefore: EOF block: | - menuentry 'Debian {{ di_version }} (amd64) + preseed' { + menuentry 'Debian {{ di_version }} (amd64) + preseed + kiosk.yml' { linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } - #menuentry 'Debian daily (amd64) + preseed' { + #menuentry 'Debian daily (amd64) + preseed + kiosk.yml' { # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- # initrd /d-i/n-a/daily/amd64/initrd.gz #} diff --git a/roles/two-interface-firewalld/handlers/main.yml b/roles/two-interface-firewalld/handlers/main.yml new file mode 100644 index 0000000..51bb215 --- /dev/null +++ b/roles/two-interface-firewalld/handlers/main.yml @@ -0,0 +1,9 @@ +- name: restart networking + systemd: name=networking state=restarted enabled=yes + listen: restart networking + when: not run_in_installer|default(false)|bool + +- name: start firewalld + systemd: name=firewalld state=started enabled=yes + listen: "start firewalld" + when: not run_in_installer|default(false)|bool diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/two-interface-firewalld/tasks/main.yml new file mode 100644 index 0000000..4df3564 --- /dev/null +++ b/roles/two-interface-firewalld/tasks/main.yml @@ -0,0 +1,69 @@ +- name: add if_lan with static address + template: + src: interfaces-static.j2 + dest: /etc/network/interfaces.d/static + notify: "restart networking" + +- name: install firewalld package + apt: name=firewalld state=latest + notify: "start firewalld" + +- meta: flush_handlers + + +## Do not run the following in the installer: + +- name: add WAN interface to zone public + firewalld: + zone: public + interface: "{{ if_wan }}" + permanent: yes + state: enabled + when: not run_in_installer|default(false)|bool + +- name: enable masquerading + firewalld: + zone: public + masquerade: yes + permanent: yes + state: enabled + when: not run_in_installer|default(false)|bool + +- name: add LAN interface to zone intern + firewalld: + zone: internal + interface: "{{ if_lan }}" + permanent: yes + state: enabled + when: not run_in_installer|default(false)|bool + +- name: enable services + firewalld: + zone: internal + service: "{{ item }}" + permanent: yes + state: enabled + with_items: + - dhcp + - dns + - tftp + - git + when: not run_in_installer|default(false)|bool + +## Use firewall-offline-cmd when run during installation: + +- name: add WAN interface to zone public + command: "firewall-offline-cmd --zone=public --add-interface={{ if_wan }}" + when: run_in_installer|default(false)|bool + +- name: enable masquerading + command: "firewall-offline-cmd --zone=public --add-masquerade" + when: run_in_installer|default(false)|bool + +- name: add LAN interface to zone intern + command: "firewall-offline-cmd --zone=internal --add-interface={{ if_lan }}" + when: run_in_installer|default(false)|bool + +- name: enable services + command: "firewall-offline-cmd --zone=internal --add-service=dhcp --add-service=dns --add-service=tftp --add-service=git" + when: run_in_installer|default(false)|bool diff --git a/roles/two-interface-firewalld/templates/interfaces-static.j2 b/roles/two-interface-firewalld/templates/interfaces-static.j2 new file mode 100644 index 0000000..c9fe71c --- /dev/null +++ b/roles/two-interface-firewalld/templates/interfaces-static.j2 @@ -0,0 +1,4 @@ +auto {{ if_lan }} +allow-hotplug {{ if_lan }} +iface {{ if_lan }} inet static + address {{ ipaddr_lan }}/24 From 0ff0ff1c1bcc3e74a0ce201439601de5a94b3400 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 25 Oct 2019 21:28:32 +0200 Subject: [PATCH 033/504] Set hostname from boot parameters. --- installbox.yml | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-) diff --git a/installbox.yml b/installbox.yml index 56cc456..fa52678 100644 --- a/installbox.yml +++ b/installbox.yml @@ -6,11 +6,11 @@ remote_user: ansible become: yes vars: - ## this interface provides the default route: + ## This interface provides the default route: if_wan: "{{ ansible_default_ipv4.interface }}" - ## use the first remaining interface for the LAN: + ## Use the first remaining interface for the LAN: if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first}}" - ## change this to not use the DNS-provided name: + ## Add 'hostname=XXX' to the installer boot parameters if necessary: hostname: "{{ ansible_hostname }}" ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h @@ -38,20 +38,3 @@ - preseed-installer - apt-cacher - installbox2kiosk - - post_tasks: - - name: make sure hostname is set correctly in /etc/hosts - replace: - path: /etc/hosts - regexp: '(127.0.1.1\s+){{ ansible_hostname }}(\s+.*)?$' - replace: '\1{{ hostname }}\2' - - - name: make sure hostname is set correctly in /etc/hostname - replace: - path: /etc/hostname - regexp: '{{ ansible_hostname }}' - replace: '{{ hostname }}' - - - name: set hostname - hostname: - name: "{{ hostname }}" From fef999e7fe0205c7dbbd1e3929fbbde490bf3247 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 25 Oct 2019 21:51:23 +0200 Subject: [PATCH 034/504] Remove locale 'tr', keep 'de' as example. --- roles/gnome/files/defaults | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/gnome/files/defaults b/roles/gnome/files/defaults index 3f6b1d1..e2f99d0 100644 --- a/roles/gnome/files/defaults +++ b/roles/gnome/files/defaults @@ -2,7 +2,7 @@ enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com', 'desktop-icons@csoriano'] [org/gnome/desktop/input-sources] -sources=[('xkb', 'tr'), ('xkb', 'de'), ('xkb', 'us')] +sources=[('xkb', 'de'), ('xkb', 'us')] [org/gnome/desktop/wm/preferences] button-layout='appmenu:minimize,maximize,close' From b3b8d3d342c3ccb3936c2e7bb751b6f71629100d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 26 Oct 2019 09:15:16 +0200 Subject: [PATCH 035/504] Add KDE plasma as another kiosk system option. --- installbox.yml | 4 ++-- kiosk.yml | 2 ++ roles/kde/handlers/main.yml | 3 +++ roles/kde/tasks/main.yml | 21 ++++++++++++++++++++ roles/kiosk/files/kde5rc | 8 ++++++++ roles/kiosk/files/kscreenlockerrc | 3 +++ roles/kiosk/tasks/main.yml | 31 ++++++++++++++++++++++++++++-- roles/kiosk/templates/sddm.conf.j2 | 4 ++++ 8 files changed, 72 insertions(+), 4 deletions(-) create mode 100644 roles/kde/handlers/main.yml create mode 100644 roles/kde/tasks/main.yml create mode 100644 roles/kiosk/files/kde5rc create mode 100644 roles/kiosk/files/kscreenlockerrc create mode 100644 roles/kiosk/templates/sddm.conf.j2 diff --git a/installbox.yml b/installbox.yml index fa52678..850db30 100644 --- a/installbox.yml +++ b/installbox.yml @@ -9,7 +9,7 @@ ## This interface provides the default route: if_wan: "{{ ansible_default_ipv4.interface }}" ## Use the first remaining interface for the LAN: - if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first}}" + if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" ## Add 'hostname=XXX' to the installer boot parameters if necessary: hostname: "{{ ansible_hostname }}" ipaddr_lan: 192.168.0.10 @@ -28,7 +28,7 @@ - name: validate if interfaces are available fail: msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." - when: if_lan not in ansible_interfaces or if_wan not in ansible_interfaces or if_lan == if_wan + when: (if_lan not in ansible_interfaces) or (if_wan not in ansible_interfaces) or (if_lan == if_wan) roles: - up2date-debian diff --git a/kiosk.yml b/kiosk.yml index 9c56c8c..e3e89a5 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -17,5 +17,7 @@ roles: - up2date-debian + ## Choose either gnome or KDE: - gnome + #- kde - kiosk diff --git a/roles/kde/handlers/main.yml b/roles/kde/handlers/main.yml new file mode 100644 index 0000000..855b467 --- /dev/null +++ b/roles/kde/handlers/main.yml @@ -0,0 +1,3 @@ +- name: update grub + command: update-grub + listen: update grub diff --git a/roles/kde/tasks/main.yml b/roles/kde/tasks/main.yml new file mode 100644 index 0000000..847da41 --- /dev/null +++ b/roles/kde/tasks/main.yml @@ -0,0 +1,21 @@ +- name: kde plasma desktop + apt: + name: + - task-kde-desktop + - cups + state: latest + + +## Bug #698504 +- name: allow print job management + replace: + dest: "/etc/cups/cups-files.conf" + regexp: '^(SystemGroup lpadmin)$' + replace: '\1 root' + +- name: enable splash screen + replace: + dest: "/etc/default/grub" + regexp: '"quiet"$' + replace: '"quiet splash"' + notify: update grub diff --git a/roles/kiosk/files/kde5rc b/roles/kiosk/files/kde5rc new file mode 100644 index 0000000..d7525ca --- /dev/null +++ b/roles/kiosk/files/kde5rc @@ -0,0 +1,8 @@ +[KDE Action Restrictions][$i] +action/start_new_session=false +action/switch_user=false +action/lock_screen=false +action/logout=false + +[General] +BrowserApplication=firefox-esr.desktop diff --git a/roles/kiosk/files/kscreenlockerrc b/roles/kiosk/files/kscreenlockerrc new file mode 100644 index 0000000..0ac7312 --- /dev/null +++ b/roles/kiosk/files/kscreenlockerrc @@ -0,0 +1,3 @@ +[Daemon][$i] +Autolock=false +LockOnResume=false diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index fd5e413..ae75af1 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -12,24 +12,51 @@ apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ deb_release }}-backports when: extra_pkgs_bpo|length +## Check which display manager is used: - name: check if gdm3 is installed stat: path=/etc/gdm3/daemon.conf register: gdm3 -- name: enable auto login +- name: check if sddm is installed + stat: path=/usr/bin/sddm + register: sddm + +## gdm3: +- name: enable auto login in gdm3 when: gdm3.stat.exists == true lineinfile: dest: /etc/gdm3/daemon.conf insertafter: '^#\s*AutomaticLoginEnable = true' line: 'AutomaticLoginEnable = true' -- name: auto login user +- name: auto login user in gdm3 when: gdm3.stat.exists == true lineinfile: dest: /etc/gdm3/daemon.conf insertafter: '^#\s*AutomaticLogin = ' line: 'AutomaticLogin = {{ auto_user }}' +## sddm/KDE: +- name: enable auto login in sddm + when: sddm.stat.exists == true + template: + src: sddm.conf.j2 + dest: /etc/sddm.conf + +- name: kde global defaults + when: sddm.stat.exists == true + copy: + src: kde5rc + dest: /etc/kde5rc + +- name: modify kde screen lock + when: sddm.stat.exists == true + copy: + src: kscreenlockerrc + dest: /etc/xdg/kscreenlockerrc + +######## + - name: graphics quirk when: ansible_product_name == "HP 500" or ansible_product_name == "HP 550" lineinfile: diff --git a/roles/kiosk/templates/sddm.conf.j2 b/roles/kiosk/templates/sddm.conf.j2 new file mode 100644 index 0000000..7d36fa9 --- /dev/null +++ b/roles/kiosk/templates/sddm.conf.j2 @@ -0,0 +1,4 @@ +[Autologin] +Relogin=true +Session=plasma.desktop +User={{ auto_user }} From 0597d178e06c6ee0c94e45ac8a2a3d17b04b1397 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 17 Nov 2019 11:31:55 +0100 Subject: [PATCH 036/504] Implement LDAP server role. --- mainserver.yml | 14 ++++ roles/ldap/defaults/main.yml | 4 ++ roles/ldap/files/slapd-config.ldif | 28 ++++++++ roles/ldap/tasks/main.yml | 110 +++++++++++++++++++++++++++++ 4 files changed, 156 insertions(+) create mode 100644 mainserver.yml create mode 100644 roles/ldap/defaults/main.yml create mode 100644 roles/ldap/files/slapd-config.ldif create mode 100644 roles/ldap/tasks/main.yml diff --git a/mainserver.yml b/mainserver.yml new file mode 100644 index 0000000..88a1401 --- /dev/null +++ b/mainserver.yml @@ -0,0 +1,14 @@ +--- +# This playbook deploys the mainserver + +- name: apply configuration to the mainserver + hosts: all + remote_user: andi + become: yes + vars: + foo_pwd: 123 + + roles: + - ldap +# - krb5-kdc-ldap + diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml new file mode 100644 index 0000000..8c16cfc --- /dev/null +++ b/roles/ldap/defaults/main.yml @@ -0,0 +1,4 @@ +ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd length=24') }}" +ldap_pwd_file: "/root/ldap-admin.pwd" +ldap_domain: "{{ ansible_domain | default('intern', true) }}" +basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" diff --git a/roles/ldap/files/slapd-config.ldif b/roles/ldap/files/slapd-config.ldif new file mode 100644 index 0000000..4770d3b --- /dev/null +++ b/roles/ldap/files/slapd-config.ldif @@ -0,0 +1,28 @@ +#### LDAP Overlays slapd #### +#### Attribute Uniqueness #### + +dn: cn=module,cn=config +objectClass: olcModuleList +cn: module +olcModulePath: /usr/lib/ldap +olcModuleLoad: unique + +dn: olcOverlay=unique,olcDatabase={1}mdb,cn=config +objectClass: olcOverlayConfig +objectClass: olcUniqueConfig +olcOverlay: unique +olcUniqueAttribute: uid uidNumber mail + + +#### Password Hashing #### + +dn: cn=module,cn=config +objectClass: olcModuleList +cn: module +olcModuleLoad: ppolicy + +dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config +objectClass: olcOverlayConfig +objectClass: olcPPolicyConfig +olcOverlay: ppolicy +olcPPolicyHashCleartext: TRUE diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml new file mode 100644 index 0000000..a775111 --- /dev/null +++ b/roles/ldap/tasks/main.yml @@ -0,0 +1,110 @@ +## Install and configure slapd (if not done yet), +## run most tasks only on slapd installation. +--- + +- name: check if slapd is already there + stat: path=/usr/sbin/slapd + register: slapd + +- name: preseed ldap domain + debconf: + name: slapd + question: slapd/domain + value: "{{ ldap_domain }}" + vtype: string + when: not slapd.stat.exists + +- name: preseed slapd admin password1 + debconf: + name: slapd + question: slapd/password1 + value: "{{ ldap_admin_pwd }}" + vtype: password + no_log: true + when: not slapd.stat.exists + +- name: preseed slapd admin password2 + debconf: + name: slapd + question: slapd/password2 + value: "{{ ldap_admin_pwd }}" + vtype: password + no_log: true + when: not slapd.stat.exists + +- name: dump admin password + shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_pwd_file }}" ; chmod 0600 "{{ ldap_pwd_file }}" + no_log: true + when: not slapd.stat.exists + +- name: install slapd and python-ldap + apt: + name: + - slapd + - python-ldap + state: latest + +- name: make initial slapd configuration available + copy: + src: slapd-config.ldif + dest: /etc/ldap/slapd.d/slapd-config.ldif + when: not slapd.stat.exists + +- name: activate ppolicy schema + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif + when: not slapd.stat.exists + +- name: initialize slapd if it has just been installed + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif + when: not slapd.stat.exists + + +####################################################################################### + +## Prepare user directories +- name: make sure we have a people entry for users + ldap_entry: + dn: "ou=people,{{ basedn }}" + objectClass: organizationalUnit + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + +- name: make sure we have a group entry for users + ldap_entry: + dn: "ou=groups,{{ basedn }}" + objectClass: organizationalUnit + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + + +## Add user +- name: add dummy user foo + ldap_entry: + dn: "uid=foo,ou=people,{{ basedn }}" + objectClass: + - inetOrgPerson + - posixAccount + attributes: + cn: foo + sn: bar + userPassword: "{{ foo_pwd }}" + uidNumber: 10000 + gidNumber: 10000 + homeDirectory: /home/foo + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + when: foo_pwd is defined + +- name: add dummy group foo + ldap_entry: + dn: "cn=foo,ou=groups,{{ basedn }}" + objectClass: + - posixGroup + attributes: + gidNumber: 10000 + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + when: foo_pwd is defined + +## ldapaddgroup tom +## ldapadduser tom tom From 18067d8df358737c528a3e2e5c8f8b4c5ef8008f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 17 Nov 2019 11:40:22 +0100 Subject: [PATCH 037/504] Implement Kerberos KDC-LDAP server role. --- mainserver.yml | 4 +- roles/krb5-kdc-ldap/defaults/main.yml | 5 + roles/krb5-kdc-ldap/handlers/main.yml | 7 ++ roles/krb5-kdc-ldap/meta/main.yml | 3 + roles/krb5-kdc-ldap/tasks/main.yml | 146 ++++++++++++++++++++++++ roles/krb5-kdc-ldap/templates/kadm5.acl | 4 + roles/krb5-kdc-ldap/templates/kdc.conf | 15 +++ roles/krb5-kdc-ldap/templates/krb5.conf | 26 +++++ 8 files changed, 208 insertions(+), 2 deletions(-) create mode 100644 roles/krb5-kdc-ldap/defaults/main.yml create mode 100644 roles/krb5-kdc-ldap/handlers/main.yml create mode 100644 roles/krb5-kdc-ldap/meta/main.yml create mode 100644 roles/krb5-kdc-ldap/tasks/main.yml create mode 100644 roles/krb5-kdc-ldap/templates/kadm5.acl create mode 100644 roles/krb5-kdc-ldap/templates/kdc.conf create mode 100644 roles/krb5-kdc-ldap/templates/krb5.conf diff --git a/mainserver.yml b/mainserver.yml index 88a1401..a97a47b 100644 --- a/mainserver.yml +++ b/mainserver.yml @@ -9,6 +9,6 @@ foo_pwd: 123 roles: - - ldap -# - krb5-kdc-ldap +# - ldap + - krb5-kdc-ldap diff --git a/roles/krb5-kdc-ldap/defaults/main.yml b/roles/krb5-kdc-ldap/defaults/main.yml new file mode 100644 index 0000000..7ea992c --- /dev/null +++ b/roles/krb5-kdc-ldap/defaults/main.yml @@ -0,0 +1,5 @@ +--- +kdc_pwd: "{{ lookup('password', '/tmp/kdc.pwd length=24') }}" +kadmin_pwd: "{{ lookup('password', '/tmp/kadmin.pwd length=24') }}" +kdc_master_pwd: "{{ lookup('password', '/tmp/kdc_master.pwd length=24') }}" +kdc_pwd_file: "/root/kdc-master.pwd" diff --git a/roles/krb5-kdc-ldap/handlers/main.yml b/roles/krb5-kdc-ldap/handlers/main.yml new file mode 100644 index 0000000..dd749e0 --- /dev/null +++ b/roles/krb5-kdc-ldap/handlers/main.yml @@ -0,0 +1,7 @@ +- name: restart krb5-kdc + service: name=krb5-kdc state=restarted enabled=yes + listen: "restart krb5-kdc" + +- name: restart krb5-admin-server + service: name=krb5-admin-server state=restarted enabled=yes + listen: "restart krb5-admin-server" diff --git a/roles/krb5-kdc-ldap/meta/main.yml b/roles/krb5-kdc-ldap/meta/main.yml new file mode 100644 index 0000000..b19fb35 --- /dev/null +++ b/roles/krb5-kdc-ldap/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: ldap diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml new file mode 100644 index 0000000..6f37107 --- /dev/null +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -0,0 +1,146 @@ +## Install and configure krb5-kdc-ldap (if not done yet), +## run most tasks only on krb5-kdc-ldap installation. +--- + +- name: check if slapd is already there + stat: path=/usr/sbin/krb5kdc + register: krb5kdc + +- name: prepare krb5.conf + template: + src: krb5.conf + dest: /etc/krb5.conf + +- name: prepare kdc.conf + template: + src: kdc.conf + dest: /etc/krb5kdc/kdc.conf + +- name: prepare kadm5.acl + template: + src: kadm5.acl + dest: /etc/krb5kdc/kadm5.acl + notify: "restart krb5-admin-server" + +- name: install krb5-kdc-ldap and krb5-admin-server + apt: + name: + - krb5-kdc-ldap + - krb5-admin-server + state: latest + +- name: prepare kerberos.openldap.ldif + shell: gunzip -c /usr/share/doc/krb5-kdc-ldap/kerberos.openldap.ldif.gz > /etc/ldap/schema/kerberos.openldap.ldif + when: not krb5kdc.stat.exists + +- name: activate kerberos.openldap.ldif schema + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/kerberos.openldap.ldif + when: not krb5kdc.stat.exists + +- name: make sure we have a kerberos container + ldap_entry: + dn: "cn=kerberos,{{ basedn }}" + objectClass: krbContainer + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + when: not krb5kdc.stat.exists + +- name: make sure we have a kdc object + ldap_entry: + dn: "cn=kdc,cn=kerberos,{{ basedn }}" + objectClass: + - organizationalRole + - simpleSecurityObject + attributes: + userPassword: "{{ kdc_pwd }}" + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + when: not krb5kdc.stat.exists + +- name: make sure we have a kadmin object + ldap_entry: + dn: "cn=kadmin,cn=kerberos,{{ basedn }}" + objectClass: + - organizationalRole + - simpleSecurityObject + attributes: + userPassword: "{{ kadmin_pwd }}" + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd }}" + when: not krb5kdc.stat.exists + +- name: modify ACLs to account for KDC + ldap_attr: + dn: "olcDatabase={1}mdb,cn=config" + name: olcAccess + values: + - >- + to attrs=userPassword + by self write + by anonymous auth + by * none + - >- + to attrs=shadowLastChange + by self write + by * read + - >- + to dn.subtree="cn=kerberos,{{ basedn }}" + by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by * none + - >- + to attrs=krbPrincipalName,krbLastPwdChange,krbPrincipalKey,krbExtraData + by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by self read + by * auth + - >- + to * + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by * read + state: exact + when: not krb5kdc.stat.exists + +- name: add KDC indexes to LDAP + ldap_attr: + dn: "olcDatabase={1}mdb,cn=config" + name: olcDbIndex + values: krbPrincipalName pres,sub,eq + when: not krb5kdc.stat.exists + +- name: prepare password for kdc + shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile + no_log: true + when: not krb5kdc.stat.exists + +- name: prepare password for kadmin + shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_pwd }} | xxd -g0 -ps | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile + no_log: true + when: not krb5kdc.stat.exists + +- name: dump kdc master password + shell: echo -n "{{ kdc_master_pwd }}" > "{{ kdc_pwd_file }}" ; chmod 0600 "{{ kdc_pwd_file }}" + no_log: true + when: not krb5kdc.stat.exists + +- name: initialize KDC + command: + >- + kdb5_ldap_util + -D cn=admin,"{{ basedn }}" + -w "{{ ldap_admin_pwd }}" + -H ldapi:/// + create -s -subtrees "{{ basedn }}" + -P "{{ kdc_master_pwd }}" + -r "{{ ldap_domain | upper }}" + no_log: true + notify: "restart krb5-kdc" + when: not krb5kdc.stat.exists + +- name: add default policy to silence warning when using kadmin + command: kadmin.local -q "add_policy default" + when: not krb5kdc.stat.exists + +- name: kerberize dummy user foo + command: kadmin.local -q 'add_principal -pw {{ foo_pwd }} -x dn="uid=foo,ou=people,{{ basedn }}" foo' + when: foo_pwd is defined diff --git a/roles/krb5-kdc-ldap/templates/kadm5.acl b/roles/krb5-kdc-ldap/templates/kadm5.acl new file mode 100644 index 0000000..1ddf3ff --- /dev/null +++ b/roles/krb5-kdc-ldap/templates/kadm5.acl @@ -0,0 +1,4 @@ +## access controls for the Kerberos KDC +root/admin@{{ ldap_domain | upper }} * +*@{{ ldap_domain | upper }} cil +*/*@{{ ldap_domain | upper }} i diff --git a/roles/krb5-kdc-ldap/templates/kdc.conf b/roles/krb5-kdc-ldap/templates/kdc.conf new file mode 100644 index 0000000..477c9ba --- /dev/null +++ b/roles/krb5-kdc-ldap/templates/kdc.conf @@ -0,0 +1,15 @@ +[kdcdefaults] + kdc_ports = 750,88 + +[realms] + {{ ldap_domain | upper }} = { + admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab + acl_file = /etc/krb5kdc/kadm5.acl + key_stash_file = /etc/krb5kdc/stash + kdc_ports = 750,88 + max_life = 10h 0m 0s + max_renewable_life = 7d 0h 0m 0s + master_key_type = des3-hmac-sha1 + #supported_enctypes = aes256-cts:normal aes128-cts:normal + default_principal_flags = +preauth + } diff --git a/roles/krb5-kdc-ldap/templates/krb5.conf b/roles/krb5-kdc-ldap/templates/krb5.conf new file mode 100644 index 0000000..8f231cb --- /dev/null +++ b/roles/krb5-kdc-ldap/templates/krb5.conf @@ -0,0 +1,26 @@ +[libdefaults] + default_realm = {{ ldap_domain | upper }} + +[realms] + {{ ldap_domain | upper }} = { + kdc = {{ ansible_hostname }} + admin_server = {{ ansible_hostname }} + database_module = LDAP + } + +[domain_realm] + .{{ ldap_domain }} = {{ ldap_domain | upper }} + {{ ldap_domain }} = {{ ldap_domain | upper }} + +[dbdefaults] + ldap_kerberos_container_dn = cn=kerberos,{{ basedn }} + +[dbmodules] + LDAP = { + db_library = kldap + ldap_kdc_dn = cn=kdc,cn=kerberos,{{ basedn }} + ldap_kadmind_dn = cn=kadmin,cn=kerberos,{{ basedn }} + ldap_service_password_file = /etc/krb5kdc/service.keyfile + ldap_servers = ldapi:/// + ldap_conns_per_server = 5 + } From 7e1332ee46a069161499bf8900748c873f79d3bb Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 17 Nov 2019 18:25:43 +0100 Subject: [PATCH 038/504] Minor fixes for KDC-LDAP. --- roles/krb5-kdc-ldap/tasks/main.yml | 14 +++++++++++--- .../templates/{kadm5.acl => kadm5.acl.j2} | 1 - .../templates/{kdc.conf => kdc.conf.j2} | 0 .../templates/{krb5.conf => krb5.conf.j2} | 0 roles/ldap/tasks/main.yml | 2 +- 5 files changed, 12 insertions(+), 5 deletions(-) rename roles/krb5-kdc-ldap/templates/{kadm5.acl => kadm5.acl.j2} (72%) rename roles/krb5-kdc-ldap/templates/{kdc.conf => kdc.conf.j2} (100%) rename roles/krb5-kdc-ldap/templates/{krb5.conf => krb5.conf.j2} (100%) diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 6f37107..63aaeb5 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -8,17 +8,17 @@ - name: prepare krb5.conf template: - src: krb5.conf + src: krb5.conf.j2 dest: /etc/krb5.conf - name: prepare kdc.conf template: - src: kdc.conf + src: kdc.conf.j2 dest: /etc/krb5kdc/kdc.conf - name: prepare kadm5.acl template: - src: kadm5.acl + src: kadm5.acl.j2 dest: /etc/krb5kdc/kadm5.acl notify: "restart krb5-admin-server" @@ -141,6 +141,14 @@ command: kadmin.local -q "add_policy default" when: not krb5kdc.stat.exists +- name: create machine principal + command: kadmin.local -q "addprinc -randkey host/{{ ansible_hostname }}.{{ ldap_domain }}" + when: not krb5kdc.stat.exists + +- name: add principal to the keytab + command: kadmin.local -q "ktadd host/{{ ansible_hostname }}.{{ ldap_domain }}" + when: not krb5kdc.stat.exists + - name: kerberize dummy user foo command: kadmin.local -q 'add_principal -pw {{ foo_pwd }} -x dn="uid=foo,ou=people,{{ basedn }}" foo' when: foo_pwd is defined diff --git a/roles/krb5-kdc-ldap/templates/kadm5.acl b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 similarity index 72% rename from roles/krb5-kdc-ldap/templates/kadm5.acl rename to roles/krb5-kdc-ldap/templates/kadm5.acl.j2 index 1ddf3ff..c21d6b8 100644 --- a/roles/krb5-kdc-ldap/templates/kadm5.acl +++ b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 @@ -1,4 +1,3 @@ ## access controls for the Kerberos KDC -root/admin@{{ ldap_domain | upper }} * *@{{ ldap_domain | upper }} cil */*@{{ ldap_domain | upper }} i diff --git a/roles/krb5-kdc-ldap/templates/kdc.conf b/roles/krb5-kdc-ldap/templates/kdc.conf.j2 similarity index 100% rename from roles/krb5-kdc-ldap/templates/kdc.conf rename to roles/krb5-kdc-ldap/templates/kdc.conf.j2 diff --git a/roles/krb5-kdc-ldap/templates/krb5.conf b/roles/krb5-kdc-ldap/templates/krb5.conf.j2 similarity index 100% rename from roles/krb5-kdc-ldap/templates/krb5.conf rename to roles/krb5-kdc-ldap/templates/krb5.conf.j2 diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index a775111..6b4a5d2 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -90,7 +90,7 @@ userPassword: "{{ foo_pwd }}" uidNumber: 10000 gidNumber: 10000 - homeDirectory: /home/foo + homeDirectory: /home/lan/foo bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" when: foo_pwd is defined From ece5bca5b52ea1398d8fe55e2f2010994514202b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 17 Nov 2019 19:12:22 +0100 Subject: [PATCH 039/504] Implement NFS4 server role. --- roles/nfs-server/defaults/main.yml | 4 ++ roles/nfs-server/handlers/main.yml | 11 +++++ roles/nfs-server/tasks/main.yml | 65 +++++++++++++++++++++++++ roles/nfs-server/templates/sssd.conf.j2 | 24 +++++++++ 4 files changed, 104 insertions(+) create mode 100644 roles/nfs-server/defaults/main.yml create mode 100644 roles/nfs-server/handlers/main.yml create mode 100644 roles/nfs-server/tasks/main.yml create mode 100644 roles/nfs-server/templates/sssd.conf.j2 diff --git a/roles/nfs-server/defaults/main.yml b/roles/nfs-server/defaults/main.yml new file mode 100644 index 0000000..08061b3 --- /dev/null +++ b/roles/nfs-server/defaults/main.yml @@ -0,0 +1,4 @@ +export_root: /srv/nfs4 +export_dir: /home/lan +ldap_domain: "{{ ansible_domain | default('intern', true) }}" +basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" diff --git a/roles/nfs-server/handlers/main.yml b/roles/nfs-server/handlers/main.yml new file mode 100644 index 0000000..bc2c23b --- /dev/null +++ b/roles/nfs-server/handlers/main.yml @@ -0,0 +1,11 @@ +- name: restart nfs-kernel-server + service: name=nfs-kernel-server state=restarted enabled=yes + listen: "restart nfs-kernel-server" + +- name: restart rpc-svcgssd + service: name=rpc-svcgssd state=restarted enabled=yes + listen: "restart rpc-svcgssd" + +- name: restart sssd + service: name=sssd state=restarted enabled=yes + listen: "restart sssd" diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml new file mode 100644 index 0000000..5b6a28a --- /dev/null +++ b/roles/nfs-server/tasks/main.yml @@ -0,0 +1,65 @@ +## Install and configure nfs-server +--- +- name: check if there are installing + stat: path=/etc/exports + register: exports + +- name: install nfs-kernel-server + apt: + name: + - nfs-kernel-server + state: latest + +- name: make sure the export exists + file: path={{ export_root }}/home/ state=directory recurse=yes + +- name: make sure the export exists + file: path={{ export_dir }} state=directory recurse=yes + +- name: bind mount exported dir + mount: + path: "{{ export_root }}/home/" + src: "{{ export_dir }}" + fstype: none + state: mounted + opts: bind + +- name: configure exports + blockinfile: + dest: /etc/exports + insertbefore: EOF + block: | + {{ export_root }} *(sec=krb5p:krb5i:krb5:sys,rw,fsid=0,crossmnt,no_subtree_check) + {{ export_root }}/home/ *(sec=krb5p:krb5i,rw,no_subtree_check) + notify: "restart nfs-kernel-server" + + + +- name: check if there is a local kadmin + stat: path=/usr/sbin/kadmin.local + register: kadmin + +- name: create machine principal + command: kadmin.local -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + when: kadmin.stat.exists and not exports.stat.exists + +- name: add principal to the keytab + command: kadmin.local -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + notify: "restart rpc-svcgssd" + when: kadmin.stat.exists and not exports.stat.exists + +- name: install sssd-krb5 + apt: + name: + - sssd-krb5 + - sssd-ldap + state: latest + when: kadmin.stat.exists + +- name: provide identities from directory + template: + src: sssd.conf.j2 + dest: /etc/sssd/sssd.conf + mode: 0600 + notify: restart sssd + when: kadmin.stat.exists diff --git a/roles/nfs-server/templates/sssd.conf.j2 b/roles/nfs-server/templates/sssd.conf.j2 new file mode 100644 index 0000000..0cea9c5 --- /dev/null +++ b/roles/nfs-server/templates/sssd.conf.j2 @@ -0,0 +1,24 @@ +[sssd] +domains = LDAP +services = nss, pam +config_file_version = 2 + +[nss] +filter_groups = root +filter_users = root + +[pam] + +[domain/LDAP] +id_provider = ldap +ldap_uri = ldap://{{ ansible_hostname }}/ +ldap_search_base = {{ basedn }} + +auth_provider = krb5 +krb5_server = {{ ansible_hostname }} +krb5_realm = {{ ldap_domain | upper }} +cache_credentials = false + +min_id = 10000 +max_id = 20000 +enumerate = False From ce6bd533195ff370ff141c61d082e625bd92db5e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 18 Nov 2019 15:31:30 +0100 Subject: [PATCH 040/504] Minor fixes and improvements, mostly KDC/LDAP related. --- roles/dhcp-dns-dnsmasq/tasks/main.yml | 5 +++ roles/krb5-kdc-ldap/defaults/main.yml | 10 ++++-- roles/krb5-kdc-ldap/tasks/main.yml | 36 +++++++++++++++++----- roles/krb5-kdc-ldap/templates/kadm5.acl.j2 | 1 + roles/ldap/defaults/main.yml | 1 + roles/ldap/tasks/main.yml | 8 +++-- roles/nfs-server/defaults/main.yml | 2 +- roles/nfs-server/tasks/main.yml | 8 ++--- 8 files changed, 52 insertions(+), 19 deletions(-) diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dhcp-dns-dnsmasq/tasks/main.yml index 0a0997a..d0e4bf6 100644 --- a/roles/dhcp-dns-dnsmasq/tasks/main.yml +++ b/roles/dhcp-dns-dnsmasq/tasks/main.yml @@ -1,3 +1,7 @@ +- name: check if dnsmasq is already there + stat: path=/etc/dnsmasq.d/dnsmasq-dhcp + register: dnsmasq + - name: install dnsmasq package apt: name: dnsmasq @@ -9,6 +13,7 @@ line: "{{ item.1 }}\t{{ 'debian%03d' | format(item.0) }}" with_indexed_items: "{{ dhcp_list }}" notify: "restart dnsmasq" + when: not dnsmasq.stat.exists - name: configure dnsmasq template: diff --git a/roles/krb5-kdc-ldap/defaults/main.yml b/roles/krb5-kdc-ldap/defaults/main.yml index 7ea992c..8e22f30 100644 --- a/roles/krb5-kdc-ldap/defaults/main.yml +++ b/roles/krb5-kdc-ldap/defaults/main.yml @@ -1,5 +1,9 @@ --- -kdc_pwd: "{{ lookup('password', '/tmp/kdc.pwd length=24') }}" -kadmin_pwd: "{{ lookup('password', '/tmp/kadmin.pwd length=24') }}" kdc_master_pwd: "{{ lookup('password', '/tmp/kdc_master.pwd length=24') }}" -kdc_pwd_file: "/root/kdc-master.pwd" +kdc_master_pwd_file: "/root/kdc-master.pwd" + +kdc_service_pwd: "{{ lookup('password', '/tmp/kdc-service.pwd length=24') }}" +kadmin_service_pwd: "{{ lookup('password', '/tmp/kadmin-service.pwd length=24') }}" + +kadmin_pwd: "{{ lookup('password', '/tmp/kadmin.pwd length=24') }}" +kadmin_pwd_file: "/root/kadmin.pwd" diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 63aaeb5..f306e5f 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -11,6 +11,9 @@ src: krb5.conf.j2 dest: /etc/krb5.conf +- name: make sure krb5kdc exists + file: path=/etc/krb5kdc state=directory recurse=yes + - name: prepare kdc.conf template: src: kdc.conf.j2 @@ -52,7 +55,7 @@ - organizationalRole - simpleSecurityObject attributes: - userPassword: "{{ kdc_pwd }}" + userPassword: "{{ kdc_service_pwd }}" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" when: not krb5kdc.stat.exists @@ -64,7 +67,7 @@ - organizationalRole - simpleSecurityObject attributes: - userPassword: "{{ kadmin_pwd }}" + userPassword: "{{ kadmin_service_pwd }}" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" when: not krb5kdc.stat.exists @@ -109,17 +112,17 @@ when: not krb5kdc.stat.exists - name: prepare password for kdc - shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile + shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists - name: prepare password for kadmin - shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_pwd }} | xxd -g0 -ps | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile + shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists - name: dump kdc master password - shell: echo -n "{{ kdc_master_pwd }}" > "{{ kdc_pwd_file }}" ; chmod 0600 "{{ kdc_pwd_file }}" + shell: echo -n "{{ kdc_master_pwd }}" > "{{ kdc_master_pwd_file }}" ; chmod 0600 "{{ kdc_master_pwd_file }}" no_log: true when: not krb5kdc.stat.exists @@ -137,18 +140,35 @@ notify: "restart krb5-kdc" when: not krb5kdc.stat.exists +- name: add root/admin as kadmin + command: kadmin.local -q "addprinc -pw {{ kadmin_pwd }} root/admin" + when: not krb5kdc.stat.exists + +- name: dump kadmin password + shell: echo -n "{{ kadmin_pwd }}" > "{{ kadmin_pwd_file }}" ; chmod 0600 "{{ kadmin_pwd_file }}" + no_log: true + when: not krb5kdc.stat.exists + - name: add default policy to silence warning when using kadmin command: kadmin.local -q "add_policy default" when: not krb5kdc.stat.exists -- name: create machine principal - command: kadmin.local -q "addprinc -randkey host/{{ ansible_hostname }}.{{ ldap_domain }}" +- name: create machine principals + command: kadmin.local -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ldap_domain }}" + with_items: + - host + - ldap when: not krb5kdc.stat.exists - name: add principal to the keytab - command: kadmin.local -q "ktadd host/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin.local -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ldap_domain }}" + with_items: + - host + - ldap when: not krb5kdc.stat.exists +############## + - name: kerberize dummy user foo command: kadmin.local -q 'add_principal -pw {{ foo_pwd }} -x dn="uid=foo,ou=people,{{ basedn }}" foo' when: foo_pwd is defined diff --git a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 index c21d6b8..1ddf3ff 100644 --- a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 +++ b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 @@ -1,3 +1,4 @@ ## access controls for the Kerberos KDC +root/admin@{{ ldap_domain | upper }} * *@{{ ldap_domain | upper }} cil */*@{{ ldap_domain | upper }} i diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index 8c16cfc..e3df005 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -2,3 +2,4 @@ ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd length=24') }}" ldap_pwd_file: "/root/ldap-admin.pwd" ldap_domain: "{{ ansible_domain | default('intern', true) }}" basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +lan_homes: /home/lan diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 6b4a5d2..7d7eb84 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -37,11 +37,13 @@ no_log: true when: not slapd.stat.exists -- name: install slapd and python-ldap +- name: install slapd, ldap-utils, ldapvi and python3-ldap apt: name: - slapd - - python-ldap + - ldap-utils + - ldapvi + - python3-ldap state: latest - name: make initial slapd configuration available @@ -90,7 +92,7 @@ userPassword: "{{ foo_pwd }}" uidNumber: 10000 gidNumber: 10000 - homeDirectory: /home/lan/foo + homeDirectory: "{{ lan_homes }}/foo" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" when: foo_pwd is defined diff --git a/roles/nfs-server/defaults/main.yml b/roles/nfs-server/defaults/main.yml index 08061b3..294950c 100644 --- a/roles/nfs-server/defaults/main.yml +++ b/roles/nfs-server/defaults/main.yml @@ -1,4 +1,4 @@ export_root: /srv/nfs4 -export_dir: /home/lan +lan_homes: /home/lan ldap_domain: "{{ ansible_domain | default('intern', true) }}" basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 5b6a28a..d9ea5a3 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -14,12 +14,12 @@ file: path={{ export_root }}/home/ state=directory recurse=yes - name: make sure the export exists - file: path={{ export_dir }} state=directory recurse=yes + file: path={{ lan_homes }} state=directory recurse=yes - name: bind mount exported dir mount: path: "{{ export_root }}/home/" - src: "{{ export_dir }}" + src: "{{ lan_homes }}" fstype: none state: mounted opts: bind @@ -40,11 +40,11 @@ register: kadmin - name: create machine principal - command: kadmin.local -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + command: kadmin.local -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ldap_domain }}" when: kadmin.stat.exists and not exports.stat.exists - name: add principal to the keytab - command: kadmin.local -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + command: kadmin.local -q "ktadd nfs/{{ ansible_hostname }}.{{ ldap_domain }}" notify: "restart rpc-svcgssd" when: kadmin.stat.exists and not exports.stat.exists From bbcf45bbebfbcf95fe04327643e5277d4497e488 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 18 Nov 2019 18:45:07 +0100 Subject: [PATCH 041/504] Implement basic LAN client. --- minimal-krb5.yml | 10 ++++ roles/lan-client/defaults/main.yml | 6 +++ roles/lan-client/handlers/main.yml | 14 ++++++ roles/lan-client/tasks/main.yml | 63 +++++++++++++++++++++++++ roles/lan-client/templates/sssd.conf.j2 | 24 ++++++++++ roles/ldap/tasks/main.yml | 1 + roles/nfs-server/tasks/main.yml | 10 +++- 7 files changed, 126 insertions(+), 2 deletions(-) create mode 100644 minimal-krb5.yml create mode 100644 roles/lan-client/defaults/main.yml create mode 100644 roles/lan-client/handlers/main.yml create mode 100644 roles/lan-client/tasks/main.yml create mode 100644 roles/lan-client/templates/sssd.conf.j2 diff --git a/minimal-krb5.yml b/minimal-krb5.yml new file mode 100644 index 0000000..ebba3a2 --- /dev/null +++ b/minimal-krb5.yml @@ -0,0 +1,10 @@ +--- +# This playbook does almost nothing. Useful for testing only preseeding. + +- name: apply a minimal configuration with kerberos LAN integration + hosts: all + remote_user: ansible + become: yes + roles: + - up2date-debian + - lan-client diff --git a/roles/lan-client/defaults/main.yml b/roles/lan-client/defaults/main.yml new file mode 100644 index 0000000..b52918d --- /dev/null +++ b/roles/lan-client/defaults/main.yml @@ -0,0 +1,6 @@ +lan_homes: /home/lan +ldap_domain: "{{ ansible_domain | default('intern', true) }}" +basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +ldap_server: ldap +krb_server: kerberos +nfs_server: nfs diff --git a/roles/lan-client/handlers/main.yml b/roles/lan-client/handlers/main.yml new file mode 100644 index 0000000..ec16fb7 --- /dev/null +++ b/roles/lan-client/handlers/main.yml @@ -0,0 +1,14 @@ +- name: restart sssd + service: name=sssd state=restarted enabled=yes + listen: "restart sssd" + +- name: reload systemd + systemd: + daemon_reload: yes + listen: "reload systemd" + +- name: restart rpc-gssd + systemd: + name: rpc-gssd + state: restarted + notify: "restart rpc-gssd" diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml new file mode 100644 index 0000000..1008bb7 --- /dev/null +++ b/roles/lan-client/tasks/main.yml @@ -0,0 +1,63 @@ +--- +- name: preseed krb5-config realm + debconf: + name: krb5-config + question: krb5-config/default_realm + value: "{{ ldap_domain | upper }}" + vtype: string + +- name: preseed krb5-config kerberos servers + debconf: + name: krb5-config + question: krb5-config/kerberos_servers + value: "{{ krb_server }}" + vtype: string + +- name: preseed krb5-config admin server + debconf: + name: krb5-config + question: krb5-config/admin_server + value: "{{ krb_server }}" + vtype: string + +- name: install needed packages + apt: + name: + - krb5-config + - krb5-user + - sssd-krb5 + - sssd-ldap + - nfs-common + state: latest + +- name: provide identities from directory + template: + src: sssd.conf.j2 + dest: /etc/sssd/sssd.conf + mode: 0600 + notify: restart sssd + +- name: make sure the home mount directory exists + file: path={{ lan_homes }} state=directory recurse=yes + + +## Activate machine after installation: +- name: create machine principal + command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ldap_domain }}" + no_log: true + when: not run_in_installer|default(false)|bool + +- name: add principal to keytab + command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "ktadd nfs/{{ ansible_hostname }}.{{ ldap_domain }}" + args: + creates: /etc/krb5.keytab + no_log: true + notify: "restart rpc-gssd" + when: not run_in_installer|default(false)|bool + +- name: automount + lineinfile: + dest: /etc/fstab + line: "{{ nfs_server}}:/home {{ lan_homes }} nfs4 sec=krb5p,_netdev,noauto,x-systemd.automount,x-systemd.idle-timeout=60 0 0" + notify: reload systemd + when: not run_in_installer|default(false)|bool diff --git a/roles/lan-client/templates/sssd.conf.j2 b/roles/lan-client/templates/sssd.conf.j2 new file mode 100644 index 0000000..4b5b285 --- /dev/null +++ b/roles/lan-client/templates/sssd.conf.j2 @@ -0,0 +1,24 @@ +[sssd] +domains = LDAP +services = nss, pam +config_file_version = 2 + +[nss] +filter_groups = root +filter_users = root + +[pam] + +[domain/LDAP] +id_provider = ldap +ldap_uri = ldap://{{ ldap_server }}/ +ldap_search_base = {{ basedn }} + +auth_provider = krb5 +krb5_server = {{ krb_server }} +krb5_realm = {{ ldap_domain | upper }} +cache_credentials = true + +min_id = 10000 +max_id = 20000 +enumerate = False diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 7d7eb84..36ca050 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -93,6 +93,7 @@ uidNumber: 10000 gidNumber: 10000 homeDirectory: "{{ lan_homes }}/foo" + loginShell: /bin/bash bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" when: foo_pwd is defined diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index d9ea5a3..3cb2f7f 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -29,8 +29,8 @@ dest: /etc/exports insertbefore: EOF block: | - {{ export_root }} *(sec=krb5p:krb5i:krb5:sys,rw,fsid=0,crossmnt,no_subtree_check) - {{ export_root }}/home/ *(sec=krb5p:krb5i,rw,no_subtree_check) + {{ export_root }} *(sec=krb5p,rw,fsid=0,crossmnt,no_subtree_check) + {{ export_root }}/home/ *(sec=krb5p,rw,no_subtree_check) notify: "restart nfs-kernel-server" @@ -63,3 +63,9 @@ mode: 0600 notify: restart sssd when: kadmin.stat.exists + +- name: copy home from /etc/skel for dummy user foo + shell: cp -r /etc/skel {{ lan_homes }}/foo && chmod -R o-rwx {{ lan_homes }}/foo && chown -R foo:foo {{ lan_homes }}/foo + args: + creates: "{{ lan_homes }}/foo" + when: foo_pwd is defined From ed8b7a7fa659d76b3af0c1f5c723efd3157a5337 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 21 Nov 2019 15:47:08 +0100 Subject: [PATCH 042/504] Use ansible_domain everywhere and bail out if it is empty. --- roles/krb5-kdc-ldap/tasks/main.yml | 8 +++++--- roles/krb5-kdc-ldap/templates/kadm5.acl.j2 | 6 +++--- roles/krb5-kdc-ldap/templates/kdc.conf.j2 | 2 +- roles/krb5-kdc-ldap/templates/krb5.conf.j2 | 8 ++++---- roles/lan-client/defaults/main.yml | 3 +-- roles/lan-client/tasks/main.yml | 9 ++++++--- roles/lan-client/templates/sssd.conf.j2 | 2 +- roles/ldap/defaults/main.yml | 3 +-- roles/ldap/tasks/main.yml | 4 +++- roles/nfs-server/defaults/main.yml | 3 +-- roles/nfs-server/tasks/main.yml | 7 +++++-- roles/nfs-server/templates/sssd.conf.j2 | 2 +- 12 files changed, 32 insertions(+), 25 deletions(-) diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index f306e5f..1de5dc5 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -1,6 +1,8 @@ ## Install and configure krb5-kdc-ldap (if not done yet), ## run most tasks only on krb5-kdc-ldap installation. --- +- fail: msg="The machine's domain must not be empty." + when: ansible_domain | length == 0 - name: check if slapd is already there stat: path=/usr/sbin/krb5kdc @@ -135,7 +137,7 @@ -H ldapi:/// create -s -subtrees "{{ basedn }}" -P "{{ kdc_master_pwd }}" - -r "{{ ldap_domain | upper }}" + -r "{{ ansible_domain | upper }}" no_log: true notify: "restart krb5-kdc" when: not krb5kdc.stat.exists @@ -154,14 +156,14 @@ when: not krb5kdc.stat.exists - name: create machine principals - command: kadmin.local -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin.local -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}" with_items: - host - ldap when: not krb5kdc.stat.exists - name: add principal to the keytab - command: kadmin.local -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin.local -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}" with_items: - host - ldap diff --git a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 index 1ddf3ff..54c6636 100644 --- a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 +++ b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 @@ -1,4 +1,4 @@ ## access controls for the Kerberos KDC -root/admin@{{ ldap_domain | upper }} * -*@{{ ldap_domain | upper }} cil -*/*@{{ ldap_domain | upper }} i +root/admin@{{ ansible_domain | upper }} * +*@{{ ansible_domain | upper }} cil +*/*@{{ ansible_domain | upper }} i diff --git a/roles/krb5-kdc-ldap/templates/kdc.conf.j2 b/roles/krb5-kdc-ldap/templates/kdc.conf.j2 index 477c9ba..7a64706 100644 --- a/roles/krb5-kdc-ldap/templates/kdc.conf.j2 +++ b/roles/krb5-kdc-ldap/templates/kdc.conf.j2 @@ -2,7 +2,7 @@ kdc_ports = 750,88 [realms] - {{ ldap_domain | upper }} = { + {{ ansible_domain | upper }} = { admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab acl_file = /etc/krb5kdc/kadm5.acl key_stash_file = /etc/krb5kdc/stash diff --git a/roles/krb5-kdc-ldap/templates/krb5.conf.j2 b/roles/krb5-kdc-ldap/templates/krb5.conf.j2 index 8f231cb..11d3cf2 100644 --- a/roles/krb5-kdc-ldap/templates/krb5.conf.j2 +++ b/roles/krb5-kdc-ldap/templates/krb5.conf.j2 @@ -1,16 +1,16 @@ [libdefaults] - default_realm = {{ ldap_domain | upper }} + default_realm = {{ ansible_domain | upper }} [realms] - {{ ldap_domain | upper }} = { + {{ ansible_domain | upper }} = { kdc = {{ ansible_hostname }} admin_server = {{ ansible_hostname }} database_module = LDAP } [domain_realm] - .{{ ldap_domain }} = {{ ldap_domain | upper }} - {{ ldap_domain }} = {{ ldap_domain | upper }} + .{{ ansible_domain }} = {{ ansible_domain | upper }} + {{ ansible_domain }} = {{ ansible_domain | upper }} [dbdefaults] ldap_kerberos_container_dn = cn=kerberos,{{ basedn }} diff --git a/roles/lan-client/defaults/main.yml b/roles/lan-client/defaults/main.yml index b52918d..7c62cce 100644 --- a/roles/lan-client/defaults/main.yml +++ b/roles/lan-client/defaults/main.yml @@ -1,6 +1,5 @@ lan_homes: /home/lan -ldap_domain: "{{ ansible_domain | default('intern', true) }}" -basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" ldap_server: ldap krb_server: kerberos nfs_server: nfs diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index 1008bb7..74362a1 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -1,9 +1,12 @@ --- +- fail: msg="The machine's domain must not be empty." + when: ansible_domain | length == 0 + - name: preseed krb5-config realm debconf: name: krb5-config question: krb5-config/default_realm - value: "{{ ldap_domain | upper }}" + value: "{{ ansible_domain | upper }}" vtype: string - name: preseed krb5-config kerberos servers @@ -43,12 +46,12 @@ ## Activate machine after installation: - name: create machine principal - command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" no_log: true when: not run_in_installer|default(false)|bool - name: add principal to keytab - command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "ktadd nfs/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" args: creates: /etc/krb5.keytab no_log: true diff --git a/roles/lan-client/templates/sssd.conf.j2 b/roles/lan-client/templates/sssd.conf.j2 index 4b5b285..d55c2c7 100644 --- a/roles/lan-client/templates/sssd.conf.j2 +++ b/roles/lan-client/templates/sssd.conf.j2 @@ -16,7 +16,7 @@ ldap_search_base = {{ basedn }} auth_provider = krb5 krb5_server = {{ krb_server }} -krb5_realm = {{ ldap_domain | upper }} +krb5_realm = {{ ansible_domain | upper }} cache_credentials = true min_id = 10000 diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index e3df005..c84b93e 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -1,5 +1,4 @@ ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd length=24') }}" ldap_pwd_file: "/root/ldap-admin.pwd" -ldap_domain: "{{ ansible_domain | default('intern', true) }}" -basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" lan_homes: /home/lan diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 36ca050..de33367 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -1,6 +1,8 @@ ## Install and configure slapd (if not done yet), ## run most tasks only on slapd installation. --- +- fail: msg="The machine's domain must not be empty." + when: ansible_domain | length == 0 - name: check if slapd is already there stat: path=/usr/sbin/slapd @@ -10,7 +12,7 @@ debconf: name: slapd question: slapd/domain - value: "{{ ldap_domain }}" + value: "{{ ansible_domain }}" vtype: string when: not slapd.stat.exists diff --git a/roles/nfs-server/defaults/main.yml b/roles/nfs-server/defaults/main.yml index 294950c..49adf7c 100644 --- a/roles/nfs-server/defaults/main.yml +++ b/roles/nfs-server/defaults/main.yml @@ -1,4 +1,3 @@ export_root: /srv/nfs4 lan_homes: /home/lan -ldap_domain: "{{ ansible_domain | default('intern', true) }}" -basedn: "{{ 'dc=' + ( ldap_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 3cb2f7f..4eb52c0 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -1,5 +1,8 @@ ## Install and configure nfs-server --- +- fail: msg="The machine's domain must not be empty." + when: ansible_domain | length == 0 + - name: check if there are installing stat: path=/etc/exports register: exports @@ -40,11 +43,11 @@ register: kadmin - name: create machine principal - command: kadmin.local -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin.local -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" when: kadmin.stat.exists and not exports.stat.exists - name: add principal to the keytab - command: kadmin.local -q "ktadd nfs/{{ ansible_hostname }}.{{ ldap_domain }}" + command: kadmin.local -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" notify: "restart rpc-svcgssd" when: kadmin.stat.exists and not exports.stat.exists diff --git a/roles/nfs-server/templates/sssd.conf.j2 b/roles/nfs-server/templates/sssd.conf.j2 index 0cea9c5..54868d2 100644 --- a/roles/nfs-server/templates/sssd.conf.j2 +++ b/roles/nfs-server/templates/sssd.conf.j2 @@ -16,7 +16,7 @@ ldap_search_base = {{ basedn }} auth_provider = krb5 krb5_server = {{ ansible_hostname }} -krb5_realm = {{ ldap_domain | upper }} +krb5_realm = {{ ansible_domain | upper }} cache_credentials = false min_id = 10000 From 5d5f75e0c82157504d581e17422b8b19d0d20cb4 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 21 Nov 2019 17:19:28 +0100 Subject: [PATCH 043/504] Do not preseed desktop environment, leave this to the ansible role. --- roles/installbox2kiosk/tasks/main.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml index 0da71cf..6fe4f00 100644 --- a/roles/installbox2kiosk/tasks/main.yml +++ b/roles/installbox2kiosk/tasks/main.yml @@ -26,12 +26,6 @@ regexp: '^#(apt-setup-udeb.*)$' replace: '\1' -- name: preseed client - add gnome-desktop, print-server - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(tasksel tasksel/first multiselect standard, ssh-server)$' - replace: '#\1\ntasksel tasksel/first multiselect standard, ssh-server, gnome-desktop, print-server' - - name: preseed client - add firmware-linux, ansible and git replace: dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" From fbf48f44f3f711fc5bc15aeddba0a8e564736600 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 21 Nov 2019 19:15:22 +0100 Subject: [PATCH 044/504] Fixes and improvements, NFS/KDC/LDAP related. --- kerberox-client.yml | 26 +++++++++++ kerberox.yml | 46 +++++++++++++++++++ mainserver.yml | 14 ------ roles/kde/tasks/main.yml | 1 + roles/krb5-kdc-ldap/tasks/main.yml | 21 +++++---- roles/lan-client/tasks/main.yml | 12 +++-- roles/ldap/defaults/main.yml | 2 +- roles/ldap/tasks/main.yml | 13 ++++-- roles/nfs-server/handlers/main.yml | 13 ++++++ roles/nfs-server/tasks/main.yml | 30 ++++++------ .../nfs-server/templates/dhcp-send-domain.j2 | 2 + 11 files changed, 134 insertions(+), 46 deletions(-) create mode 100644 kerberox-client.yml create mode 100644 kerberox.yml delete mode 100644 mainserver.yml create mode 100644 roles/nfs-server/templates/dhcp-send-domain.j2 diff --git a/kerberox-client.yml b/kerberox-client.yml new file mode 100644 index 0000000..4861857 --- /dev/null +++ b/kerberox-client.yml @@ -0,0 +1,26 @@ +--- +# This playbook deploys a client for the kerberox LAN. + +- name: apply configuration to the machines + hosts: all + remote_user: ansible + become: yes + vars: + deb_release: "buster" + extra_pkgs: + - webext-privacy-badger + - webext-ublock-origin + - krb5-auth-dialog + extra_pkgs_bpo: [] # [ libreoffice ] + + vars_prompt: + - name: "kadmin_pwd" + prompt: "Provide kadmin password to fetch kerberos keytab.\nLeave empty if done already" + private: yes + + roles: + - up2date-debian + - lan-client + ## Choose either gnome or KDE: + - gnome + #- kde diff --git a/kerberox.yml b/kerberox.yml new file mode 100644 index 0000000..e7eff0e --- /dev/null +++ b/kerberox.yml @@ -0,0 +1,46 @@ +--- +# This playbook deploys the kerberox server. + +- name: apply configuration to the installbox + hosts: all + remote_user: ansible + become: yes + vars: + ## This interface provides the default route: + if_wan: "{{ ansible_default_ipv4.interface }}" + ## Use the first remaining interface for the LAN: + if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" + ## Add 'hostname=XXX' to the installer boot parameters if necessary: + hostname: "{{ ansible_hostname }}" + ipaddr_lan: 192.168.0.10 + dhcp_range: 192.168.0.50,192.168.0.150,2h + dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" + tftp_root: "/var/lib/tftpboot" + deb_mirror: "deb.debian.org" + di_dist: "buster" + di_version: "10" + di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" + ansible_user: ansible + repo_dir: "/home/{{ ansible_user }}/debian-lan" + ansible_python_interpreter: "/usr/bin/python3" ## needed for firewalld module + + vars_prompt: + - name: "foo_pwd" + prompt: "Provide a non-empty password for the test user 'foo'.\nLeave empty to continue without test user" + private: yes + + pre_tasks: + - name: validate if interfaces are available + fail: + msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." + when: (if_lan not in ansible_interfaces) or (if_wan not in ansible_interfaces) or (if_lan == if_wan) + + roles: + - up2date-debian + - two-interface-firewalld + - dhcp-dns-dnsmasq + - tftp-netboot-installer + - preseed-installer + - apt-cacher + - krb5-kdc-ldap + - nfs-server diff --git a/mainserver.yml b/mainserver.yml deleted file mode 100644 index a97a47b..0000000 --- a/mainserver.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -# This playbook deploys the mainserver - -- name: apply configuration to the mainserver - hosts: all - remote_user: andi - become: yes - vars: - foo_pwd: 123 - - roles: -# - ldap - - krb5-kdc-ldap - diff --git a/roles/kde/tasks/main.yml b/roles/kde/tasks/main.yml index 847da41..74f7e1f 100644 --- a/roles/kde/tasks/main.yml +++ b/roles/kde/tasks/main.yml @@ -2,6 +2,7 @@ apt: name: - task-kde-desktop + - sddm-theme-debian-breeze - cups state: latest diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 1de5dc5..5252dc1 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -2,7 +2,7 @@ ## run most tasks only on krb5-kdc-ldap installation. --- - fail: msg="The machine's domain must not be empty." - when: ansible_domain | length == 0 + when: ansible_domain | length == 0 - name: check if slapd is already there stat: path=/usr/sbin/krb5kdc @@ -142,35 +142,38 @@ notify: "restart krb5-kdc" when: not krb5kdc.stat.exists -- name: add root/admin as kadmin - command: kadmin.local -q "addprinc -pw {{ kadmin_pwd }} root/admin" +- name: add root/admin as kadmin + command: kadmin.local -q 'addprinc -pw "{{ kadmin_pwd }}" root/admin' when: not krb5kdc.stat.exists - name: dump kadmin password shell: echo -n "{{ kadmin_pwd }}" > "{{ kadmin_pwd_file }}" ; chmod 0600 "{{ kadmin_pwd_file }}" no_log: true when: not krb5kdc.stat.exists - + - name: add default policy to silence warning when using kadmin command: kadmin.local -q "add_policy default" when: not krb5kdc.stat.exists - name: create machine principals - command: kadmin.local -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}" + command: kadmin.local -q 'addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' with_items: - host - ldap when: not krb5kdc.stat.exists - name: add principal to the keytab - command: kadmin.local -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}" + command: kadmin.local -q 'ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' with_items: - host - ldap when: not krb5kdc.stat.exists ############## - + - name: kerberize dummy user foo - command: kadmin.local -q 'add_principal -pw {{ foo_pwd }} -x dn="uid=foo,ou=people,{{ basedn }}" foo' - when: foo_pwd is defined + command: kadmin.local -q 'add_principal -pw "{{ foo_pwd }}" -x dn="uid=foo,ou=people,{{ basedn }}" foo' + register: kerberize_result + changed_when: kerberize_result.stderr is not search('already exists while creating') + no_log: true + when: foo_pwd is defined and foo_pwd | length > 0 diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index 74362a1..f86861b 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -33,6 +33,8 @@ - nfs-common state: latest +## oddjob-mkhomedir works only with sec=sys for the NFSv4 share + - name: provide identities from directory template: src: sssd.conf.j2 @@ -46,17 +48,19 @@ ## Activate machine after installation: - name: create machine principal - command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + command: kadmin -p root/admin -w {{ kadmin_pwd }} -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + register: kerberize_result + changed_when: kerberize_result.stderr is not search('already exists while creating') no_log: true - when: not run_in_installer|default(false)|bool + when: not run_in_installer|default(false)|bool and kadmin_pwd | length > 0 - name: add principal to keytab - command: kadmin -p root/admin -w {{ lookup('password', '/root/kadmin.pwd') }} -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" + command: kadmin -p root/admin -w {{ kadmin_pwd }} -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" args: creates: /etc/krb5.keytab no_log: true notify: "restart rpc-gssd" - when: not run_in_installer|default(false)|bool + when: not run_in_installer|default(false)|bool and kadmin_pwd | length > 0 - name: automount lineinfile: diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index c84b93e..141c21f 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -1,4 +1,4 @@ ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd length=24') }}" -ldap_pwd_file: "/root/ldap-admin.pwd" +ldap_admin_pwd_file: "/root/ldap-admin.pwd" basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" lan_homes: /home/lan diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index de33367..6f290d3 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -2,7 +2,7 @@ ## run most tasks only on slapd installation. --- - fail: msg="The machine's domain must not be empty." - when: ansible_domain | length == 0 + when: ansible_domain | length == 0 - name: check if slapd is already there stat: path=/usr/sbin/slapd @@ -35,7 +35,7 @@ when: not slapd.stat.exists - name: dump admin password - shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_pwd_file }}" ; chmod 0600 "{{ ldap_pwd_file }}" + shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}" no_log: true when: not slapd.stat.exists @@ -80,6 +80,11 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" +- name: provide simple script to add/delete users + template: + src: debian-lan.j2 + dest: /usr/local/sbin/debian-lan + mode: 0744 ## Add user - name: add dummy user foo @@ -98,7 +103,7 @@ loginShell: /bin/bash bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" - when: foo_pwd is defined + when: foo_pwd is defined and foo_pwd | length > 0 - name: add dummy group foo ldap_entry: @@ -109,7 +114,7 @@ gidNumber: 10000 bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" - when: foo_pwd is defined + when: foo_pwd is defined and foo_pwd | length > 0 ## ldapaddgroup tom ## ldapadduser tom tom diff --git a/roles/nfs-server/handlers/main.yml b/roles/nfs-server/handlers/main.yml index bc2c23b..224f948 100644 --- a/roles/nfs-server/handlers/main.yml +++ b/roles/nfs-server/handlers/main.yml @@ -1,3 +1,12 @@ +- name: bind mount exported dir + mount: + path: "{{ export_root }}/home/" + src: "{{ lan_homes }}" + fstype: none + state: mounted + opts: bind + listen: "bind mount exported dirs" + - name: restart nfs-kernel-server service: name=nfs-kernel-server state=restarted enabled=yes listen: "restart nfs-kernel-server" @@ -9,3 +18,7 @@ - name: restart sssd service: name=sssd state=restarted enabled=yes listen: "restart sssd" + +- name: restart dnsmasq + service: name=dnsmasq state=restarted enabled=yes + listen: "restart dnsmasq" diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 4eb52c0..aede26c 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -1,7 +1,7 @@ ## Install and configure nfs-server --- - fail: msg="The machine's domain must not be empty." - when: ansible_domain | length == 0 + when: ansible_domain | length == 0 - name: check if there are installing stat: path=/etc/exports @@ -13,19 +13,12 @@ - nfs-kernel-server state: latest -- name: make sure the export exists +- name: make sure the export paths exists file: path={{ export_root }}/home/ state=directory recurse=yes -- name: make sure the export exists +- name: make sure the lan homes exists file: path={{ lan_homes }} state=directory recurse=yes - -- name: bind mount exported dir - mount: - path: "{{ export_root }}/home/" - src: "{{ lan_homes }}" - fstype: none - state: mounted - opts: bind + notify: "bind mount exported dirs" - name: configure exports blockinfile: @@ -36,8 +29,6 @@ {{ export_root }}/home/ *(sec=krb5p,rw,no_subtree_check) notify: "restart nfs-kernel-server" - - - name: check if there is a local kadmin stat: path=/usr/sbin/kadmin.local register: kadmin @@ -71,4 +62,15 @@ shell: cp -r /etc/skel {{ lan_homes }}/foo && chmod -R o-rwx {{ lan_homes }}/foo && chown -R foo:foo {{ lan_homes }}/foo args: creates: "{{ lan_homes }}/foo" - when: foo_pwd is defined + when: foo_pwd is defined and foo_pwd | length > 0 + +- name: check if our dnsmasq is used + stat: path=/etc/dnsmasq.d/dnsmasq-dhcp + register: dnsmasq + +- name: send domain to clients + template: + src: dhcp-send-domain.j2 + dest: /etc/dnsmasq.d/dhcp-send-domain + notify: "restart dnsmasq" + when: dnsmasq.stat.exists diff --git a/roles/nfs-server/templates/dhcp-send-domain.j2 b/roles/nfs-server/templates/dhcp-send-domain.j2 new file mode 100644 index 0000000..6933a9e --- /dev/null +++ b/roles/nfs-server/templates/dhcp-send-domain.j2 @@ -0,0 +1,2 @@ +expand-hosts +domain={{ ansible_domain }} From f158d8cae15e283ac339fb3c726d0541fab8f55b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 23 Nov 2019 18:01:24 +0100 Subject: [PATCH 045/504] Add simple script to add/delete users and their group. --- roles/ldap/templates/debian-lan.j2 | 140 +++++++++++++++++++++++++++++ roles/nfs-server/tasks/main.yml | 1 + 2 files changed, 141 insertions(+) create mode 100644 roles/ldap/templates/debian-lan.j2 diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 new file mode 100644 index 0000000..e17404f --- /dev/null +++ b/roles/ldap/templates/debian-lan.j2 @@ -0,0 +1,140 @@ +#!/bin/bash +# +# A simple script to add users and their group to ldap, as well as a kerberos principal. +# + +set -eu + +usage(){ + cat < [] [] + $(basename $0) deluser + + : User ID (login name) + : Password + , : LDAP attributes, if omitted, is used. + +EOF +} + +#sss_cache -U -G ## should not be necessary + +if [ $# -lt 2 ] ; then + usage + exit 1 +elif [ $1 = adduser -a $# -lt 3 ] ; then + echo "Error: Password missing." + usage + exit 1 +fi + +MINID=10000 +MAXID=20000 +BASEDN="{{ basedn }}" +HOMES="{{ lan_homes }}" +LDAPADMIN="cn=admin,$BASEDN" +ADPASSWD="$(cat {{ ldap_admin_pwd_file }})" + +COMMAND="$1" +uid="$2" +pw="${3:-""}" +cn="${4:-$2}" +sn="${5:-$2}" + +if [ -x /usr/sbin/kadmin.local ] ; then + KRB5=true + pwEntry="" +else + KRB5=false + pwEntry="userPassword: $pw" +fi + +############# + + +nextnum(){ + local num + num="$(( $(ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=people,$BASEDN" -S $1 $1 2>/dev/null \ + | tail -n -2 | grep -oE "[[:digit:]]+$") + 1 ))" + if [ $num -lt $MINID ] ; then + echo $MINID + else + echo "$num" + fi +} + +add-user(){ + uidNumber=$(nextnum uidNumber) + gidNumber=$(nextnum gidNumber) + + if [ $uidNumber -ge $MAXID -o $gidNumber -ge $MAXID ] ; then + echo "Error: $uidNumber and/or $gidNumber exceed max ID number ${MAXID}." + exit 1 + fi + + cat <&1 \ + | sed '/ldap_initialize/d' + + if [ -d ${HOMES}/${uid} ] ; then + KEEPDIR="${HOMES}/rm_$(date '+%Y%m%d')_${uid}" + mv ${HOMES}/${uid} "${KEEPDIR}" + chown -R root:root "${KEEPDIR}" + ls -ld "$KEEPDIR" + fi +} + +############################## +########### main ############# +############################## + +case $COMMAND in + adduser) + add-user + ;; + deluser) + del-user + ;; + *) + usage + ;; +esac diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index aede26c..31c9036 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -47,6 +47,7 @@ name: - sssd-krb5 - sssd-ldap + - sssd-tools ## sss_cache -U -G state: latest when: kadmin.stat.exists From ea36c9beaf86aa444365c3b0a4ff1d77abe44fca Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 24 Nov 2019 19:44:01 +0100 Subject: [PATCH 046/504] Use provided ansible variable to determine debian release. --- kerberox-client.yml | 1 - kerberox.yml | 4 ++-- kiosk.yml | 1 - roles/kiosk/tasks/main.yml | 6 +++--- roles/lan-client/tasks/main.yml | 18 ++++++++++++++++-- 5 files changed, 21 insertions(+), 9 deletions(-) diff --git a/kerberox-client.yml b/kerberox-client.yml index 4861857..3170e0e 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -6,7 +6,6 @@ remote_user: ansible become: yes vars: - deb_release: "buster" extra_pkgs: - webext-privacy-badger - webext-ublock-origin diff --git a/kerberox.yml b/kerberox.yml index e7eff0e..1c34282 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -17,8 +17,8 @@ dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" tftp_root: "/var/lib/tftpboot" deb_mirror: "deb.debian.org" - di_dist: "buster" - di_version: "10" + di_dist: "{{ ansible_distribution_release }}" + di_version: "{{ ansible_distribution_version }}" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" ansible_user: ansible repo_dir: "/home/{{ ansible_user }}/debian-lan" diff --git a/kiosk.yml b/kiosk.yml index e3e89a5..b68bbb7 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -6,7 +6,6 @@ remote_user: ansible become: yes vars: - deb_release: "buster" auto_user: debi wifi_ssid: "YOUR SSID HERE" wifi_passwd: "YOUR WIFI-PW HERE" diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index ae75af1..93aaea8 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -1,15 +1,15 @@ - name: install extra packages from stable apt: name={{ extra_pkgs }} state=latest -- name: add {{ deb_release }}-backports +- name: add {{ ansible_distribution_release }}-backports apt_repository: - repo: deb http://deb.debian.org/debian/ {{ deb_release }}-backports main + repo: deb http://deb.debian.org/debian/ {{ ansible_distribution_release }}-backports main state: present update_cache: yes when: extra_pkgs_bpo|length - name: install extra packages from backports - apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ deb_release }}-backports + apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ ansible_distribution_release }}-backports when: extra_pkgs_bpo|length ## Check which display manager is used: diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index f86861b..d779d09 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -1,6 +1,6 @@ --- - fail: msg="The machine's domain must not be empty." - when: ansible_domain | length == 0 + when: ansible_domain | length == 0 - name: preseed krb5-config realm debconf: @@ -34,7 +34,21 @@ state: latest ## oddjob-mkhomedir works only with sec=sys for the NFSv4 share - + +- name: install extra packages from stable + apt: name={{ extra_pkgs }} state=latest + +- name: add {{ ansible_distribution_release }}-backports + apt_repository: + repo: deb http://deb.debian.org/debian/ {{ ansible_distribution_release }}-backports main + state: present + update_cache: yes + when: extra_pkgs_bpo|length + +- name: install extra packages from backports + apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ ansible_distribution_release }}-backports + when: extra_pkgs_bpo|length + - name: provide identities from directory template: src: sssd.conf.j2 From a0ee0fd90d3712ae2bdd10f65e2631f0bff08342 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 24 Nov 2019 20:53:54 +0100 Subject: [PATCH 047/504] Add firewalld rules to service roles. --- roles/krb5-kdc-ldap/tasks/main.yml | 24 ++++++++++++++++++++ roles/ldap/tasks/main.yml | 17 ++++++++++++-- roles/nfs-server/tasks/main.yml | 16 +++++++++++++ roles/two-interface-firewalld/tasks/main.yml | 7 +++++- 4 files changed, 61 insertions(+), 3 deletions(-) diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 5252dc1..fc27565 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -177,3 +177,27 @@ changed_when: kerberize_result.stderr is not search('already exists while creating') no_log: true when: foo_pwd is defined and foo_pwd | length > 0 + +############################# + +- name: allow services in firewalld + firewalld: + zone: internal + service: "{{ item }}" + permanent: yes + state: enabled + with_items: + - kerberos + - kadmin + - kpasswd + when: not run_in_installer|default(false)|bool + +## Use firewall-offline-cmd when run during installation: + +- name: allow services in firewalld + command: >- + firewall-offline-cmd --zone=internal + --add-service=kerberos + --add-service=kadmin + --add-service=kpasswd + when: run_in_installer|default(false)|bool diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 6f290d3..c8564d4 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -116,5 +116,18 @@ bind_pw: "{{ ldap_admin_pwd }}" when: foo_pwd is defined and foo_pwd | length > 0 -## ldapaddgroup tom -## ldapadduser tom tom +############################# + +- name: allow ldap service in firewalld + firewalld: + zone: internal + service: ldap + permanent: yes + state: enabled + when: not run_in_installer|default(false)|bool + +## Use firewall-offline-cmd when run during installation: + +- name: allow ldap service in firewalld + command: "firewall-offline-cmd --zone=internal --add-service=ldap" + when: run_in_installer|default(false)|bool diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 31c9036..2f5448f 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -75,3 +75,19 @@ dest: /etc/dnsmasq.d/dhcp-send-domain notify: "restart dnsmasq" when: dnsmasq.stat.exists + +############################# + +- name: allow nfs service in firewalld + firewalld: + zone: internal + service: nfs + permanent: yes + state: enabled + when: not run_in_installer|default(false)|bool + +## Use firewall-offline-cmd when run during installation: + +- name: allow nfs service in firewalld + command: "firewall-offline-cmd --zone=internal --add-service=nfs" + when: run_in_installer|default(false)|bool diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/two-interface-firewalld/tasks/main.yml index 4df3564..dd5a05e 100644 --- a/roles/two-interface-firewalld/tasks/main.yml +++ b/roles/two-interface-firewalld/tasks/main.yml @@ -65,5 +65,10 @@ when: run_in_installer|default(false)|bool - name: enable services - command: "firewall-offline-cmd --zone=internal --add-service=dhcp --add-service=dns --add-service=tftp --add-service=git" + command: >- + firewall-offline-cmd --zone=internal + --add-service=dhcp + --add-service=dns + --add-service=tftp + --add-service=git when: run_in_installer|default(false)|bool From 284dadc2d3a76694b8475b3ab6669abbfa95faf0 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 25 Nov 2019 18:26:21 +0100 Subject: [PATCH 048/504] Cleanup and restructuring. Move pressed-installer tasks to other roles. --- README | 5 +- installbox.yml | 27 ++-- kerberox-client.yml | 2 +- kerberox.yml | 22 ++- roles/apt-cacher/tasks/main.yml | 13 ++ roles/installbox2kiosk/tasks/main.yml | 72 --------- roles/krb5-kdc-ldap/tasks/main.yml | 2 +- roles/ldap/tasks/main.yml | 4 +- .../handlers/main.yml | 0 roles/prepare4clients/tasks/main.yml | 146 ++++++++++++++++++ .../templates/git-repo.j2 | 0 roles/preseed-installer/tasks/main.yml | 55 ------- .../tftp-netboot-installer/defaults/main.yml | 1 + roles/tftp-netboot-installer/tasks/main.yml | 17 ++ roles/two-interface-firewalld/tasks/main.yml | 2 +- 15 files changed, 214 insertions(+), 154 deletions(-) delete mode 100644 roles/installbox2kiosk/tasks/main.yml rename roles/{installbox2kiosk => prepare4clients}/handlers/main.yml (100%) create mode 100644 roles/prepare4clients/tasks/main.yml rename roles/{installbox2kiosk => prepare4clients}/templates/git-repo.j2 (100%) delete mode 100644 roles/preseed-installer/tasks/main.yml create mode 100644 roles/tftp-netboot-installer/defaults/main.yml diff --git a/README b/README index 2c60c4f..e13b926 100644 --- a/README +++ b/README @@ -41,9 +41,8 @@ Installbox - LAN interface not configured/managed • Customize installbox.yml: - - set if_lan (mandatory) - - modify deb_mirror - - enable installbox2kiosk task + - set if_lan if necessary + - enable/disable installbox2kiosk task • Run ansible: ssh-copy-id ansible@1.2.3.4 diff --git a/installbox.yml b/installbox.yml index 850db30..a7418a0 100644 --- a/installbox.yml +++ b/installbox.yml @@ -1,28 +1,33 @@ --- -# This playbook deploys the installbox on a minimal installation. +## This playbook deploys the installbox. Add 'hostname=XXX' and +## 'domain=YYY' to the installer boot parameters to set hostname and +## domain. - name: apply configuration to the installbox hosts: all remote_user: ansible become: yes + vars: ## This interface provides the default route: if_wan: "{{ ansible_default_ipv4.interface }}" + ## Use the first remaining interface for the LAN: if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" - ## Add 'hostname=XXX' to the installer boot parameters if necessary: - hostname: "{{ ansible_hostname }}" + + ## LAN IP address range: ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" - tftp_root: "/var/lib/tftpboot" - deb_mirror: "deb.debian.org" - di_dist: "buster" - di_version: "10" + + di_dist: "{{ ansible_distribution_release }}" + di_version: "{{ ansible_distribution_major_version }}" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" + ansible_user: ansible - repo_dir: "/home/{{ ansible_user }}/kiosk" - ansible_python_interpreter: "/usr/bin/python3" # needed for firewalld module + repo_dir: "/home/{{ ansible_user }}/debian-lan" + ansible_python_interpreter: "/usr/bin/python3" ## needed for firewalld module + pre_tasks: - name: validate if interfaces are available @@ -30,11 +35,11 @@ msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." when: (if_lan not in ansible_interfaces) or (if_wan not in ansible_interfaces) or (if_lan == if_wan) + roles: - up2date-debian - two-interface-firewalld - dhcp-dns-dnsmasq - tftp-netboot-installer - - preseed-installer - apt-cacher - - installbox2kiosk + - prepare4clients diff --git a/kerberox-client.yml b/kerberox-client.yml index 3170e0e..e54b505 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -16,7 +16,7 @@ - name: "kadmin_pwd" prompt: "Provide kadmin password to fetch kerberos keytab.\nLeave empty if done already" private: yes - + roles: - up2date-debian - lan-client diff --git a/kerberox.yml b/kerberox.yml index 1c34282..764359f 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -1,46 +1,52 @@ --- -# This playbook deploys the kerberox server. +## This playbook deploys the kerberox server. Add 'hostname=XXX' and +## 'domain=YYY' to the installer boot parameters to set hostname and domain. -- name: apply configuration to the installbox +- name: apply configuration to the kerberox server hosts: all remote_user: ansible become: yes + vars: ## This interface provides the default route: if_wan: "{{ ansible_default_ipv4.interface }}" + ## Use the first remaining interface for the LAN: if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" - ## Add 'hostname=XXX' to the installer boot parameters if necessary: - hostname: "{{ ansible_hostname }}" + + ## LAN IP address range: ipaddr_lan: 192.168.0.10 dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" - tftp_root: "/var/lib/tftpboot" - deb_mirror: "deb.debian.org" + di_dist: "{{ ansible_distribution_release }}" - di_version: "{{ ansible_distribution_version }}" + di_version: "{{ ansible_distribution_major_version }}" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" + ansible_user: ansible repo_dir: "/home/{{ ansible_user }}/debian-lan" ansible_python_interpreter: "/usr/bin/python3" ## needed for firewalld module + vars_prompt: - name: "foo_pwd" prompt: "Provide a non-empty password for the test user 'foo'.\nLeave empty to continue without test user" private: yes + pre_tasks: - name: validate if interfaces are available fail: msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." when: (if_lan not in ansible_interfaces) or (if_wan not in ansible_interfaces) or (if_lan == if_wan) + roles: - up2date-debian - two-interface-firewalld - dhcp-dns-dnsmasq - tftp-netboot-installer - - preseed-installer - apt-cacher - krb5-kdc-ldap - nfs-server + - prepare4clients diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index c54a3a9..bb9cc51 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -9,5 +9,18 @@ dest: /etc/apt/apt.conf backup: yes notify: "start apt-cacher-ng" + when: not run_in_installer|default(false)|bool ## do not enable apt-cacher during installation + + +- name: check if preseeded installer is available + stat: path={{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg + register: preseedcfg + +- name: enable apt-cacher-ng for install-clients + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(d-i mirror/http/proxy string.*)$' + replace: 'd-i mirror/http/proxy string http://{{ ansible_hostname }}:3142/' + when: preseedcfg.stat.exists - meta: flush_handlers diff --git a/roles/installbox2kiosk/tasks/main.yml b/roles/installbox2kiosk/tasks/main.yml deleted file mode 100644 index 6fe4f00..0000000 --- a/roles/installbox2kiosk/tasks/main.yml +++ /dev/null @@ -1,72 +0,0 @@ -- name: generate ssh key - command: "su -l {{ ansible_user }} -c \"ssh-keygen -t rsa -f /home/{{ ansible_user }}/.ssh/id_rsa -P ''\"" - args: - creates: "/home/{{ ansible_user }}/.ssh/id_rsa" - warn: False - -- name: slurp public key - slurp: - src: "/home/{{ ansible_user }}/.ssh/id_rsa.pub" - register: sshpubkey - -# The following seems to be necessary to get rid of a newline: -- set_fact: - sshpubkey: "{{ sshpubkey['content'] | b64decode | replace('\n', '') }}" - -- name: set debian mirror in preseed file - when: deb_mirror != "deb.debian.org" - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(d-i mirror/http/hostname string deb.debian.org)$' - replace: '#\1\nd-i mirror/http/hostname string {{ deb_mirror }}' - -- name: enable backports in preseed file - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^#(apt-setup-udeb.*)$' - replace: '\1' - -- name: preseed client - add firmware-linux, ansible and git - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(d-i pkgsel/include string firmware-linux)$' - replace: '#\1\nd-i pkgsel/include string firmware-linux ansible git' - -- name: insert start of managed block - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(### This command is run just before the install finishes:)' - replace: '#\1\n# BEGIN ANSIBLE MANAGED BLOCK preseed/late_command' - -- name: insert end of managed block - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(## When installing.*)' - replace: '# END ANSIBLE MANAGED BLOCK preseed/late_command\n#\1' - -- name: insert block - blockinfile: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - insertafter: "^### This command is run just before the install finishes:" - block: | - d-i preseed/late_command string \ - mkdir -p /target/home/ansible/.ssh && \ - echo "{{ sshpubkey }}" >> /target/home/ansible/.ssh/authorized_keys ; \ - in-target chown -R ansible:ansible /home/ansible/.ssh/ ; \ - in-target chmod -R og= /home/ansible/.ssh/ ; \ - in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" \ - -i localhost, --url=git://{{ hostname }}/.git $playbook - marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" - -- name: provide git repo if not available already - git: - repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' - dest: "{{ repo_dir }}" - update: no - become_user: "ansible" - -- name: start git-repo - template: - src: git-repo.j2 - dest: "/etc/systemd/system/git-repo.service" - notify: start git-repo diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index fc27565..59d289f 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -4,7 +4,7 @@ - fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 -- name: check if slapd is already there +- name: check if krb5kdc is already there stat: path=/usr/sbin/krb5kdc register: krb5kdc diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index c8564d4..131e8c9 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -53,7 +53,7 @@ src: slapd-config.ldif dest: /etc/ldap/slapd.d/slapd-config.ldif when: not slapd.stat.exists - + - name: activate ppolicy schema command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif when: not slapd.stat.exists @@ -128,6 +128,6 @@ ## Use firewall-offline-cmd when run during installation: -- name: allow ldap service in firewalld +- name: allow ldap service in firewalld command: "firewall-offline-cmd --zone=internal --add-service=ldap" when: run_in_installer|default(false)|bool diff --git a/roles/installbox2kiosk/handlers/main.yml b/roles/prepare4clients/handlers/main.yml similarity index 100% rename from roles/installbox2kiosk/handlers/main.yml rename to roles/prepare4clients/handlers/main.yml diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml new file mode 100644 index 0000000..4ae6d3f --- /dev/null +++ b/roles/prepare4clients/tasks/main.yml @@ -0,0 +1,146 @@ +- name: generate ssh key + command: "su -l {{ ansible_user }} -c \"ssh-keygen -t rsa -f /home/{{ ansible_user }}/.ssh/id_rsa -P ''\"" + args: + creates: "/home/{{ ansible_user }}/.ssh/id_rsa" + warn: False + +- name: slurp public key + slurp: + src: "/home/{{ ansible_user }}/.ssh/id_rsa.pub" + register: sshpubkey + +# The following seems to be necessary to get rid of a newline: +- set_fact: + sshpubkey: "{{ sshpubkey['content'] | b64decode | replace('\n', '') }}" + +- name: enable backports in preseed file + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^#(apt-setup-udeb.*)$' + replace: '\1' + +- name: preseed client - add firmware-linux, ansible and git + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(d-i pkgsel/include string firmware-linux)$' + replace: '#\1\nd-i pkgsel/include string firmware-linux ansible git' + +- name: insert start of managed block + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(### This command is run just before the install finishes:)' + replace: '#\1\n# BEGIN ANSIBLE MANAGED BLOCK preseed/late_command' + +- name: insert end of managed block + replace: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + regexp: '^(## When installing.*)' + replace: '# END ANSIBLE MANAGED BLOCK preseed/late_command\n#\1' + +- name: insert block + blockinfile: + dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" + insertafter: "^### This command is run just before the install finishes:" + block: | + d-i preseed/late_command string \ + mkdir -p /target/home/ansible/.ssh && \ + echo "{{ sshpubkey }}" >> /target/home/ansible/.ssh/authorized_keys ; \ + in-target chown -R ansible:ansible /home/ansible/.ssh/ ; \ + in-target chmod -R og= /home/ansible/.ssh/ ; \ + in-target ansible-pull --verbose --purge --extra-vars="run_in_installer=true" \ + -i localhost, --url=git://{{ ansible_hostname }}/.git $playbook + marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" + +- name: add kiosk auto pxe boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/pxelinux.HEAD + insertbefore: EOF + block: | + TIMEOUT 100 + # Use a temporary package cache during installation, install etckeeper. + LABEL tmp pkg cache + MENU LABEL Debian stable (amd64) + temporary package cache + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz mirror/http/proxy?=http://{{ ansible_hostname }}:3142/ pkgsel/include=etckeeper preseed/late_command="rm -fv /target/etc/apt/apt.conf" --- + + LABEL autoinstall + MENU LABEL Debian {{ di_version }} (amd64) + preseed + kiosk.yml + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + + #LABEL daily + #MENU LABEL Debian daily (amd64) + preseed + kiosk.yml + #kernel ::/d-i/n-a/daily/amd64/linux + #append initrd=::/d-i/n-a/daily/amd64/initrd.gz auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + marker: "# {mark} ANSIBLE MANAGED BLOCK kiosk" + notify: "rebuild di-netboot-assistant menu" + +- name: add kiosk auto efi boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/grub.cfg.HEAD + insertbefore: EOF + block: | + # Use a temporary package cache during installation, install etckeeper. + menuentry 'Debian stable (amd64) + temporary package cache' { + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux mirror/http/proxy?=http://{{ ansible_hostname }}:3142/ pkgsel/include=etckeeper preseed/late_command="rm -fv /target/etc/apt/apt.conf" --- + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz + } + + menuentry 'Debian {{ di_version }} (amd64) + preseed + kiosk.yml' { + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz + } + + #menuentry 'Debian daily (amd64) + preseed + kiosk.yml' { + # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + # initrd /d-i/n-a/daily/amd64/initrd.gz + #} + marker: "# {mark} ANSIBLE MANAGED BLOCK kiosk" + notify: "rebuild di-netboot-assistant menu" + +######## kerberox-client ####### + +- name: check if we opereate on kerberox + stat: path=/usr/sbin/krb5kdc + register: krb5kdc + +- name: add kerberox-client auto pxe boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/pxelinux.HEAD + insertbefore: EOF + block: | + LABEL autoinstall + MENU LABEL Debian {{ di_version }} (amd64) + preseed + kerberox-client.yml + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kerberox-client.yml --- + marker: "# {mark} ANSIBLE MANAGED BLOCK kerberox-client" + notify: "rebuild di-netboot-assistant menu" + when: krb5kdc.stat.exists + +- name: add kerberox-client auto efi boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/grub.cfg.HEAD + insertbefore: EOF + block: | + menuentry 'Debian {{ di_version }} (amd64) + preseed + kerberox-client.yml' { + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kerberox-client.yml --- + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz + } + marker: "# {mark} ANSIBLE MANAGED BLOCK kerberox-client" + notify: "rebuild di-netboot-assistant menu" + when: krb5kdc.stat.exists + +###################### + +- name: provide git repo if not available already + git: + repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' + dest: "{{ repo_dir }}" + update: no + become_user: "ansible" + +- name: start git-repo + template: + src: git-repo.j2 + dest: "/etc/systemd/system/git-repo.service" + notify: start git-repo diff --git a/roles/installbox2kiosk/templates/git-repo.j2 b/roles/prepare4clients/templates/git-repo.j2 similarity index 100% rename from roles/installbox2kiosk/templates/git-repo.j2 rename to roles/prepare4clients/templates/git-repo.j2 diff --git a/roles/preseed-installer/tasks/main.yml b/roles/preseed-installer/tasks/main.yml deleted file mode 100644 index 8435208..0000000 --- a/roles/preseed-installer/tasks/main.yml +++ /dev/null @@ -1,55 +0,0 @@ -- name: make preseed directory available - file: - path: "{{ tftp_root }}/d-i/{{ di_dist }}" - state: directory - -- name: provide preseed file - copy: - src: /usr/share/doc/di-netboot-assistant/examples/preseed.cfg - dest: "{{ tftp_root }}/d-i/{{ di_dist }}" - force: no - -- name: enable apt-cacher-ng for install-clients - replace: - dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(d-i mirror/http/proxy string.*)$' - replace: 'd-i mirror/http/proxy string http://{{ hostname }}:3142/' - -- name: make the hostname resolvable from the LAN - replace: - path: /etc/hosts - regexp: '^(127\.0\.1\.1.*)$' - replace: '#\1\n{{ ipaddr_lan }} {{ hostname }}' - -- name: add auto pxe boot entry to di-netboot-assistant - blockinfile: - dest: /etc/di-netboot-assistant/pxelinux.HEAD - insertbefore: EOF - block: | - TIMEOUT 100 - LABEL autoinstall - MENU LABEL Debian {{ di_version }} (amd64) + preseed + kiosk.yml - kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux - append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- - - #LABEL daily - #MENU LABEL Debian daily (amd64) + preseed + kiosk.yml - #kernel ::/d-i/n-a/daily/amd64/linux - #append initrd=::/d-i/n-a/daily/amd64/initrd.gz auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- - notify: "rebuild di-netboot-assistant menu" - -- name: add auto efi boot entry to di-netboot-assistant - blockinfile: - dest: /etc/di-netboot-assistant/grub.cfg.HEAD - insertbefore: EOF - block: | - menuentry 'Debian {{ di_version }} (amd64) + preseed + kiosk.yml' { - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- - initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz - } - - #menuentry 'Debian daily (amd64) + preseed + kiosk.yml' { - # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical url=tftp://{{ hostname }} playbook=kiosk.yml --- - # initrd /d-i/n-a/daily/amd64/initrd.gz - #} - notify: "rebuild di-netboot-assistant menu" diff --git a/roles/tftp-netboot-installer/defaults/main.yml b/roles/tftp-netboot-installer/defaults/main.yml new file mode 100644 index 0000000..2b791ea --- /dev/null +++ b/roles/tftp-netboot-installer/defaults/main.yml @@ -0,0 +1 @@ +tftp_root: "/var/lib/tftpboot" diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/tftp-netboot-installer/tasks/main.yml index 31df608..a70a711 100644 --- a/roles/tftp-netboot-installer/tasks/main.yml +++ b/roles/tftp-netboot-installer/tasks/main.yml @@ -1,3 +1,8 @@ +- name: make preseed directory available + file: + path: "{{ tftp_root }}/d-i/{{ di_dist }}" + state: directory + - name: install di-netboot-assistant and installer package apt: name: @@ -7,6 +12,12 @@ - bind mount images - rebuild di-netboot-assistant menu +- name: provide preseed file + copy: + src: /usr/share/doc/di-netboot-assistant/examples/preseed.cfg + dest: "{{ tftp_root }}/d-i/{{ di_dist }}" + force: no + - name: configure dnsmasq template: src: dnsmasq-tftp-netboot-installer.j2 @@ -14,3 +25,9 @@ notify: - restart dnsmasq - rebuild di-netboot-assistant menu + +- name: make the hostname resolvable from the LAN + replace: + path: /etc/hosts + regexp: '^(127\.0\.1\.1.*)$' + replace: '#\1\n{{ ipaddr_lan }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}' diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/two-interface-firewalld/tasks/main.yml index dd5a05e..d61dc39 100644 --- a/roles/two-interface-firewalld/tasks/main.yml +++ b/roles/two-interface-firewalld/tasks/main.yml @@ -24,7 +24,7 @@ - name: enable masquerading firewalld: zone: public - masquerade: yes + masquerade: 'yes' permanent: yes state: enabled when: not run_in_installer|default(false)|bool From 954ac5b0e687fa01f912cfdd33791a3ab5fd79f3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 26 Nov 2019 18:52:43 +0100 Subject: [PATCH 049/504] Do not deploy LDAP and KDC during installation as it adds too much complexity. --- kerberox.yml | 4 ++-- roles/krb5-kdc-ldap/tasks/main.yml | 29 +++++++++-------------------- roles/ldap/tasks/main.yml | 13 ++----------- roles/nfs-server/tasks/main.yml | 11 +---------- 4 files changed, 14 insertions(+), 43 deletions(-) diff --git a/kerberox.yml b/kerberox.yml index 764359f..edafcba 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -47,6 +47,6 @@ - dhcp-dns-dnsmasq - tftp-netboot-installer - apt-cacher - - krb5-kdc-ldap - - nfs-server + - { role: krb5-kdc-ldap, when: not run_in_installer|default(false)|bool } + - { role: nfs-server, when: not run_in_installer|default(false)|bool } - prepare4clients diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 59d289f..72322f4 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -36,7 +36,8 @@ - name: prepare kerberos.openldap.ldif shell: gunzip -c /usr/share/doc/krb5-kdc-ldap/kerberos.openldap.ldif.gz > /etc/ldap/schema/kerberos.openldap.ldif - when: not krb5kdc.stat.exists + args: + creates: /etc/ldap/schema/kerberos.openldap.ldif - name: activate kerberos.openldap.ldif schema command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/kerberos.openldap.ldif @@ -48,7 +49,6 @@ objectClass: krbContainer bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" - when: not krb5kdc.stat.exists - name: make sure we have a kdc object ldap_entry: @@ -60,7 +60,6 @@ userPassword: "{{ kdc_service_pwd }}" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" - when: not krb5kdc.stat.exists - name: make sure we have a kadmin object ldap_entry: @@ -72,7 +71,6 @@ userPassword: "{{ kadmin_service_pwd }}" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd }}" - when: not krb5kdc.stat.exists - name: modify ACLs to account for KDC ldap_attr: @@ -110,7 +108,13 @@ ldap_attr: dn: "olcDatabase={1}mdb,cn=config" name: olcDbIndex - values: krbPrincipalName pres,sub,eq + values: + - objectClass eq + - cn,uid eq + - uidNumber,gidNumber eq + - member,memberUid eq + - krbPrincipalName pres,sub,eq + state: exact when: not krb5kdc.stat.exists - name: prepare password for kdc @@ -169,8 +173,6 @@ - ldap when: not krb5kdc.stat.exists -############## - - name: kerberize dummy user foo command: kadmin.local -q 'add_principal -pw "{{ foo_pwd }}" -x dn="uid=foo,ou=people,{{ basedn }}" foo' register: kerberize_result @@ -178,8 +180,6 @@ no_log: true when: foo_pwd is defined and foo_pwd | length > 0 -############################# - - name: allow services in firewalld firewalld: zone: internal @@ -190,14 +190,3 @@ - kerberos - kadmin - kpasswd - when: not run_in_installer|default(false)|bool - -## Use firewall-offline-cmd when run during installation: - -- name: allow services in firewalld - command: >- - firewall-offline-cmd --zone=internal - --add-service=kerberos - --add-service=kadmin - --add-service=kpasswd - when: run_in_installer|default(false)|bool diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 131e8c9..eeb7b97 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -5,7 +5,7 @@ when: ansible_domain | length == 0 - name: check if slapd is already there - stat: path=/usr/sbin/slapd + stat: path=/etc/ldap/slapd.d/slapd-config.ldif register: slapd - name: preseed ldap domain @@ -53,7 +53,7 @@ src: slapd-config.ldif dest: /etc/ldap/slapd.d/slapd-config.ldif when: not slapd.stat.exists - + - name: activate ppolicy schema command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif when: not slapd.stat.exists @@ -116,18 +116,9 @@ bind_pw: "{{ ldap_admin_pwd }}" when: foo_pwd is defined and foo_pwd | length > 0 -############################# - - name: allow ldap service in firewalld firewalld: zone: internal service: ldap permanent: yes state: enabled - when: not run_in_installer|default(false)|bool - -## Use firewall-offline-cmd when run during installation: - -- name: allow ldap service in firewalld - command: "firewall-offline-cmd --zone=internal --add-service=ldap" - when: run_in_installer|default(false)|bool diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 2f5448f..d54fdbe 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -60,7 +60,7 @@ when: kadmin.stat.exists - name: copy home from /etc/skel for dummy user foo - shell: cp -r /etc/skel {{ lan_homes }}/foo && chmod -R o-rwx {{ lan_homes }}/foo && chown -R foo:foo {{ lan_homes }}/foo + shell: cp -r /etc/skel {{ lan_homes }}/foo && chmod -R o-rwx {{ lan_homes }}/foo && chown -R 10000:10000 {{ lan_homes }}/foo args: creates: "{{ lan_homes }}/foo" when: foo_pwd is defined and foo_pwd | length > 0 @@ -76,18 +76,9 @@ notify: "restart dnsmasq" when: dnsmasq.stat.exists -############################# - - name: allow nfs service in firewalld firewalld: zone: internal service: nfs permanent: yes state: enabled - when: not run_in_installer|default(false)|bool - -## Use firewall-offline-cmd when run during installation: - -- name: allow nfs service in firewalld - command: "firewall-offline-cmd --zone=internal --add-service=nfs" - when: run_in_installer|default(false)|bool From 1686bf44e7f72b0a0169ba8714b065d50d60a998 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 27 Nov 2019 17:43:58 +0100 Subject: [PATCH 050/504] Improved password management. Make sure the saved password is used after first setup. --- kerberox.yml | 5 ++++- roles/krb5-kdc-ldap/tasks/main.yml | 8 ++++---- roles/ldap/tasks/main.yml | 17 +++++++++++------ 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/kerberox.yml b/kerberox.yml index edafcba..931652d 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -30,7 +30,10 @@ vars_prompt: - name: "foo_pwd" - prompt: "Provide a non-empty password for the test user 'foo'.\nLeave empty to continue without test user" + prompt: + In case you would like to prepare a test user 'foo' and have + not done so yet, provide foo's password here. Leave empty to + just continue private: yes diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 72322f4..2d6e922 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -48,7 +48,7 @@ dn: "cn=kerberos,{{ basedn }}" objectClass: krbContainer bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - name: make sure we have a kdc object ldap_entry: @@ -59,7 +59,7 @@ attributes: userPassword: "{{ kdc_service_pwd }}" bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - name: make sure we have a kadmin object ldap_entry: @@ -70,7 +70,7 @@ attributes: userPassword: "{{ kadmin_service_pwd }}" bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - name: modify ACLs to account for KDC ldap_attr: @@ -137,7 +137,7 @@ >- kdb5_ldap_util -D cn=admin,"{{ basedn }}" - -w "{{ ldap_admin_pwd }}" + -w "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" -H ldapi:/// create -s -subtrees "{{ basedn }}" -P "{{ kdc_master_pwd }}" diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index eeb7b97..8a7cda1 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -62,8 +62,13 @@ command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif when: not slapd.stat.exists - ####################################################################################### +## Use the admin password saved to file from now on (available also after installation): +- name: slurp admin password + slurp: + src: "{{ ldap_admin_pwd_file }}" + register: ldap_admin_pwd + no_log: true ## Prepare user directories - name: make sure we have a people entry for users @@ -71,19 +76,19 @@ dn: "ou=people,{{ basedn }}" objectClass: organizationalUnit bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - name: make sure we have a group entry for users ldap_entry: dn: "ou=groups,{{ basedn }}" objectClass: organizationalUnit bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - name: provide simple script to add/delete users template: src: debian-lan.j2 - dest: /usr/local/sbin/debian-lan + dest: /usr/local/bin/debian-lan mode: 0744 ## Add user @@ -102,7 +107,7 @@ homeDirectory: "{{ lan_homes }}/foo" loginShell: /bin/bash bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" when: foo_pwd is defined and foo_pwd | length > 0 - name: add dummy group foo @@ -113,7 +118,7 @@ attributes: gidNumber: 10000 bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" when: foo_pwd is defined and foo_pwd | length > 0 - name: allow ldap service in firewalld From 9d9da31649f20536de153f5a4c94f965895f69b1 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 27 Nov 2019 18:31:52 +0100 Subject: [PATCH 051/504] Allow apt-cacher-ng in firewalld. --- roles/apt-cacher/tasks/main.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index bb9cc51..128d1fd 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -23,4 +23,11 @@ replace: 'd-i mirror/http/proxy string http://{{ ansible_hostname }}:3142/' when: preseedcfg.stat.exists +- name: allow apt-cacher-ng service in firewalld + firewalld: + zone: internal + port: 3142/tcp + permanent: yes + state: enabled + - meta: flush_handlers From 7f49b191ac065e08ff99aa8f6dc2ea61ff8dc0a3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 27 Nov 2019 20:21:09 +0100 Subject: [PATCH 052/504] Make 'ldap', 'kerberos' and 'nfs' hostname aliases. --- roles/krb5-kdc-ldap/tasks/main.yml | 9 +++++++++ roles/lan-client/handlers/main.yml | 1 + roles/ldap/tasks/main.yml | 7 +++++++ roles/nfs-server/tasks/main.yml | 9 ++++++++- 4 files changed, 25 insertions(+), 1 deletion(-) diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 2d6e922..104f694 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -173,6 +173,15 @@ - ldap when: not krb5kdc.stat.exists +- name: "make 'kerberos' an alias hostname resolvable from the LAN" + replace: + path: /etc/hosts + regexp: "^({{ ipaddr_lan }}\\s.+)$" + replace: '\1 kerberos' + when: not krb5kdc.stat.exists + +######################## + - name: kerberize dummy user foo command: kadmin.local -q 'add_principal -pw "{{ foo_pwd }}" -x dn="uid=foo,ou=people,{{ basedn }}" foo' register: kerberize_result diff --git a/roles/lan-client/handlers/main.yml b/roles/lan-client/handlers/main.yml index ec16fb7..66f15d5 100644 --- a/roles/lan-client/handlers/main.yml +++ b/roles/lan-client/handlers/main.yml @@ -10,5 +10,6 @@ - name: restart rpc-gssd systemd: name: rpc-gssd + daemon_reload: yes state: restarted notify: "restart rpc-gssd" diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 8a7cda1..b0d4ed4 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -62,6 +62,13 @@ command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif when: not slapd.stat.exists +- name: "make 'ldap' an alias hostname resolvable from the LAN" + replace: + path: /etc/hosts + regexp: "^({{ ipaddr_lan }}\\s.+)$" + replace: '\1 ldap' + when: not slapd.stat.exists + ####################################################################################### ## Use the admin password saved to file from now on (available also after installation): - name: slurp admin password diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index d54fdbe..400a49f 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -3,7 +3,7 @@ - fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 -- name: check if there are installing +- name: check if we are installing stat: path=/etc/exports register: exports @@ -29,6 +29,13 @@ {{ export_root }}/home/ *(sec=krb5p,rw,no_subtree_check) notify: "restart nfs-kernel-server" +- name: "make 'nfs' an alias hostname resolvable from the LAN" + replace: + path: /etc/hosts + regexp: "^({{ ipaddr_lan }}\\s.+)$" + replace: '\1 nfs' + when: not exports.stat.exists + - name: check if there is a local kadmin stat: path=/usr/sbin/kadmin.local register: kadmin From 3670bf65974aad16e6cc83138a222001633c0e39 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 27 Nov 2019 20:45:27 +0100 Subject: [PATCH 053/504] Provide keytab before touching home directories to avoid lock. --- kerberox-client.yml | 2 +- roles/lan-client/tasks/main.yml | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/kerberox-client.yml b/kerberox-client.yml index e54b505..7fceaf7 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -21,5 +21,5 @@ - up2date-debian - lan-client ## Choose either gnome or KDE: - - gnome + #- gnome #- kde diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index d779d09..f4d7afb 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -56,9 +56,6 @@ mode: 0600 notify: restart sssd -- name: make sure the home mount directory exists - file: path={{ lan_homes }} state=directory recurse=yes - ## Activate machine after installation: - name: create machine principal @@ -76,6 +73,10 @@ notify: "restart rpc-gssd" when: not run_in_installer|default(false)|bool and kadmin_pwd | length > 0 + +- name: make sure the home mount directory exists + file: path={{ lan_homes }} state=directory recurse=yes + - name: automount lineinfile: dest: /etc/fstab From 2ff1354fe324fed36aaf1f5366cd7fb2273c0ede Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 28 Nov 2019 16:34:37 +0100 Subject: [PATCH 054/504] Implement better IP address/network notation. --- installbox.yml | 2 +- kerberox.yml | 2 +- roles/krb5-kdc-ldap/tasks/main.yml | 2 +- roles/ldap/tasks/main.yml | 2 +- roles/nfs-server/tasks/main.yml | 6 +++--- roles/tftp-netboot-installer/tasks/main.yml | 2 +- .../two-interface-firewalld/templates/interfaces-static.j2 | 2 +- .../two-interface-shorewall/templates/interfaces-static.j2 | 1 - 8 files changed, 9 insertions(+), 10 deletions(-) diff --git a/installbox.yml b/installbox.yml index a7418a0..7f64372 100644 --- a/installbox.yml +++ b/installbox.yml @@ -16,7 +16,7 @@ if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" ## LAN IP address range: - ipaddr_lan: 192.168.0.10 + ipaddr_lan: 192.168.0.10/24 dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" diff --git a/kerberox.yml b/kerberox.yml index 931652d..d45c1c2 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -15,7 +15,7 @@ if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" ## LAN IP address range: - ipaddr_lan: 192.168.0.10 + ipaddr_lan: 192.168.0.10/24 dhcp_range: 192.168.0.50,192.168.0.150,2h dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 104f694..beeb4ac 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -176,7 +176,7 @@ - name: "make 'kerberos' an alias hostname resolvable from the LAN" replace: path: /etc/hosts - regexp: "^({{ ipaddr_lan }}\\s.+)$" + regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" replace: '\1 kerberos' when: not krb5kdc.stat.exists diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index b0d4ed4..15e0665 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -65,7 +65,7 @@ - name: "make 'ldap' an alias hostname resolvable from the LAN" replace: path: /etc/hosts - regexp: "^({{ ipaddr_lan }}\\s.+)$" + regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" replace: '\1 ldap' when: not slapd.stat.exists diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 400a49f..845944b 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -25,14 +25,14 @@ dest: /etc/exports insertbefore: EOF block: | - {{ export_root }} *(sec=krb5p,rw,fsid=0,crossmnt,no_subtree_check) - {{ export_root }}/home/ *(sec=krb5p,rw,no_subtree_check) + {{ export_root }} {{ ipaddr_lan | ipaddr('subnet') }}(sec=krb5p,rw,fsid=0,crossmnt,no_subtree_check) + {{ export_root }}/home/ {{ ipaddr_lan | ipaddr('subnet') }}(sec=krb5p,rw,no_subtree_check) notify: "restart nfs-kernel-server" - name: "make 'nfs' an alias hostname resolvable from the LAN" replace: path: /etc/hosts - regexp: "^({{ ipaddr_lan }}\\s.+)$" + regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" replace: '\1 nfs' when: not exports.stat.exists diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/tftp-netboot-installer/tasks/main.yml index a70a711..f6daa83 100644 --- a/roles/tftp-netboot-installer/tasks/main.yml +++ b/roles/tftp-netboot-installer/tasks/main.yml @@ -30,4 +30,4 @@ replace: path: /etc/hosts regexp: '^(127\.0\.1\.1.*)$' - replace: '#\1\n{{ ipaddr_lan }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}' + replace: '#\1\n{{ ipaddr_lan | ipaddr("address") }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}' diff --git a/roles/two-interface-firewalld/templates/interfaces-static.j2 b/roles/two-interface-firewalld/templates/interfaces-static.j2 index c9fe71c..9724fa4 100644 --- a/roles/two-interface-firewalld/templates/interfaces-static.j2 +++ b/roles/two-interface-firewalld/templates/interfaces-static.j2 @@ -1,4 +1,4 @@ auto {{ if_lan }} allow-hotplug {{ if_lan }} iface {{ if_lan }} inet static - address {{ ipaddr_lan }}/24 + address {{ ipaddr_lan }} diff --git a/roles/two-interface-shorewall/templates/interfaces-static.j2 b/roles/two-interface-shorewall/templates/interfaces-static.j2 index 6c0fd53..9724fa4 100644 --- a/roles/two-interface-shorewall/templates/interfaces-static.j2 +++ b/roles/two-interface-shorewall/templates/interfaces-static.j2 @@ -2,4 +2,3 @@ auto {{ if_lan }} allow-hotplug {{ if_lan }} iface {{ if_lan }} inet static address {{ ipaddr_lan }} - netmask 255.255.255.0 From 3b3303e96d515e5af809c0a4d3e2c8f619a56a7d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 28 Nov 2019 17:37:19 +0100 Subject: [PATCH 055/504] Kerberize LDAP access. --- roles/krb5-kdc-ldap/tasks/main.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index beeb4ac..13c9002 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -117,6 +117,15 @@ state: exact when: not krb5kdc.stat.exists +- name: add AuthzRegexp to map access via kerberos/GSSAPI + ldap_attr: + dn: "cn=config" + name: olcAuthzRegexp + values: + - "{0}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=people,{{ basedn }}" + - "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}" + state: exact + - name: prepare password for kdc shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile no_log: true @@ -173,6 +182,13 @@ - ldap when: not krb5kdc.stat.exists +- name: allow slapd to read the keytab + file: + path: /etc/krb5.keytab + owner: root + group: openldap + mode: '0640' + - name: "make 'kerberos' an alias hostname resolvable from the LAN" replace: path: /etc/hosts From be829760c6d145b7733b2a868861a36a9640ecda Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 29 Nov 2019 14:38:07 +0100 Subject: [PATCH 056/504] Improved DHCP configuration, no static IP addresses. --- installbox.yml | 3 +-- kerberox.yml | 3 +-- roles/dhcp-dns-dnsmasq/tasks/main.yml | 12 +++--------- roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 | 1 + 4 files changed, 6 insertions(+), 13 deletions(-) diff --git a/installbox.yml b/installbox.yml index 7f64372..48e5d9f 100644 --- a/installbox.yml +++ b/installbox.yml @@ -17,8 +17,7 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - dhcp_range: 192.168.0.50,192.168.0.150,2h - dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" + dhcp_range: 192.168.0.50,192.168.0.99,2h di_dist: "{{ ansible_distribution_release }}" di_version: "{{ ansible_distribution_major_version }}" diff --git a/kerberox.yml b/kerberox.yml index d45c1c2..c1594ca 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -16,8 +16,7 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - dhcp_range: 192.168.0.50,192.168.0.150,2h - dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}" + dhcp_range: 192.168.0.50,192.168.0.99,2h di_dist: "{{ ansible_distribution_release }}" di_version: "{{ ansible_distribution_major_version }}" diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dhcp-dns-dnsmasq/tasks/main.yml index d0e4bf6..48bae66 100644 --- a/roles/dhcp-dns-dnsmasq/tasks/main.yml +++ b/roles/dhcp-dns-dnsmasq/tasks/main.yml @@ -4,17 +4,11 @@ - name: install dnsmasq package apt: - name: dnsmasq + name: + - dnsmasq + - resolvconf state: latest -- name: add client hostnames and IP addresses to /etc/hosts - lineinfile: - dest: /etc/hosts - line: "{{ item.1 }}\t{{ 'debian%03d' | format(item.0) }}" - with_indexed_items: "{{ dhcp_list }}" - notify: "restart dnsmasq" - when: not dnsmasq.stat.exists - - name: configure dnsmasq template: src: dnsmasq-dhcp.j2 diff --git a/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 b/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 index a6ca62b..61f82c2 100644 --- a/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 +++ b/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 @@ -1,2 +1,3 @@ interface={{ if_lan }} dhcp-range={{ dhcp_range }} +dhcp-generate-names From 61e4b1d852f7e7667231b093c555d4af8d490ff2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 29 Nov 2019 15:47:45 +0100 Subject: [PATCH 057/504] Add kerberize role (providing kerberized ssh so far). --- kerberox-client.yml | 1 + kerberox.yml | 1 + roles/kerberize/handlers/main.yml | 5 +++++ roles/kerberize/tasks/main.yml | 18 ++++++++++++++++++ roles/lan-client/tasks/main.yml | 22 ++++++++++++++++------ 5 files changed, 41 insertions(+), 6 deletions(-) create mode 100644 roles/kerberize/handlers/main.yml create mode 100644 roles/kerberize/tasks/main.yml diff --git a/kerberox-client.yml b/kerberox-client.yml index 7fceaf7..201d5d5 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -20,6 +20,7 @@ roles: - up2date-debian - lan-client + - kerberize ## Choose either gnome or KDE: #- gnome #- kde diff --git a/kerberox.yml b/kerberox.yml index c1594ca..2335fcf 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -52,3 +52,4 @@ - { role: krb5-kdc-ldap, when: not run_in_installer|default(false)|bool } - { role: nfs-server, when: not run_in_installer|default(false)|bool } - prepare4clients + - kerberize diff --git a/roles/kerberize/handlers/main.yml b/roles/kerberize/handlers/main.yml new file mode 100644 index 0000000..9adbeaa --- /dev/null +++ b/roles/kerberize/handlers/main.yml @@ -0,0 +1,5 @@ +- name: reload sshd + systemd: + name: sshd + state: reloaded + notify: "reload sshd" diff --git a/roles/kerberize/tasks/main.yml b/roles/kerberize/tasks/main.yml new file mode 100644 index 0000000..6fcecc2 --- /dev/null +++ b/roles/kerberize/tasks/main.yml @@ -0,0 +1,18 @@ +- name: kerberize sshd server + lineinfile: + dest: /etc/ssh/sshd_config + line: "GSSAPIAuthentication yes" + insertafter: "#GSSAPIAuthentication no" + notify: "reload sshd" + +- name: kerberize ssh client, authenticate + lineinfile: + dest: /etc/ssh/ssh_config + line: "GSSAPIAuthentication yes" + insertafter: "# GSSAPIAuthentication no" + +- name: kerberize ssh client, delegate credentials + lineinfile: + dest: /etc/ssh/ssh_config + line: "GSSAPIDelegateCredentials yes" + insertafter: "# GSSAPIDelegateCredentials no" diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index f4d7afb..6882fa9 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -56,19 +56,29 @@ mode: 0600 notify: restart sssd - ## Activate machine after installation: -- name: create machine principal - command: kadmin -p root/admin -w {{ kadmin_pwd }} -q "addprinc -randkey nfs/{{ ansible_hostname }}.{{ ansible_domain }}" +- name: create machine principals + command: kadmin -p root/admin -w {{ kadmin_pwd }} -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}" register: kerberize_result + with_items: + - nfs + - host changed_when: kerberize_result.stderr is not search('already exists while creating') no_log: true when: not run_in_installer|default(false)|bool and kadmin_pwd | length > 0 -- name: add principal to keytab - command: kadmin -p root/admin -w {{ kadmin_pwd }} -q "ktadd nfs/{{ ansible_hostname }}.{{ ansible_domain }}" +- name: remove old keytab + file: + path: /etc/krb5.keytab + state: absent + when: not run_in_installer|default(false)|bool and kadmin_pwd | length > 0 + +- name: add principals to keytab + command: kadmin -p root/admin -w {{ kadmin_pwd }} -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}" + with_items: + - nfs + - host args: - creates: /etc/krb5.keytab no_log: true notify: "restart rpc-gssd" when: not run_in_installer|default(false)|bool and kadmin_pwd | length > 0 From 6b3c2f0e0ff98111ed7f8ab78dc62b684af5c13f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 30 Nov 2019 09:56:40 +0100 Subject: [PATCH 058/504] Add commands: Option to remove machine principals, start ldapvi. --- roles/ldap/templates/debian-lan.j2 | 76 +++++++++++++++++++----------- 1 file changed, 49 insertions(+), 27 deletions(-) diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index e17404f..54222ba 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -7,12 +7,14 @@ set -eu usage(){ cat < [] [] $(basename $0) deluser + $(basename $0) delhost + $(basename $0) ldapvi : User ID (login name) - : Password + : Password , : LDAP attributes, if omitted, is used. EOF @@ -20,9 +22,17 @@ EOF #sss_cache -U -G ## should not be necessary +BASEDN="{{ basedn }}" +LDAPADMIN="cn=admin,$BASEDN" +ADPASSWD="$(cat {{ ldap_admin_pwd_file }})" + if [ $# -lt 2 ] ; then - usage - exit 1 + if [ "$1" = ldapvi ] ; then + exec ldapvi -h ldapi:/// -D "$LDAPADMIN" -b "$BASEDN" -w "$ADPASSWD" + else + usage + exit 1 + fi elif [ $1 = adduser -a $# -lt 3 ] ; then echo "Error: Password missing." usage @@ -31,16 +41,14 @@ fi MINID=10000 MAXID=20000 -BASEDN="{{ basedn }}" HOMES="{{ lan_homes }}" -LDAPADMIN="cn=admin,$BASEDN" -ADPASSWD="$(cat {{ ldap_admin_pwd_file }})" COMMAND="$1" -uid="$2" +id="$2" pw="${3:-""}" cn="${4:-$2}" sn="${5:-$2}" +domain="$(hostname -d)" if [ -x /usr/sbin/kadmin.local ] ; then KRB5=true @@ -67,26 +75,26 @@ nextnum(){ add-user(){ uidNumber=$(nextnum uidNumber) gidNumber=$(nextnum gidNumber) - + if [ $uidNumber -ge $MAXID -o $gidNumber -ge $MAXID ] ; then echo "Error: $uidNumber and/or $gidNumber exceed max ID number ${MAXID}." exit 1 fi - + cat <&1 \ - | sed '/ldap_initialize/d' - - if [ -d ${HOMES}/${uid} ] ; then - KEEPDIR="${HOMES}/rm_$(date '+%Y%m%d')_${uid}" - mv ${HOMES}/${uid} "${KEEPDIR}" + + ldapdelete -v -H ldapi:/// -D "$LDAPADMIN" -w "$ADPASSWD" "uid=${id},ou=people,$BASEDN" "cn=${id},ou=groups,$BASEDN" 2>&1 \ + | sed '/ldap_initialize/d' + + if [ -d ${HOMES}/${id} ] ; then + KEEPDIR="${HOMES}/rm_$(date '+%Y%m%d')_${id}" + mv ${HOMES}/${id} "${KEEPDIR}" chown -R root:root "${KEEPDIR}" ls -ld "$KEEPDIR" fi } - + + +del-host(){ + if [ $KRB5 ] ; then + ## Remove kerberos principals from LDAP. + kadmin.local -q "delete_principal -force host/${id}.${domain}" \ + | sed -e '/Authenticating as principal/d' -e '/Make sure that you have removed/d' + kadmin.local -q "delete_principal -force nfs/${id}.${domain}" \ + | sed -e '/Authenticating as principal/d' -e '/Make sure that you have removed/d' + fi +} + ############################## ########### main ############# ############################## @@ -134,6 +153,9 @@ case $COMMAND in deluser) del-user ;; + delhost) + del-host + ;; *) usage ;; From 43cb4dcf13787c48903f49b60eb66c449bf76ba3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 1 Dec 2019 10:17:08 +0100 Subject: [PATCH 059/504] Add user import/deletion from file option, minor improvements. --- roles/lan-client/templates/sssd.conf.j2 | 1 - roles/ldap/tasks/main.yml | 2 +- roles/ldap/templates/debian-lan.j2 | 69 ++++++++++++++++++------- roles/nfs-server/templates/sssd.conf.j2 | 1 - 4 files changed, 50 insertions(+), 23 deletions(-) diff --git a/roles/lan-client/templates/sssd.conf.j2 b/roles/lan-client/templates/sssd.conf.j2 index d55c2c7..2d4f287 100644 --- a/roles/lan-client/templates/sssd.conf.j2 +++ b/roles/lan-client/templates/sssd.conf.j2 @@ -21,4 +21,3 @@ cache_credentials = true min_id = 10000 max_id = 20000 -enumerate = False diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 15e0665..13123ae 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -92,7 +92,7 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" -- name: provide simple script to add/delete users +- name: provide simple script to manage ldap/kdc template: src: debian-lan.j2 dest: /usr/local/bin/debian-lan diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index 54222ba..f94ad23 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -8,27 +8,45 @@ set -eu usage(){ cat < [] [] + $(basename $0) adduser [] [] $(basename $0) deluser $(basename $0) delhost $(basename $0) ldapvi + $(basename $0) - : User ID (login name) - : Password - , : LDAP attributes, if omitted, is used. + : User ID (login name) + : Password + , : LDAP attributes 'givenName' and 'sn'. If omitted, is used. + : File containing lines of the form: + adduser [] [] + adduser [] [] + … + deluser + deluser + … + Every line is processed like a single call to the $(basename $0) program. EOF } -#sss_cache -U -G ## should not be necessary - BASEDN="{{ basedn }}" LDAPADMIN="cn=admin,$BASEDN" ADPASSWD="$(cat {{ ldap_admin_pwd_file }})" if [ $# -lt 2 ] ; then - if [ "$1" = ldapvi ] ; then - exec ldapvi -h ldapi:/// -D "$LDAPADMIN" -b "$BASEDN" -w "$ADPASSWD" + if [ $# = 0 ] ; then + usage + exit 1 + elif [ "$1" = ldapvi ] ; then + exec ldapvi -m -h ldapi:/// -D "$LDAPADMIN" -b "$BASEDN" -w "$ADPASSWD" + elif [ -r "$1" ]; then + ## recursively call this program: + while read -r LINE ; do + $0 $LINE + done < "$1" + ## reset cache after mass import/deletion: + sss_cache -U -G + exit 0 else usage exit 1 @@ -46,8 +64,9 @@ HOMES="{{ lan_homes }}" COMMAND="$1" id="$2" pw="${3:-""}" -cn="${4:-$2}" +gn="${4:-$2}" sn="${5:-$2}" + domain="$(hostname -d)" if [ -x /usr/sbin/kadmin.local ] ; then @@ -73,8 +92,12 @@ nextnum(){ } add-user(){ - uidNumber=$(nextnum uidNumber) - gidNumber=$(nextnum gidNumber) + local id="$1" + local pwEntry="$2" + local gn="$3" + local sn="$4" + local uidNumber=$(nextnum uidNumber) + local gidNumber=$(nextnum gidNumber) if [ $uidNumber -ge $MAXID -o $gidNumber -ge $MAXID ] ; then echo "Error: $uidNumber and/or $gidNumber exceed max ID number ${MAXID}." @@ -90,8 +113,10 @@ uidNumber: ${uidNumber} gidNumber: ${gidNumber} homeDirectory: ${HOMES}/${id} loginShell: /bin/bash -cn: ${cn} +cn: ${gn} ${sn} +givenName: ${gn} sn: ${sn} +gecos: ${gn} ${sn} ${pwEntry} dn: cn=${id},ou=groups,$BASEDN @@ -100,19 +125,21 @@ gidNumber: ${gidNumber} ################################## EOF - echo "uidNumber: ${uidNumber} gidNumber: ${gidNumber}" - if [ $KRB5 ] ; then kadmin.local -q "add_principal -policy default -pw \"$pw\" -x dn=\"uid=${id},ou=people,$BASEDN\" ${id}" \ | sed '/Authenticating as principal/d' - cp -r /etc/skel ${HOMES}/${id} - chown -R ${uidNumber}:${gidNumber} ${HOMES}/${id} - ls -nld ${HOMES}/${id} + if [ ! -e "${HOMES}/${id}" ] ; then + echo "uidNumber: ${uidNumber} gidNumber: ${gidNumber}" + cp -r /etc/skel ${HOMES}/${id} + chown -R ${uidNumber}:${gidNumber} ${HOMES}/${id} + ls -nld ${HOMES}/${id} + fi fi } del-user(){ + local id="$1" local KEEPDIR if [ $KRB5 ] ; then ## Remove all kerberos attributes from LDAP, then the whole DN below. The latter should be sufficient. @@ -133,6 +160,7 @@ del-user(){ del-host(){ + local id="$1" if [ $KRB5 ] ; then ## Remove kerberos principals from LDAP. kadmin.local -q "delete_principal -force host/${id}.${domain}" \ @@ -146,15 +174,16 @@ del-host(){ ########### main ############# ############################## +sss_cache -U -G ## clear cache case $COMMAND in adduser) - add-user + add-user "${id}" "${pwEntry}" "${gn}" "${sn}" ;; deluser) - del-user + del-user "${id}" ;; delhost) - del-host + del-host "${id}" ;; *) usage diff --git a/roles/nfs-server/templates/sssd.conf.j2 b/roles/nfs-server/templates/sssd.conf.j2 index 54868d2..40fba97 100644 --- a/roles/nfs-server/templates/sssd.conf.j2 +++ b/roles/nfs-server/templates/sssd.conf.j2 @@ -21,4 +21,3 @@ cache_credentials = false min_id = 10000 max_id = 20000 -enumerate = False From 8c896c90e65f80c4136636a78927ceb7b3776da2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 1 Dec 2019 18:21:24 +0100 Subject: [PATCH 060/504] Implement posix group for all users in LDAP. --- roles/ldap/tasks/main.yml | 19 +++++++++++++++++++ roles/ldap/templates/debian-lan.j2 | 17 +++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 13123ae..e8b9e65 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -92,6 +92,16 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" +- name: add group for all ldapusers + ldap_entry: + dn: "cn=ldapuser,ou=groups,{{ basedn }}" + objectClass: + - posixGroup + attributes: + gidNumber: 18000 + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + - name: provide simple script to manage ldap/kdc template: src: debian-lan.j2 @@ -128,6 +138,15 @@ bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" when: foo_pwd is defined and foo_pwd | length > 0 +- name: add dummy user foo to group ldapuser + ldap_attr: + dn: "cn=ldapuser,ou=groups,{{ basedn }}" + name: memberUid + values: foo + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + when: foo_pwd is defined and foo_pwd | length > 0 + - name: allow ldap service in firewalld firewalld: zone: internal diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index f94ad23..3dbf3c7 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -123,6 +123,14 @@ dn: cn=${id},ou=groups,$BASEDN objectClass: posixGroup gidNumber: ${gidNumber} ################################## +EOF + + cat <&1 \ | sed '/ldap_initialize/d' + cat < Date: Fri, 6 Dec 2019 20:03:44 +0100 Subject: [PATCH 061/504] Add kerberox* to the README. --- README | 53 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 39 insertions(+), 14 deletions(-) diff --git a/README b/README index e13b926..e3506a9 100644 --- a/README +++ b/README @@ -6,24 +6,28 @@ The goal of the "Debian Local Area Network"-project is to make setting up Debian in a local area network as easy as possible. This repository offers ansible playbooks and instructions for the following machines: - • Installbox: + • installbox: orchestration of automatic installs in the LAN - set up as gateway to some external network (WAN) - - providing TFTP installation on the LAN interface + - provides TFTP installations on the LAN interface - automatic installs: preseeding and ansible playbooks - package cache - use case: orchestration of automatic installs in the LAN - • Kiosk: + • kerberox: serving a minimalistic kerberized LAN + - automatic TFTP installation of clients + - centralized home directories on kerberized NFS + - simple script to manage users and machines + + • kerberox-client: the client for the kerberized LAN + + • kiosk: school's computer, hackerspace, … - auto login user - reasonable defaults - temporary home directory on tmpfs, reset at boot - use case: school's computer, hackerspace, … - • Cloudbox: + • cloudbox: nextcloud server in the basement - setup of a home cloud server - dynamic DNS name - … - use case: nextcloud server in the basement Contributions like patches, suggestions, pull requests and/or further profiles are highly appreciated! @@ -35,30 +39,51 @@ profiles are highly appreciated! Installbox ~~~~~~~~~~ - • Debian installation: + • standard Debian installation: - user 'ansible' in sudo group - WAN interface configured and connected - LAN interface not configured/managed - • Customize installbox.yml: - - set if_lan if necessary - - enable/disable installbox2kiosk task + • optional: customize installbox.yml - • Run ansible: + • run ansible: ssh-copy-id ansible@1.2.3.4 ansible-playbook installbox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + • the installbox can be used to install all other profiles + +Kerberox +~~~~~~~~ + • standard Debian installation: + - user 'ansible' in sudo group + - WAN interface configured and connected + - LAN interface not configured/managed + + • optional: customize kerberox.yml + + • run ansible: + ssh-copy-id ansible@1.2.3.4 + ansible-playbook installbox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + +Kerberox and installbox provide a local ansible configuration space +which can be used to install clients and/or to check/modify the local +installation. To do the latter, cd into 'debian-lan' and run: + + 'ansible-playbook --ask-become-pass -v -i localhost, -c local kerberox.yml' + +The kerberox-clients are automatically installed using the included TFTP netboot +installer within the LAN. Kiosk ~~~~~ • Debian installation: - user 'ansible' in sudo group - • Customize kiosk.yml: + • customize kiosk.yml: - WiFi parameters - package selection: extra_pkgs and extra_pkgs_bpo for backports - desktop environment - • Run ansible: + • run ansible: ssh-copy-id ansible@1.2.3.4 ansible-playbook kiosk.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, From 0829b1b2e89d74e441fecc5733ed855366c71043 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 8 Dec 2019 08:43:26 +0100 Subject: [PATCH 062/504] Kerberize firefox in the local domain. --- roles/kerberize/tasks/main.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/roles/kerberize/tasks/main.yml b/roles/kerberize/tasks/main.yml index 6fcecc2..dc4d9c4 100644 --- a/roles/kerberize/tasks/main.yml +++ b/roles/kerberize/tasks/main.yml @@ -16,3 +16,18 @@ dest: /etc/ssh/ssh_config line: "GSSAPIDelegateCredentials yes" insertafter: "# GSSAPIDelegateCredentials no" + + +- name: check if firewox is available + stat: path=/etc/firefox-esr/firefox-esr.js + register: firefox + +- name: kerberize firefox for sites in the local domain + lineinfile: + dest: /etc/firefox-esr/firefox-esr.js + line: "{{ item }}" + with_items: + - '// kerberize for sites in the local domain:' + - 'pref("network.negotiate-auth.delegation-uris", "{{ ansible_domain }}");' + - 'pref("network.negotiate-auth.trusted-uris", "{{ ansible_domain }}");' + when: firefox.stat.exists From 98b8d5d6ffc94c7846d47bb337cce3dc1b094793 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 13 Dec 2019 18:35:00 +0100 Subject: [PATCH 063/504] Add memberof-overlay to LDAP. --- roles/ldap/files/slapd-config.ldif | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/roles/ldap/files/slapd-config.ldif b/roles/ldap/files/slapd-config.ldif index 4770d3b..4aead37 100644 --- a/roles/ldap/files/slapd-config.ldif +++ b/roles/ldap/files/slapd-config.ldif @@ -26,3 +26,18 @@ objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyHashCleartext: TRUE + + +#### Reverse Group Membership #### + +dn: cn=module,cn=config +objectClass: olcModuleList +cn: module +olcModuleLoad: memberof + +dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config +objectClass: olcOverlayConfig +objectClass: olcMemberOf +olcOverlay: memberof +olcMemberOfDangling: error +olcMemberOfRefInt: TRUE From 572dd5a3b0bacaae89fdebe58f769209b12c1c2f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 13 Dec 2019 18:41:34 +0100 Subject: [PATCH 064/504] Add LDAP client config and enable pam_umask. --- roles/lan-client/tasks/main.yml | 17 +++++++++++++++++ roles/ldap/tasks/main.yml | 12 ++++++++++++ 2 files changed, 29 insertions(+) diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index 6882fa9..24bfacc 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -33,6 +33,23 @@ - nfs-common state: latest +- name: add URI to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "URI ldap://ldap/" + insertafter: "#URI.*" + +- name: add BASE to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "BASE {{ basedn }}" + insertafter: "#BASE.*" + +- name: enable pam_umask + lineinfile: + dest: /etc/pam.d/common-session + line: "session optional pam_umask.so usergroups" + ## oddjob-mkhomedir works only with sec=sys for the NFSv4 share - name: install extra packages from stable diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index e8b9e65..d2f7afa 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -69,6 +69,18 @@ replace: '\1 ldap' when: not slapd.stat.exists +- name: add URI to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "URI ldapi:///" + insertafter: "#URI.*" + +- name: add BASE to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "BASE {{ basedn }}" + insertafter: "#BASE.*" + ####################################################################################### ## Use the admin password saved to file from now on (available also after installation): - name: slurp admin password From 81337ac0db11ac0faf73a4f9dd9c48efbb3dfdd5 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 13 Dec 2019 18:43:42 +0100 Subject: [PATCH 065/504] Move hard-coded numbers to variables. --- roles/kerberize/tasks/main.yml | 2 +- roles/lan-client/defaults/main.yml | 2 ++ roles/lan-client/templates/sssd.conf.j2 | 4 ++-- roles/ldap/defaults/main.yml | 3 +++ roles/ldap/templates/debian-lan.j2 | 4 ++-- roles/nfs-server/defaults/main.yml | 3 +++ roles/nfs-server/tasks/main.yml | 2 +- roles/nfs-server/templates/sssd.conf.j2 | 4 ++-- 8 files changed, 16 insertions(+), 8 deletions(-) diff --git a/roles/kerberize/tasks/main.yml b/roles/kerberize/tasks/main.yml index dc4d9c4..8f9b755 100644 --- a/roles/kerberize/tasks/main.yml +++ b/roles/kerberize/tasks/main.yml @@ -18,7 +18,7 @@ insertafter: "# GSSAPIDelegateCredentials no" -- name: check if firewox is available +- name: check if firefox is available stat: path=/etc/firefox-esr/firefox-esr.js register: firefox diff --git a/roles/lan-client/defaults/main.yml b/roles/lan-client/defaults/main.yml index 7c62cce..81690e1 100644 --- a/roles/lan-client/defaults/main.yml +++ b/roles/lan-client/defaults/main.yml @@ -3,3 +3,5 @@ basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | rep ldap_server: ldap krb_server: kerberos nfs_server: nfs +min_id_sssd: 5000 +max_id_sssd: 20000 diff --git a/roles/lan-client/templates/sssd.conf.j2 b/roles/lan-client/templates/sssd.conf.j2 index 2d4f287..90e5410 100644 --- a/roles/lan-client/templates/sssd.conf.j2 +++ b/roles/lan-client/templates/sssd.conf.j2 @@ -19,5 +19,5 @@ krb5_server = {{ krb_server }} krb5_realm = {{ ansible_domain | upper }} cache_credentials = true -min_id = 10000 -max_id = 20000 +min_id = {{ min_id_sssd }} +max_id = {{ max_id_sssd }} diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index 141c21f..1400020 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -2,3 +2,6 @@ ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd length=24') }}" ldap_admin_pwd_file: "/root/ldap-admin.pwd" basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" lan_homes: /home/lan +min_id: 10000 +max_id: 20000 +ldapuser_gid: 8000 diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index 3dbf3c7..cb9d790 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -57,8 +57,8 @@ elif [ $1 = adduser -a $# -lt 3 ] ; then exit 1 fi -MINID=10000 -MAXID=20000 +MINID={{ min_id }} +MAXID={{ max_id }} HOMES="{{ lan_homes }}" COMMAND="$1" diff --git a/roles/nfs-server/defaults/main.yml b/roles/nfs-server/defaults/main.yml index 49adf7c..456b8e5 100644 --- a/roles/nfs-server/defaults/main.yml +++ b/roles/nfs-server/defaults/main.yml @@ -1,3 +1,6 @@ export_root: /srv/nfs4 lan_homes: /home/lan basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +min_id: 10000 +min_id_sssd: 5000 +max_id_sssd: 20000 diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 845944b..950fde1 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -67,7 +67,7 @@ when: kadmin.stat.exists - name: copy home from /etc/skel for dummy user foo - shell: cp -r /etc/skel {{ lan_homes }}/foo && chmod -R o-rwx {{ lan_homes }}/foo && chown -R 10000:10000 {{ lan_homes }}/foo + shell: cp -r /etc/skel {{ lan_homes }}/foo && chmod -R o-rwx {{ lan_homes }}/foo && chown -R {{ min_id }}:{{ min_id }} {{ lan_homes }}/foo args: creates: "{{ lan_homes }}/foo" when: foo_pwd is defined and foo_pwd | length > 0 diff --git a/roles/nfs-server/templates/sssd.conf.j2 b/roles/nfs-server/templates/sssd.conf.j2 index 40fba97..48eae04 100644 --- a/roles/nfs-server/templates/sssd.conf.j2 +++ b/roles/nfs-server/templates/sssd.conf.j2 @@ -19,5 +19,5 @@ krb5_server = {{ ansible_hostname }} krb5_realm = {{ ansible_domain | upper }} cache_credentials = false -min_id = 10000 -max_id = 20000 +min_id = {{ min_id_sssd }} +max_id = {{ max_id_sssd }} From dd284d6abd8fb5453a84b0e61ed29ca5fc6c6898 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 14 Dec 2019 20:21:06 +0100 Subject: [PATCH 066/504] Use subdirs for user's homes. --- roles/ldap/tasks/main.yml | 2 +- roles/ldap/templates/debian-lan.j2 | 19 ++++++++++--------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index d2f7afa..d63e3f3 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -117,7 +117,7 @@ - name: provide simple script to manage ldap/kdc template: src: debian-lan.j2 - dest: /usr/local/bin/debian-lan + dest: /usr/local/sbin/debian-lan mode: 0744 ## Add user diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index cb9d790..562bc77 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -111,7 +111,7 @@ objectClass: inetOrgPerson objectClass: posixAccount uidNumber: ${uidNumber} gidNumber: ${gidNumber} -homeDirectory: ${HOMES}/${id} +homeDirectory: ${HOMES}/${id:0:1}/${id} loginShell: /bin/bash cn: ${gn} ${sn} givenName: ${gn} @@ -136,12 +136,13 @@ EOF if [ $KRB5 ] ; then kadmin.local -q "add_principal -policy default -pw \"$pw\" -x dn=\"uid=${id},ou=people,$BASEDN\" ${id}" \ | sed '/Authenticating as principal/d' - if [ ! -e "${HOMES}/${id}" ] ; then + if [ ! -e "${HOMES}/${id:0:1}/${id}" ] ; then echo "uidNumber: ${uidNumber} gidNumber: ${gidNumber}" - cp -r /etc/skel ${HOMES}/${id} - chown -R ${uidNumber}:${gidNumber} ${HOMES}/${id} - #chmod -R o= ${HOMES}/${id} - ls -nld ${HOMES}/${id} + mkdir -p ${HOMES}/${id:0:1}/ + cp -r /etc/skel ${HOMES}/${id:0:1}/${id} + chown -R ${uidNumber}:${gidNumber} ${HOMES}/${id:0:1}/${id} + #chmod -R o= ${HOMES}/${id:0:1}/${id} + ls -nld ${HOMES}/${id:0:1}/${id} fi fi } @@ -167,9 +168,9 @@ memberUid: ${id} ################################## EOF - if [ -d ${HOMES}/${id} ] ; then - KEEPDIR="${HOMES}/rm_$(date '+%Y%m%d')_${id}" - mv ${HOMES}/${id} "${KEEPDIR}" + if [ -d ${HOMES}/${id:0:1}/${id} ] ; then + KEEPDIR="${HOMES}/${id:0:1}/rm_$(date '+%Y%m%d')_${id}" + mv ${HOMES}/${id:0:1}/${id} "${KEEPDIR}" chown -R root:root "${KEEPDIR}" ls -ld "$KEEPDIR" fi From 902a87e258df5f581cb79ba8ec02ae549e77f29a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 14 Dec 2019 20:56:45 +0100 Subject: [PATCH 067/504] Add optional posix group handling to script. --- roles/ldap/templates/debian-lan.j2 | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index 562bc77..7523d97 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -8,7 +8,7 @@ set -eu usage(){ cat < [] [] + $(basename $0) adduser [] [] [] $(basename $0) deluser $(basename $0) delhost $(basename $0) ldapvi @@ -17,6 +17,7 @@ Usage: : User ID (login name) : Password , : LDAP attributes 'givenName' and 'sn'. If omitted, is used. + : If given, the user is added to this posix group, which must already exist. : File containing lines of the form: adduser [] [] @@ -66,6 +67,7 @@ id="$2" pw="${3:-""}" gn="${4:-$2}" sn="${5:-$2}" +grp="${6:-""}" domain="$(hostname -d)" @@ -125,13 +127,15 @@ gidNumber: ${gidNumber} ################################## EOF - cat <&1 \ | sed '/ldap_initialize/d' - cat </dev/null \ + | grep cn: | cut -d ' ' -f2) ; do + cat < Date: Sun, 15 Dec 2019 18:10:27 +0100 Subject: [PATCH 068/504] Fix crap in kadmin ACL. --- roles/krb5-kdc-ldap/templates/kadm5.acl.j2 | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 index 54c6636..5e9c641 100644 --- a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 +++ b/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 @@ -1,4 +1,2 @@ -## access controls for the Kerberos KDC +## access control for the Kerberos KDC root/admin@{{ ansible_domain | upper }} * -*@{{ ansible_domain | upper }} cil -*/*@{{ ansible_domain | upper }} i From 21309fb788ecd1d73db71f1a8cfb39acc0c9c873 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jan 2020 09:22:40 +0100 Subject: [PATCH 069/504] Improved determination of next available uid/gid pair. --- roles/ldap/tasks/main.yml | 19 ++----- roles/ldap/templates/debian-lan.j2 | 78 ++++++++++++++++++++-------- roles/prepare4clients/tasks/main.yml | 2 +- 3 files changed, 62 insertions(+), 37 deletions(-) diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index d63e3f3..51ac242 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -104,13 +104,13 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" -- name: add group for all ldapusers +- name: add group for ldap users ldap_entry: dn: "cn=ldapuser,ou=groups,{{ basedn }}" objectClass: - posixGroup attributes: - gidNumber: 18000 + gidNumber: "{{ ldapuser_gid }}" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" @@ -131,8 +131,8 @@ cn: foo sn: bar userPassword: "{{ foo_pwd }}" - uidNumber: 10000 - gidNumber: 10000 + uidNumber: "{{ min_id }}" + gidNumber: "{{ min_id }}" homeDirectory: "{{ lan_homes }}/foo" loginShell: /bin/bash bind_dn: "cn=admin,{{ basedn }}" @@ -145,16 +145,7 @@ objectClass: - posixGroup attributes: - gidNumber: 10000 - bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - when: foo_pwd is defined and foo_pwd | length > 0 - -- name: add dummy user foo to group ldapuser - ldap_attr: - dn: "cn=ldapuser,ou=groups,{{ basedn }}" - name: memberUid - values: foo + gidNumber: "{{ min_id }}" bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" when: foo_pwd is defined and foo_pwd | length > 0 diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index 7523d97..5572869 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -8,7 +8,7 @@ set -eu usage(){ cat < [] [] [] + $(basename $0) adduser [] [] [] $(basename $0) deluser $(basename $0) delhost $(basename $0) ldapvi @@ -16,12 +16,13 @@ Usage: : User ID (login name) : Password + : If given, the user is added to this posix group (in addition to his personal group). + The group must already exist in the LDAP DT. , : LDAP attributes 'givenName' and 'sn'. If omitted, is used. - : If given, the user is added to this posix group, which must already exist. : File containing lines of the form: - adduser [] [] - adduser [] [] + adduser [] [] [] + adduser [] [] [] … deluser deluser @@ -58,16 +59,21 @@ elif [ $1 = adduser -a $# -lt 3 ] ; then exit 1 fi +## Range of user and personal group IDs: MINID={{ min_id }} MAXID={{ max_id }} + +## Range to cover in a single ldap search (must be smaller than 'olcSizeLimit' in cn=config): +RANGE=399 + HOMES="{{ lan_homes }}" COMMAND="$1" id="$2" pw="${3:-""}" -gn="${4:-$2}" -sn="${5:-$2}" -grp="${6:-""}" +grp="${4:-""}" +gn="${5:-$2}" +sn="${6:-$2}" domain="$(hostname -d)" @@ -79,27 +85,54 @@ else pwEntry="userPassword: $pw" fi -############# - +################################################################################################## nextnum(){ - local num - num="$(( $(ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=people,$BASEDN" -S $1 $1 2>/dev/null \ - | tail -n -2 | grep -oE "[[:digit:]]+$") + 1 ))" - if [ $num -lt $MINID ] ; then - echo $MINID - else - echo "$num" - fi + local id=$MINID + local bsta bend all uids gids num + + ## Search for the next pair of identical free IDs: + while [ $id -le $MAXID ] ; do + bsta=$id + bend=$(( $bsta + $RANGE )) + + all="$(seq $bsta $bend)" + uids="$(ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=people,$BASEDN" "(&(objectClass=posixAccount)(uidNumber>=$bsta)(uidNumber<=$bend))" \ + uidNumber 2>/dev/null | grep "uidNumber: " | cut -f2 -d ' ' | sort -g | uniq)" + gids="$(ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=groups,$BASEDN" "(&(objectClass=posixGroup)(gidNumber>=$bsta)(uidNumber<=$bend))" \ + gidNumber 2>/dev/null | grep "gidNumber: " | cut -f2 -d ' ' | sort -g | uniq)" + + fuids="$(comm -13 <(echo "$uids") <(echo "$all"))" + fgids="$(comm -13 <(echo "$gids") <(echo "$all"))" + num=$(comm -12 <(echo "$fuids") <(echo "$fgids") | head -1) + + if [ -n "$num" ] ; then + echo $num + return + else + id=$(( $bend + 1 )) + fi + done + ## something went wrong: + exit 1 } + add-user(){ local id="$1" local pwEntry="$2" - local gn="$3" - local sn="$4" - local uidNumber=$(nextnum uidNumber) - local gidNumber=$(nextnum gidNumber) + local grp="$3" + local gn="$4" + local sn="$5" + + if ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=people,$BASEDN" "(&(objectClass=posixAccount)(uid=$id))" uid 2>/dev/null \ + | grep -q "uid: $id" ; then + echo "User '$id' exists already, skipping." + return + fi + + local uidNumber=$(nextnum) + local gidNumber=$uidNumber if [ $uidNumber -ge $MAXID -o $gidNumber -ge $MAXID ] ; then echo "Error: $uidNumber and/or $gidNumber exceed max ID number ${MAXID}." @@ -200,9 +233,10 @@ del-host(){ ############################## sss_cache -U -G ## clear cache +echo "==== $@ ====" case $COMMAND in adduser) - add-user "${id}" "${pwEntry}" "${gn}" "${sn}" + add-user "${id}" "${pwEntry}" "${grp}" "${gn}" "${sn}" ;; deluser) del-user "${id}" diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 4ae6d3f..484d170 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -100,7 +100,7 @@ ######## kerberox-client ####### -- name: check if we opereate on kerberox +- name: check if we operate on kerberox stat: path=/usr/sbin/krb5kdc register: krb5kdc From 2a161df7bb7f273df77098d916f175eaf4e87bb4 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jan 2020 20:44:10 +0100 Subject: [PATCH 070/504] Implement nextcloud role. --- README | 2 +- roles/nextcloud/defaults/main.yml | 6 + roles/nextcloud/files/krb5-nextcloud.conf | 27 ++++ roles/nextcloud/files/nextcloud.conf | 15 +++ roles/nextcloud/handlers/main.yml | 11 ++ roles/nextcloud/tasks/main.yml | 151 ++++++++++++++++++++++ 6 files changed, 211 insertions(+), 1 deletion(-) create mode 100644 roles/nextcloud/defaults/main.yml create mode 100644 roles/nextcloud/files/krb5-nextcloud.conf create mode 100644 roles/nextcloud/files/nextcloud.conf create mode 100644 roles/nextcloud/handlers/main.yml create mode 100644 roles/nextcloud/tasks/main.yml diff --git a/README b/README index e3506a9..490c984 100644 --- a/README +++ b/README @@ -63,7 +63,7 @@ Kerberox • run ansible: ssh-copy-id ansible@1.2.3.4 - ansible-playbook installbox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + ansible-playbook kerberox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, Kerberox and installbox provide a local ansible configuration space which can be used to install clients and/or to check/modify the local diff --git a/roles/nextcloud/defaults/main.yml b/roles/nextcloud/defaults/main.yml new file mode 100644 index 0000000..4b8122f --- /dev/null +++ b/roles/nextcloud/defaults/main.yml @@ -0,0 +1,6 @@ +db_nextcloud_pwd: "{{ lookup('password', '/tmp/db-nextcloud.pwd length=24') }}" +nc_admin_pwd: "{{ lookup('password', '/tmp/nc-admin.pwd length=24') }}" +nc_admin_pwd_file: "/root/nc-admin.pwd" +www_root: "/var/www" +nc_dir: "{{ www_root }}/nextcloud" +data_dir: "/var/nc-data" diff --git a/roles/nextcloud/files/krb5-nextcloud.conf b/roles/nextcloud/files/krb5-nextcloud.conf new file mode 100644 index 0000000..3b84912 --- /dev/null +++ b/roles/nextcloud/files/krb5-nextcloud.conf @@ -0,0 +1,27 @@ +Alias /nextcloud "/var/www/nextcloud/" + + + AuthType GSSAPI + AuthName "Login to NextCloud" + GssapiAllowedMech krb5 + GssapiLocalName On + GssapiCredStore keytab:/etc/krb5.keytab.http + GssapiUseSessions On + GssapiNegotiateOnce On + GssapiBasicAuth On + require valid-user + + + + Require all granted + Options FollowSymlinks MultiViews + AllowOverride All + + + Dav off + + + SetEnv HOME /var/www/nextcloud + SetEnv HTTP_HOME /var/www/nextcloud + + diff --git a/roles/nextcloud/files/nextcloud.conf b/roles/nextcloud/files/nextcloud.conf new file mode 100644 index 0000000..8996eac --- /dev/null +++ b/roles/nextcloud/files/nextcloud.conf @@ -0,0 +1,15 @@ +Alias /nextcloud "/var/www/nextcloud/" + + + Require all granted + Options FollowSymlinks MultiViews + AllowOverride All + + + Dav off + + + SetEnv HOME /var/www/nextcloud + SetEnv HTTP_HOME /var/www/nextcloud + + diff --git a/roles/nextcloud/handlers/main.yml b/roles/nextcloud/handlers/main.yml new file mode 100644 index 0000000..9d2f7c6 --- /dev/null +++ b/roles/nextcloud/handlers/main.yml @@ -0,0 +1,11 @@ +- name: restart apache2 + systemd: + name: apache2 + state: restarted + listen: "restart apache2" + +- name: restart php-fpm + systemd: + name: php{{ php_ver.stdout }}-fpm + state: restarted + listen: "restart php-fpm" diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml new file mode 100644 index 0000000..d88f095 --- /dev/null +++ b/roles/nextcloud/tasks/main.yml @@ -0,0 +1,151 @@ +## Install and configure nextcloud + +- name: install apache, php- and db-packages + apt: + name: + - apache2 + - mariadb-server + - python3-pymysql + - php-apcu + - php-fpm + - php-curl + - php-gd + - php-imagick + - php-intl + - php-json + - php-ldap + - php-mbstring + - php-mysql + - php-xml + - php-zip + state: latest + +- name: disable apache modules + apache2_module: + state: absent + name: "{{ item }}" + with_items: + - mpm_prefork + - mpm_worker + notify: "restart apache2" + +- name: enable apache modules + apache2_module: + name: "{{ item }}" + with_items: + - proxy_fcgi + - mpm_event + - ssl + - http2 + notify: "restart apache2" + +- name: find php version + shell: ls /etc/php/ | sort | tail -1 + register: php_ver + changed_when: False + +- name: enable php-fpm conf + command: a2enconf php{{ php_ver.stdout }}-fpm + args: + creates: /etc/apache2/conf-enabled/php{{ php_ver.stdout }}-fpm.conf + notify: "restart apache2" + +- name: tune php-fpm + replace: + dest: /etc/php/{{ php_ver.stdout }}/fpm/pool.d/www.conf + regexp: "{{ item.regex }}" + replace: "{{ item.replace }}" + with_items: + - { regex: "^pm.max_children = .*$", replace: "pm.max_children = 120" } + - { regex: "^pm.start_servers = .*$", replace: "pm.start_servers = 12" } + - { regex: "^pm.min_spare_servers = .*$", replace: "pm.min_spare_servers = 6" } + - { regex: "^pm.max_spare_servers = .*$", replace: "pm.max_spare_servers = 18" } + notify: "restart php-fpm" + +- name: increase php memory limit + replace: + dest: "/etc/php/{{ php_ver.stdout }}/fpm/php.ini" + regexp: "^memory_limit = .*" + replace: "memory_limit = 512M" + notify: "restart apache2" + +- name: provide nextcloud site + copy: + src: nextcloud.conf + dest: /etc/apache2/sites-available/nextcloud.conf + +- name: enable https + command: a2ensite default-ssl.conf + args: + creates: /etc/apache2/sites-enabled/default-ssl.conf + notify: "restart apache2" + +- name: enable nextcloud site + command: a2ensite nextcloud.conf + args: + creates: /etc/apache2/sites-enabled/nextcloud.conf + notify: "restart apache2" + +- name: create a new database with name 'nextcloud' + mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: nextcloud + state: present + +- name: create database user 'nextcloud' + mysql_user: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: nextcloud + password: "{{ db_nextcloud_pwd }}" + priv: 'nextcloud.*:ALL' + state: present + +- name: unpack nextcloud archive + unarchive: + src: nextcloud.tar.bz2 + dest: "{{ www_root }}" + owner: www-data + group: www-data + creates: "{{ nc_dir }}" + +- name: make sure data directory exists + file: + path: "{{ data_dir }}" + state: directory + owner: www-data + group: www-data + recurse: yes + +- name: initialize nextcloud + command: + cmd: > + sudo -u www-data php occ maintenance:install + --database "mysql" + --database-name "nextcloud" + --database-user "nextcloud" + --database-pass "{{ db_nextcloud_pwd }}" + --admin-user "nc-admin" + --admin-pass "{{ nc_admin_pwd }}" + --data-dir "{{ data_dir }}" + args: + chdir: "{{ nc_dir }}" + creates: "{{ nc_dir }}/config/config.php" + no_log: true + +- name: dump nc-admin password + shell: echo -n "{{ nc_admin_pwd }}" > "{{ nc_admin_pwd_file }}" ; chmod 0600 "{{ nc_admin_pwd_file }}" + no_log: true + args: + creates: "{{ nc_admin_pwd_file }}" + +- name: enable APCu memcache + lineinfile: + dest: "{{ nc_dir }}/config/config.php" + line: " 'memcache.local' => '\\OC\\Memcache\\APCu'," + insertbefore: "'installed' => true," + +- name: allow access from LAN + lineinfile: + dest: "{{ nc_dir }}/config/config.php" + line: " 1 => '192.168.*.*'," + insertafter: "0 => 'localhost'," From 23605d69627bf0d0d1604872e45cb4606f595408 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 14 Jan 2020 14:51:52 +0100 Subject: [PATCH 071/504] Use occ to modify configuration. --- roles/nextcloud/tasks/main.yml | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index d88f095..31a71fb 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -100,6 +100,10 @@ priv: 'nextcloud.*:ALL' state: present +- name: check if we are installing + stat: path="{{ nc_dir }}" + register: nextcloud + - name: unpack nextcloud archive unarchive: src: nextcloud.tar.bz2 @@ -114,12 +118,12 @@ state: directory owner: www-data group: www-data - recurse: yes + recurse: Yes - name: initialize nextcloud command: cmd: > - sudo -u www-data php occ maintenance:install + sudo -u www-data php ./occ maintenance:install --database "mysql" --database-name "nextcloud" --database-user "nextcloud" @@ -130,22 +134,26 @@ args: chdir: "{{ nc_dir }}" creates: "{{ nc_dir }}/config/config.php" - no_log: true + no_log: True - name: dump nc-admin password shell: echo -n "{{ nc_admin_pwd }}" > "{{ nc_admin_pwd_file }}" ; chmod 0600 "{{ nc_admin_pwd_file }}" - no_log: true + no_log: True args: creates: "{{ nc_admin_pwd_file }}" - name: enable APCu memcache - lineinfile: - dest: "{{ nc_dir }}/config/config.php" - line: " 'memcache.local' => '\\OC\\Memcache\\APCu'," - insertbefore: "'installed' => true," + command: sudo -u www-data php ./occ config:system:set memcache.local --value='\OC\Memcache\APCu' + args: + chdir: "{{ nc_dir }}" + warn: False + when: not nextcloud.stat.exists - name: allow access from LAN - lineinfile: - dest: "{{ nc_dir }}/config/config.php" - line: " 1 => '192.168.*.*'," - insertafter: "0 => 'localhost'," + command: sudo -u www-data php ./occ config:system:set trusted_domains 1 --value='192.168.*.*' + args: + chdir: "{{ nc_dir }}" + warn: False + when: not nextcloud.stat.exists + +## ToDo: enable apps etc., update From e069171539a24f2eb5d7159a7859e57a2becb7a2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 14 Jan 2020 21:09:24 +0100 Subject: [PATCH 072/504] Setup fine tuning and app installation. --- roles/nextcloud/files/htaccess | 8 +++ roles/nextcloud/files/krb5-nextcloud.conf | 18 ++++-- roles/nextcloud/files/nextcloud.conf | 18 ++++-- roles/nextcloud/tasks/main.yml | 68 +++++++++++++++++------ 4 files changed, 84 insertions(+), 28 deletions(-) create mode 100644 roles/nextcloud/files/htaccess diff --git a/roles/nextcloud/files/htaccess b/roles/nextcloud/files/htaccess new file mode 100644 index 0000000..ad8b40f --- /dev/null +++ b/roles/nextcloud/files/htaccess @@ -0,0 +1,8 @@ + + RewriteEngine on + RewriteRule ^\.well-known/host-meta /nextcloud/public.php?service=host-meta [QSA,L] + RewriteRule ^\.well-known/host-meta\.json /nextcloud/public.php?service=host-meta-json [QSA,L] + RewriteRule ^\.well-known/webfinger /nextcloud/public.php?service=webfinger [QSA,L] + RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L] + RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L] + diff --git a/roles/nextcloud/files/krb5-nextcloud.conf b/roles/nextcloud/files/krb5-nextcloud.conf index 3b84912..10b9e82 100644 --- a/roles/nextcloud/files/krb5-nextcloud.conf +++ b/roles/nextcloud/files/krb5-nextcloud.conf @@ -17,11 +17,19 @@ Alias /nextcloud "/var/www/nextcloud/" Options FollowSymlinks MultiViews AllowOverride All - - Dav off - + + Dav off + - SetEnv HOME /var/www/nextcloud - SetEnv HTTP_HOME /var/www/nextcloud + SetEnv HOME /var/www/nextcloud + SetEnv HTTP_HOME /var/www/nextcloud + + + AllowOverride FileInfo + + + + Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" + diff --git a/roles/nextcloud/files/nextcloud.conf b/roles/nextcloud/files/nextcloud.conf index 8996eac..d7cb013 100644 --- a/roles/nextcloud/files/nextcloud.conf +++ b/roles/nextcloud/files/nextcloud.conf @@ -5,11 +5,19 @@ Alias /nextcloud "/var/www/nextcloud/" Options FollowSymlinks MultiViews AllowOverride All - - Dav off - + + Dav off + - SetEnv HOME /var/www/nextcloud - SetEnv HTTP_HOME /var/www/nextcloud + SetEnv HOME /var/www/nextcloud + SetEnv HTTP_HOME /var/www/nextcloud + + + AllowOverride FileInfo + + + + Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" + diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 31a71fb..2f51ad8 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -35,6 +35,8 @@ with_items: - proxy_fcgi - mpm_event + - rewrite + - headers - ssl - http2 notify: "restart apache2" @@ -74,6 +76,11 @@ src: nextcloud.conf dest: /etc/apache2/sites-available/nextcloud.conf +- name: provide htaccess file + copy: + src: htaccess + dest: /var/www/html/.htaccess + - name: enable https command: a2ensite default-ssl.conf args: @@ -86,11 +93,26 @@ creates: /etc/apache2/sites-enabled/nextcloud.conf notify: "restart apache2" -- name: create a new database with name 'nextcloud' +- name: make sure data directory exists + file: + path: "{{ data_dir }}" + state: directory + owner: www-data + group: www-data + recurse: Yes + + +## install nextcloud: +- name: check if we are installing + stat: path="{{ nc_dir }}" + register: nextcloud + +- name: create database with name 'nextcloud' mysql_db: login_unix_socket: /var/run/mysqld/mysqld.sock name: nextcloud state: present + when: not nextcloud.stat.exists - name: create database user 'nextcloud' mysql_user: @@ -99,10 +121,7 @@ password: "{{ db_nextcloud_pwd }}" priv: 'nextcloud.*:ALL' state: present - -- name: check if we are installing - stat: path="{{ nc_dir }}" - register: nextcloud + when: not nextcloud.stat.exists - name: unpack nextcloud archive unarchive: @@ -110,15 +129,7 @@ dest: "{{ www_root }}" owner: www-data group: www-data - creates: "{{ nc_dir }}" - -- name: make sure data directory exists - file: - path: "{{ data_dir }}" - state: directory - owner: www-data - group: www-data - recurse: Yes + when: not nextcloud.stat.exists - name: initialize nextcloud command: @@ -133,14 +144,13 @@ --data-dir "{{ data_dir }}" args: chdir: "{{ nc_dir }}" - creates: "{{ nc_dir }}/config/config.php" no_log: True + when: not nextcloud.stat.exists - name: dump nc-admin password shell: echo -n "{{ nc_admin_pwd }}" > "{{ nc_admin_pwd_file }}" ; chmod 0600 "{{ nc_admin_pwd_file }}" no_log: True - args: - creates: "{{ nc_admin_pwd_file }}" + when: not nextcloud.stat.exists - name: enable APCu memcache command: sudo -u www-data php ./occ config:system:set memcache.local --value='\OC\Memcache\APCu' @@ -156,4 +166,26 @@ warn: False when: not nextcloud.stat.exists -## ToDo: enable apps etc., update + +## app installations: +- name: check if calendar app is installed + stat: path="{{ nc_dir }}/apps/calendar" + register: calendar + +- name: install calendar app + command: sudo -u www-data php ./occ app:install calendar + args: + chdir: "{{ nc_dir }}" + warn: False + when: not calendar.stat.exists + +- name: check if notes app is installed + stat: path="{{ nc_dir }}/apps/notes" + register: notes + +- name: install notes app + command: sudo -u www-data php ./occ app:install notes + args: + chdir: "{{ nc_dir }}" + warn: False + when: not notes.stat.exists From 97e980fbf7812e5ce231f6f491b44467124bee92 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 15 Jan 2020 19:47:06 +0100 Subject: [PATCH 073/504] Move content from htaccess file to site config. Separate krb5 config. --- roles/nextcloud/files/htaccess | 8 ------- roles/nextcloud/files/krb5-nextcloud.conf | 24 --------------------- roles/nextcloud/files/nextcloud.conf | 14 ++++++++---- roles/nextcloud/tasks/main.yml | 26 ++++++++++++++++------- 4 files changed, 28 insertions(+), 44 deletions(-) delete mode 100644 roles/nextcloud/files/htaccess diff --git a/roles/nextcloud/files/htaccess b/roles/nextcloud/files/htaccess deleted file mode 100644 index ad8b40f..0000000 --- a/roles/nextcloud/files/htaccess +++ /dev/null @@ -1,8 +0,0 @@ - - RewriteEngine on - RewriteRule ^\.well-known/host-meta /nextcloud/public.php?service=host-meta [QSA,L] - RewriteRule ^\.well-known/host-meta\.json /nextcloud/public.php?service=host-meta-json [QSA,L] - RewriteRule ^\.well-known/webfinger /nextcloud/public.php?service=webfinger [QSA,L] - RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L] - RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L] - diff --git a/roles/nextcloud/files/krb5-nextcloud.conf b/roles/nextcloud/files/krb5-nextcloud.conf index 10b9e82..9ccb2ab 100644 --- a/roles/nextcloud/files/krb5-nextcloud.conf +++ b/roles/nextcloud/files/krb5-nextcloud.conf @@ -1,5 +1,3 @@ -Alias /nextcloud "/var/www/nextcloud/" - AuthType GSSAPI AuthName "Login to NextCloud" @@ -11,25 +9,3 @@ Alias /nextcloud "/var/www/nextcloud/" GssapiBasicAuth On require valid-user - - - Require all granted - Options FollowSymlinks MultiViews - AllowOverride All - - - Dav off - - - SetEnv HOME /var/www/nextcloud - SetEnv HTTP_HOME /var/www/nextcloud - - - - - AllowOverride FileInfo - - - - Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" - diff --git a/roles/nextcloud/files/nextcloud.conf b/roles/nextcloud/files/nextcloud.conf index d7cb013..635f7ee 100644 --- a/roles/nextcloud/files/nextcloud.conf +++ b/roles/nextcloud/files/nextcloud.conf @@ -1,6 +1,6 @@ -Alias /nextcloud "/var/www/nextcloud/" +Alias /nextcloud "/var/www/nextcloud" - + Require all granted Options FollowSymlinks MultiViews AllowOverride All @@ -11,11 +11,17 @@ Alias /nextcloud "/var/www/nextcloud/" SetEnv HOME /var/www/nextcloud SetEnv HTTP_HOME /var/www/nextcloud - - AllowOverride FileInfo + + RewriteEngine on + RewriteRule ^\.well-known/host-meta /nextcloud/public.php?service=host-meta [QSA,L] + RewriteRule ^\.well-known/host-meta\.json /nextcloud/public.php?service=host-meta-json [QSA,L] + RewriteRule ^\.well-known/webfinger /nextcloud/public.php?service=webfinger [QSA,L] + RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L] + RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L] + diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 2f51ad8..3ac9c2e 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -75,16 +75,13 @@ copy: src: nextcloud.conf dest: /etc/apache2/sites-available/nextcloud.conf + notify: "restart apache2" -- name: provide htaccess file +- name: provide kerberos SSO config copy: - src: htaccess - dest: /var/www/html/.htaccess - -- name: enable https - command: a2ensite default-ssl.conf - args: - creates: /etc/apache2/sites-enabled/default-ssl.conf + src: krb5-nextcloud.conf + dest: /etc/apache2/sites-available/krb5-nextcloud.conf + when: "'kerberize' in role_names" notify: "restart apache2" - name: enable nextcloud site @@ -93,6 +90,19 @@ creates: /etc/apache2/sites-enabled/nextcloud.conf notify: "restart apache2" +- name: enable kerberos access to nextcloud site + command: a2ensite krb5-nextcloud.conf + args: + creates: /etc/apache2/sites-enabled/krb5-nextcloud.conf + notify: "restart apache2" + when: "'kerberize' in role_names" + +- name: enable https + command: a2ensite default-ssl.conf + args: + creates: /etc/apache2/sites-enabled/default-ssl.conf + notify: "restart apache2" + - name: make sure data directory exists file: path: "{{ data_dir }}" From 0f9e8d212412a8b4c74fc9756ca352aef645e51b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 16 Jan 2020 18:56:32 +0100 Subject: [PATCH 074/504] Implement nextcloudcron systemd timer. --- roles/nextcloud/files/nextcloudcron.service | 6 +++++ roles/nextcloud/files/nextcloudcron.timer | 10 +++++++++ roles/nextcloud/handlers/main.yml | 7 ++++++ roles/nextcloud/tasks/main.yml | 25 +++++++++++++++++++++ 4 files changed, 48 insertions(+) create mode 100644 roles/nextcloud/files/nextcloudcron.service create mode 100644 roles/nextcloud/files/nextcloudcron.timer diff --git a/roles/nextcloud/files/nextcloudcron.service b/roles/nextcloud/files/nextcloudcron.service new file mode 100644 index 0000000..79f01dc --- /dev/null +++ b/roles/nextcloud/files/nextcloudcron.service @@ -0,0 +1,6 @@ +[Unit] +Description=Nextcloud cron.php job + +[Service] +User=www-data +ExecStart=/usr/bin/php -f /var/www/nextcloud/cron.php diff --git a/roles/nextcloud/files/nextcloudcron.timer b/roles/nextcloud/files/nextcloudcron.timer new file mode 100644 index 0000000..eda82c9 --- /dev/null +++ b/roles/nextcloud/files/nextcloudcron.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Run Nextcloud cron.php every 5 minutes + +[Timer] +OnBootSec=5min +OnUnitActiveSec=5min +Unit=nextcloudcron.service + +[Install] +WantedBy=timers.target diff --git a/roles/nextcloud/handlers/main.yml b/roles/nextcloud/handlers/main.yml index 9d2f7c6..17822fa 100644 --- a/roles/nextcloud/handlers/main.yml +++ b/roles/nextcloud/handlers/main.yml @@ -9,3 +9,10 @@ name: php{{ php_ver.stdout }}-fpm state: restarted listen: "restart php-fpm" + +- name: enable nextcloudcron.service and .timer + systemd: + name: nextcloudcron.timer + state: started + enabled: True + listen: "enable nextcloudcron.service" diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 3ac9c2e..3f3649c 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -199,3 +199,28 @@ chdir: "{{ nc_dir }}" warn: False when: not notes.stat.exists + +## nextcloudcron +- name: provide nextcloudcron.service and .timer + copy: + src: "{{ item }}" + dest: "/etc/systemd/system/{{ item }}" + with_items: + - nextcloudcron.service + - nextcloudcron.timer + register: nextcloudcron + notify: "enable nextcloudcron.service" + +- name: switch to systemd timer + command: sudo -u www-data php ./occ background:cron + args: + chdir: "{{ nc_dir }}" + warn: False + when: nextcloudcron.changed + + +## ToDo kerberox integration: +# sudo -u www-data php ./occ app:enable user_ldap +# sudo -u www-data php ./occ app:install user_saml + +# sudo -u www-data php ./occ ldap From ee86d488bd9c9efa68332ac23ece50d842bf1a4e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 18 Jan 2020 14:31:25 +0100 Subject: [PATCH 075/504] Experimental systemd-networkd. --- roles/systemd-networkd/handlers/main.yml | 16 ++++++++------- roles/systemd-networkd/tasks/main.yml | 25 ++++++++++++++++-------- 2 files changed, 26 insertions(+), 15 deletions(-) diff --git a/roles/systemd-networkd/handlers/main.yml b/roles/systemd-networkd/handlers/main.yml index 8d3068c..eaf56fa 100644 --- a/roles/systemd-networkd/handlers/main.yml +++ b/roles/systemd-networkd/handlers/main.yml @@ -2,12 +2,14 @@ systemd: name: systemd-networkd enabled: yes + state: restarted daemon_reload: yes - listen: "enable systemd-networkd" + listen: "start and enable systemd-networkd" -- name: enable systemd-resolved - systemd: - name: systemd-resolved - enabled: yes - daemon_reload: yes - listen: "enable systemd-resolved" +- name: use systemd-resolved + file: + src: /run/systemd/resolve/stub-resolv.conf + dest: /etc/resolv.conf + state: link + force: Yes + listen: "use systemd-resolved" diff --git a/roles/systemd-networkd/tasks/main.yml b/roles/systemd-networkd/tasks/main.yml index 28426e6..f863fa0 100644 --- a/roles/systemd-networkd/tasks/main.yml +++ b/roles/systemd-networkd/tasks/main.yml @@ -1,8 +1,16 @@ +- name: check if /etc/network/interfaces is still there + stat: path=/etc/network/interfaces + register: interfaces + +- name: move /etc/network/interfaces away + command: mv /etc/network/interfaces /etc/network/interfaces_disabled + when: interfaces.stat.exists + - name: install dynamic configuration for networkd copy: src: 10-dhcp.network dest: /etc/systemd/network/10-dhcp.network - notify: "enable systemd-networkd" + notify: "start and enable systemd-networkd" #- name: install static configuration for networkd # template: @@ -10,10 +18,11 @@ # dest: /etc/systemd/network/20-static.network # notify: "enable systemd-networkd" -- name: prepare systemd-resolved - file: - src: /run/systemd/resolve/resolv.conf - dest: /etc/resolv.conf - state: link - force: yes - notify: "enable systemd-resolved" +- name: enable systemd-resolved + systemd: + name: systemd-resolved + enabled: yes + state: started + notify: "use systemd-resolved" + +- meta: flush_handlers From 6d33f49fad6d90b5536fffaa0aab288e5cf13f84 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 18 Jan 2020 14:37:52 +0100 Subject: [PATCH 076/504] Minor fixes and improvements. --- README | 1 + cloudbox.yml | 9 +++++---- roles/nextcloud/files/nextcloud.conf | 3 ++- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/README b/README index 490c984..f6f1dbb 100644 --- a/README +++ b/README @@ -27,6 +27,7 @@ offers ansible playbooks and instructions for the following machines: • cloudbox: nextcloud server in the basement - setup of a home cloud server - dynamic DNS name + - nextcloud - … Contributions like patches, suggestions, pull requests and/or further diff --git a/cloudbox.yml b/cloudbox.yml index 6580f35..1462cf3 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -12,9 +12,10 @@ DNS: "192.168.2.1" ddns_domain: "something.ddnss.de" ddns_updkey: "138638.some.key.here.635620" + ansible_python_interpreter: "/usr/bin/python3" + roles: - up2date-debian - - systemd-networkd - - web-server - - ddns-update - - low-power +# - ddns-update +# - low-power + - nextcloud diff --git a/roles/nextcloud/files/nextcloud.conf b/roles/nextcloud/files/nextcloud.conf index 635f7ee..17ee2ac 100644 --- a/roles/nextcloud/files/nextcloud.conf +++ b/roles/nextcloud/files/nextcloud.conf @@ -4,6 +4,7 @@ Alias /nextcloud "/var/www/nextcloud" Require all granted Options FollowSymlinks MultiViews AllowOverride All + Satisfy Any Dav off @@ -21,7 +22,7 @@ Alias /nextcloud "/var/www/nextcloud" RewriteRule ^\.well-known/webfinger /nextcloud/public.php?service=webfinger [QSA,L] RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L] RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L] - + From 31be0f1fc7b77e3acb7c4541214f39d82bfc350b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 18 Jan 2020 14:39:25 +0100 Subject: [PATCH 077/504] Only enable https if not available already. --- roles/nextcloud/tasks/main.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 3f3649c..0835562 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -98,10 +98,13 @@ when: "'kerberize' in role_names" - name: enable https - command: a2ensite default-ssl.conf + shell: 'grep -q "VirtualHost .*:443" * || a2ensite default-ssl.conf' args: - creates: /etc/apache2/sites-enabled/default-ssl.conf + chdir: /etc/apache2/sites-enabled/ + creates: default-ssl.conf notify: "restart apache2" + register: cmd_result + changed_when: cmd_result.stdout != '' and cmd_result.stdout is not search('skipped') - name: make sure data directory exists file: @@ -109,7 +112,6 @@ state: directory owner: www-data group: www-data - recurse: Yes ## install nextcloud: From 0a32f99552e004b340e39fbd82522c6fc35d718d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 18 Jan 2020 14:42:26 +0100 Subject: [PATCH 078/504] App installation and updater. --- roles/nextcloud/tasks/main.yml | 45 ++++++++++++++++------------------ 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 0835562..cbe40c4 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -178,30 +178,6 @@ warn: False when: not nextcloud.stat.exists - -## app installations: -- name: check if calendar app is installed - stat: path="{{ nc_dir }}/apps/calendar" - register: calendar - -- name: install calendar app - command: sudo -u www-data php ./occ app:install calendar - args: - chdir: "{{ nc_dir }}" - warn: False - when: not calendar.stat.exists - -- name: check if notes app is installed - stat: path="{{ nc_dir }}/apps/notes" - register: notes - -- name: install notes app - command: sudo -u www-data php ./occ app:install notes - args: - chdir: "{{ nc_dir }}" - warn: False - when: not notes.stat.exists - ## nextcloudcron - name: provide nextcloudcron.service and .timer copy: @@ -220,6 +196,27 @@ warn: False when: nextcloudcron.changed +- name: check/run upgrade + command: sudo -u www-data php updater.phar --no-interaction + args: + chdir: "{{ nc_dir }}/updater" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is not search('Nothing to do.') + +### app installations: +- name: install extra apps + command: "sudo -u www-data php ./occ app:install {{ item }}" + args: + chdir: "{{ nc_dir }}" + warn: False + with_items: + - calendar + - notes + register: cmd_result + changed_when: cmd_result.stdout is not search('already installed') + failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 + ## ToDo kerberox integration: # sudo -u www-data php ./occ app:enable user_ldap From 985cc477b56b642bfc426c1d23a6e0e878fb02d9 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 19 Jan 2020 18:47:12 +0100 Subject: [PATCH 079/504] Minor fixes and cleanup nextcloud role. --- host_vars/blackbox.yml | 1 + host_vars/bluebox.yml | 1 + roles/nextcloud/defaults/main.yml | 1 + roles/nextcloud/handlers/main.yml | 2 +- roles/nextcloud/tasks/main.yml | 40 ++++++++++++++++++------------- 5 files changed, 28 insertions(+), 17 deletions(-) create mode 100644 host_vars/blackbox.yml create mode 100644 host_vars/bluebox.yml diff --git a/host_vars/blackbox.yml b/host_vars/blackbox.yml new file mode 100644 index 0000000..3fff54c --- /dev/null +++ b/host_vars/blackbox.yml @@ -0,0 +1 @@ +allow_download: True diff --git a/host_vars/bluebox.yml b/host_vars/bluebox.yml new file mode 100644 index 0000000..3fff54c --- /dev/null +++ b/host_vars/bluebox.yml @@ -0,0 +1 @@ +allow_download: True diff --git a/roles/nextcloud/defaults/main.yml b/roles/nextcloud/defaults/main.yml index 4b8122f..f55220f 100644 --- a/roles/nextcloud/defaults/main.yml +++ b/roles/nextcloud/defaults/main.yml @@ -4,3 +4,4 @@ nc_admin_pwd_file: "/root/nc-admin.pwd" www_root: "/var/www" nc_dir: "{{ www_root }}/nextcloud" data_dir: "/var/nc-data" +allow_download: False diff --git a/roles/nextcloud/handlers/main.yml b/roles/nextcloud/handlers/main.yml index 17822fa..f514172 100644 --- a/roles/nextcloud/handlers/main.yml +++ b/roles/nextcloud/handlers/main.yml @@ -15,4 +15,4 @@ name: nextcloudcron.timer state: started enabled: True - listen: "enable nextcloudcron.service" + listen: "enable nextcloudcron.timer" diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index cbe40c4..1ed27f1 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -1,4 +1,24 @@ -## Install and configure nextcloud +## Install and configure nextcloud. + +- name: check if we are installing + stat: path="{{ nc_dir }}" + register: nextcloud + +- name: check for nextcloud archive + local_action: stat path=nextcloud.tar.bz2 + become: No + register: nc_archive + when: not nextcloud.stat.exists + +- name: stop if nextcloud archive is unavailable + fail: + msg: > + The nextcloud archive nextcloud.tar.bz2 is not available. + Download the latest stable release from 'nextcloud.com', + check the signature, rename it and copy it next to 'cloudbox.yml'. + when: not nextcloud.stat.exists and not nc_archive.stat.exists + +## We can start with the installation now: - name: install apache, php- and db-packages apt: @@ -113,12 +133,7 @@ owner: www-data group: www-data - ## install nextcloud: -- name: check if we are installing - stat: path="{{ nc_dir }}" - register: nextcloud - - name: create database with name 'nextcloud' mysql_db: login_unix_socket: /var/run/mysqld/mysqld.sock @@ -186,15 +201,7 @@ with_items: - nextcloudcron.service - nextcloudcron.timer - register: nextcloudcron - notify: "enable nextcloudcron.service" - -- name: switch to systemd timer - command: sudo -u www-data php ./occ background:cron - args: - chdir: "{{ nc_dir }}" - warn: False - when: nextcloudcron.changed + notify: "enable nextcloudcron.timer" - name: check/run upgrade command: sudo -u www-data php updater.phar --no-interaction @@ -203,6 +210,7 @@ warn: False register: cmd_result changed_when: cmd_result.stdout is not search('Nothing to do.') + when: allow_download ### app installations: - name: install extra apps @@ -216,7 +224,7 @@ register: cmd_result changed_when: cmd_result.stdout is not search('already installed') failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 - + when: allow_download ## ToDo kerberox integration: # sudo -u www-data php ./occ app:enable user_ldap From 004919824c477823a103203cfc6ca3b41f17753b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 19 Jan 2020 18:51:58 +0100 Subject: [PATCH 080/504] Implement borg backup role. --- README | 17 ++++++++++++ cloudbox.yml | 9 +++++-- roles/backup/defaults/main.yml | 8 ++++++ roles/backup/files/backup.service | 6 +++++ roles/backup/files/backup.timer | 10 +++++++ roles/backup/handlers/main.yml | 6 +++++ roles/backup/tasks/main.yml | 32 +++++++++++++++++++++++ roles/backup/templates/backup | 43 +++++++++++++++++++++++++++++++ 8 files changed, 129 insertions(+), 2 deletions(-) create mode 100644 roles/backup/defaults/main.yml create mode 100644 roles/backup/files/backup.service create mode 100644 roles/backup/files/backup.timer create mode 100644 roles/backup/handlers/main.yml create mode 100644 roles/backup/tasks/main.yml create mode 100755 roles/backup/templates/backup diff --git a/README b/README index f6f1dbb..52a83b0 100644 --- a/README +++ b/README @@ -88,3 +88,20 @@ Kiosk • run ansible: ssh-copy-id ansible@1.2.3.4 ansible-playbook kiosk.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + +Cloudbox +~~~~~~~~ + • Debian installation: + - user 'ansible' in sudo group + + • check/customize cloudbox.yml + + • download latest nextcloud-*.*.*.tar.bz2 archive and place it as nextcloud.tar.bz2 + in your debian-lan-ansible directory + + • run ansible: + ssh-copy-id ansible@1.2.3.4 + ansible-playbook cloudbox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + + • use 'nc-admin' with password in '/root/nc-admin.pwd' to log into nextcloud. + diff --git a/cloudbox.yml b/cloudbox.yml index 1462cf3..ae46714 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -2,9 +2,9 @@ # This playbook deploys the cloudbox on a minimal installation. - name: apply configuration to the cloudbox - hosts: cloudboxes + hosts: all remote_user: ansible - become: yes + become: Yes vars: if_lan: "enp1s0" ipaddr: "192.168.2.50/24" @@ -12,6 +12,10 @@ DNS: "192.168.2.1" ddns_domain: "something.ddnss.de" ddns_updkey: "138638.some.key.here.635620" + backup_opts: "--exclude-caches -e '*/updater-*/' -e '*/preview/*' -e '*/files_trashbin/*'" + backup_dirs: + - "{{ nc_dir }}" + - "{{ data_dir }}" ansible_python_interpreter: "/usr/bin/python3" roles: @@ -19,3 +23,4 @@ # - ddns-update # - low-power - nextcloud + - backup diff --git a/roles/backup/defaults/main.yml b/roles/backup/defaults/main.yml new file mode 100644 index 0000000..fd66655 --- /dev/null +++ b/roles/backup/defaults/main.yml @@ -0,0 +1,8 @@ +borg_pwd: "{{ lookup('password', '/tmp/borg.pwd length=24') }}" +borg_pwd_file: "/root/borg.pwd" +borg_key_backup: "/root/borg-key.backup" + +## alternative: "ssh://user@host:port/path/to/repo" +backup_repo: "/var/backups/mnt/backup/borg" + +backup_opts: "--exclude-caches" diff --git a/roles/backup/files/backup.service b/roles/backup/files/backup.service new file mode 100644 index 0000000..6f653c2 --- /dev/null +++ b/roles/backup/files/backup.service @@ -0,0 +1,6 @@ +[Unit] +Description=Run backup script + +[Service] +Type=simple +ExecStart=/usr/local/bin/backup diff --git a/roles/backup/files/backup.timer b/roles/backup/files/backup.timer new file mode 100644 index 0000000..866729d --- /dev/null +++ b/roles/backup/files/backup.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Run backup script daily + +[Timer] +OnCalendar=*-*-* 4:00:00 +Persistent=true +AccuracySec=15min + +[Install] +WantedBy=timers.target diff --git a/roles/backup/handlers/main.yml b/roles/backup/handlers/main.yml new file mode 100644 index 0000000..43950ec --- /dev/null +++ b/roles/backup/handlers/main.yml @@ -0,0 +1,6 @@ +- name: enable backup.service and .timer + systemd: + name: backup.timer + state: started + enabled: True + listen: "enable backup.timer" diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml new file mode 100644 index 0000000..5cbd241 --- /dev/null +++ b/roles/backup/tasks/main.yml @@ -0,0 +1,32 @@ +- name: install borg + apt: + name: borgbackup + state: latest + +- name: check if borg password is available + stat: path="{{ borg_pwd_file }}" + register: borg + +- name: dump borg password + shell: echo -n "{{ borg_pwd }}" > "{{ borg_pwd_file }}" ; chmod 0600 "{{ borg_pwd_file }}" + no_log: True + when: not borg.stat.exists + +- name: provide backup script + template: + src: "backup" + dest: "/usr/local/bin/backup" + mode: "0750" + +- name: provide backup.service and .timer + copy: + src: "{{ item }}" + dest: "/etc/systemd/system/{{ item }}" + with_items: + - backup.service + - backup.timer + notify: "enable backup.timer" + +- name: run first backup + command: /usr/local/bin/backup + when: not borg.stat.exists diff --git a/roles/backup/templates/backup b/roles/backup/templates/backup new file mode 100755 index 0000000..9c03514 --- /dev/null +++ b/roles/backup/templates/backup @@ -0,0 +1,43 @@ +#!/bin/bash +set -eu + +REPOSITORY="{{ backup_repo }}" +BACKUP=({{ backup_dirs|join(' ') }}) +EXTRAOPTIONS=({{ backup_opts }}) +export BORG_PASSCOMMAND="cat {{ borg_pwd_file }}" +MOUNTED="" + +MNT="$(echo "$REPOSITORY" | sed "s|\(^.*/mnt\).*|\1|")" +if grep -q "$MNT" /etc/fstab ; then + [ -d "$REPOSITORY" ] || mount -v "$MNT" && MOUNTED="TRUE" +fi + +if [ ! -d "$REPOSITORY" ] ; then + mkdir -vp --mode=0750 "$REPOSITORY" + borg init --encryption=repokey "$REPOSITORY" + borg key export "$REPOSITORY" "{{ borg_key_backup }}" +fi + +if [ -e "{{ nc_dir }}/config/config.php" ] ; then + NCDB="{{ data_dir }}/nextcloud-database.dump" + sudo -u www-data /usr/bin/php {{ nc_dir }}/occ maintenance:mode --on + PW="$(grep dbpassword {{ nc_dir }}/config/config.php | \ + sed -e "s/\W*'dbpassword' => '//" -e "s/',$//")" + + echo -n "Dumping data base into '$NCDB' … " + mysqldump --single-transaction -h localhost -u nextcloud -p"$PW" nextcloud > "$NCDB" + chmod 600 "$NCDB" + echo "done." +fi + +ARCHIVE="$(date +%Y-%m-%d-%H:%M)" +echo "Backup ${BACKUP[@]} to $REPOSITORY." +borg create -v "${EXTRAOPTIONS[@]}" "$REPOSITORY::$ARCHIVE" "${BACKUP[@]}" + +if [ -e "{{ nc_dir }}/config/config.php" ] ; then + sudo -u www-data /usr/bin/php {{ nc_dir }}/occ maintenance:mode --off +fi + +if [ "$MOUNTED" = "TRUE" ] ; then + umount -v "$MNT" +fi From 8a821f501da2e70c9e91a4a974fe23f1ace73af3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 20 Jan 2020 19:01:49 +0100 Subject: [PATCH 081/504] Move list of apps to playbook variable. --- cloudbox.yml | 3 +++ roles/nextcloud/tasks/main.yml | 4 +--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/cloudbox.yml b/cloudbox.yml index ae46714..27fe60f 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -12,6 +12,9 @@ DNS: "192.168.2.1" ddns_domain: "something.ddnss.de" ddns_updkey: "138638.some.key.here.635620" + nc_apps: + - calendar + - notes backup_opts: "--exclude-caches -e '*/updater-*/' -e '*/preview/*' -e '*/files_trashbin/*'" backup_dirs: - "{{ nc_dir }}" diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 1ed27f1..8dfd682 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -218,9 +218,7 @@ args: chdir: "{{ nc_dir }}" warn: False - with_items: - - calendar - - notes + with_items: "{{ nc_apps }}" register: cmd_result changed_when: cmd_result.stdout is not search('already installed') failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 From 23766673bef50cf03fc3347ffd29d680e36c4454 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 20 Jan 2020 19:32:00 +0100 Subject: [PATCH 082/504] Add host-specific variables for backup dirs and options. --- cloudbox.yml | 1 + host_vars/blackbox.yml | 3 +++ roles/backup/defaults/main.yml | 3 +++ roles/backup/templates/backup | 4 ++-- 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/cloudbox.yml b/cloudbox.yml index 27fe60f..9fcfeb7 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -17,6 +17,7 @@ - notes backup_opts: "--exclude-caches -e '*/updater-*/' -e '*/preview/*' -e '*/files_trashbin/*'" backup_dirs: + - "/etc" - "{{ nc_dir }}" - "{{ data_dir }}" ansible_python_interpreter: "/usr/bin/python3" diff --git a/host_vars/blackbox.yml b/host_vars/blackbox.yml index 3fff54c..7e2e4aa 100644 --- a/host_vars/blackbox.yml +++ b/host_vars/blackbox.yml @@ -1 +1,4 @@ allow_download: True +backup_dirs_extra: + - /home +backup_opts_extra: "" diff --git a/roles/backup/defaults/main.yml b/roles/backup/defaults/main.yml index fd66655..63b110b 100644 --- a/roles/backup/defaults/main.yml +++ b/roles/backup/defaults/main.yml @@ -5,4 +5,7 @@ borg_key_backup: "/root/borg-key.backup" ## alternative: "ssh://user@host:port/path/to/repo" backup_repo: "/var/backups/mnt/backup/borg" +backup_dirs_extra: "" + backup_opts: "--exclude-caches" +backup_opts_extra: "" diff --git a/roles/backup/templates/backup b/roles/backup/templates/backup index 9c03514..11c75c1 100755 --- a/roles/backup/templates/backup +++ b/roles/backup/templates/backup @@ -2,8 +2,8 @@ set -eu REPOSITORY="{{ backup_repo }}" -BACKUP=({{ backup_dirs|join(' ') }}) -EXTRAOPTIONS=({{ backup_opts }}) +BACKUP=({{ backup_dirs|join(' ') }} {{ backup_dirs_extra|join(' ') }}) +EXTRAOPTIONS=({{ backup_opts }} {{ backup_opts_extra }}) export BORG_PASSCOMMAND="cat {{ borg_pwd_file }}" MOUNTED="" From e1766a7cfd60f8e20ce1bca84256545718766438 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 21 Jan 2020 16:41:57 +0100 Subject: [PATCH 083/504] Prune backups automatically over time. --- roles/backup/templates/backup | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/roles/backup/templates/backup b/roles/backup/templates/backup index 11c75c1..b20e97c 100755 --- a/roles/backup/templates/backup +++ b/roles/backup/templates/backup @@ -1,21 +1,23 @@ #!/bin/bash set -eu -REPOSITORY="{{ backup_repo }}" BACKUP=({{ backup_dirs|join(' ') }} {{ backup_dirs_extra|join(' ') }}) -EXTRAOPTIONS=({{ backup_opts }} {{ backup_opts_extra }}) +OPTIONS=({{ backup_opts }} {{ backup_opts_extra }}) + +export BORG_REPO="{{ backup_repo }}" export BORG_PASSCOMMAND="cat {{ borg_pwd_file }}" + MOUNTED="" -MNT="$(echo "$REPOSITORY" | sed "s|\(^.*/mnt\).*|\1|")" +MNT="$(echo "$BORG_REPO" | sed "s|\(^.*/mnt\).*|\1|")" if grep -q "$MNT" /etc/fstab ; then - [ -d "$REPOSITORY" ] || mount -v "$MNT" && MOUNTED="TRUE" + [ -d "$BORG_REPO" ] || mount -v "$MNT" && MOUNTED="TRUE" fi -if [ ! -d "$REPOSITORY" ] ; then - mkdir -vp --mode=0750 "$REPOSITORY" - borg init --encryption=repokey "$REPOSITORY" - borg key export "$REPOSITORY" "{{ borg_key_backup }}" +if [ ! -d "$BORG_REPO" ] ; then + mkdir -vp --mode=0750 "$BORG_REPO" + borg init --encryption=repokey + borg key export "{{ borg_key_backup }}" fi if [ -e "{{ nc_dir }}/config/config.php" ] ; then @@ -30,9 +32,14 @@ if [ -e "{{ nc_dir }}/config/config.php" ] ; then echo "done." fi -ARCHIVE="$(date +%Y-%m-%d-%H:%M)" -echo "Backup ${BACKUP[@]} to $REPOSITORY." -borg create -v "${EXTRAOPTIONS[@]}" "$REPOSITORY::$ARCHIVE" "${BACKUP[@]}" +echo "Backup ${BACKUP[@]} to $BORG_REPO." +borg create -v --show-rc "${OPTIONS[@]}" ::'{hostname}-{now}' "${BACKUP[@]}" + +borg prune -v --list --prefix='{hostname}-' --show-rc \ + --keep-daily 14 \ + --keep-weekly 8 \ + --keep-monthly 6 \ + --keep-yearly 10 if [ -e "{{ nc_dir }}/config/config.php" ] ; then sudo -u www-data /usr/bin/php {{ nc_dir }}/occ maintenance:mode --off From 29fb8f9420138d2ce31513fb6ea2e90626f1c124 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 21 Jan 2020 20:50:18 +0100 Subject: [PATCH 084/504] Move extra_pkgs*-handling to the up2date-debian role. --- roles/kiosk/tasks/main.yml | 14 -------------- roles/lan-client/tasks/main.yml | 14 -------------- roles/up2date-debian/defaults/main.yml | 2 ++ roles/up2date-debian/tasks/main.yml | 20 ++++++++++++++++++++ 4 files changed, 22 insertions(+), 28 deletions(-) create mode 100644 roles/up2date-debian/defaults/main.yml diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index 93aaea8..60ab55e 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -1,17 +1,3 @@ -- name: install extra packages from stable - apt: name={{ extra_pkgs }} state=latest - -- name: add {{ ansible_distribution_release }}-backports - apt_repository: - repo: deb http://deb.debian.org/debian/ {{ ansible_distribution_release }}-backports main - state: present - update_cache: yes - when: extra_pkgs_bpo|length - -- name: install extra packages from backports - apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ ansible_distribution_release }}-backports - when: extra_pkgs_bpo|length - ## Check which display manager is used: - name: check if gdm3 is installed stat: path=/etc/gdm3/daemon.conf diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index 24bfacc..9b793a3 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -52,20 +52,6 @@ ## oddjob-mkhomedir works only with sec=sys for the NFSv4 share -- name: install extra packages from stable - apt: name={{ extra_pkgs }} state=latest - -- name: add {{ ansible_distribution_release }}-backports - apt_repository: - repo: deb http://deb.debian.org/debian/ {{ ansible_distribution_release }}-backports main - state: present - update_cache: yes - when: extra_pkgs_bpo|length - -- name: install extra packages from backports - apt: name={{ extra_pkgs_bpo }} state=latest default_release={{ ansible_distribution_release }}-backports - when: extra_pkgs_bpo|length - - name: provide identities from directory template: src: sssd.conf.j2 diff --git a/roles/up2date-debian/defaults/main.yml b/roles/up2date-debian/defaults/main.yml new file mode 100644 index 0000000..97d8c9b --- /dev/null +++ b/roles/up2date-debian/defaults/main.yml @@ -0,0 +1,2 @@ +extra_pkgs: "" +extra_pkgs_bpo: "" diff --git a/roles/up2date-debian/tasks/main.yml b/roles/up2date-debian/tasks/main.yml index 8cb8dcc..cd11949 100644 --- a/roles/up2date-debian/tasks/main.yml +++ b/roles/up2date-debian/tasks/main.yml @@ -15,3 +15,23 @@ apt: name: etckeeper state: latest + +- name: install extra packages from stable + apt: + name: "{{ extra_pkgs }}" + state: latest + when: extra_pkgs|length + +- name: add {{ ansible_distribution_release }}-backports + apt_repository: + repo: deb http://deb.debian.org/debian/ {{ ansible_distribution_release }}-backports main + state: present + update_cache: yes + when: extra_pkgs_bpo|length + +- name: install extra packages from backports + apt: + name: "{{ extra_pkgs_bpo }}" + state: latest + default_release: "{{ ansible_distribution_release }}-backports" + when: extra_pkgs_bpo|length From 456f5c9870af908b1b3fa9c36b7d0c507384e51a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 23 Jan 2020 16:01:15 +0100 Subject: [PATCH 085/504] Integrate firewalld, minor fixes/improvements. --- roles/backup/defaults/main.yml | 2 +- roles/backup/templates/backup | 3 ++- roles/nextcloud/tasks/main.yml | 14 ++++++++++++-- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/roles/backup/defaults/main.yml b/roles/backup/defaults/main.yml index 63b110b..172d822 100644 --- a/roles/backup/defaults/main.yml +++ b/roles/backup/defaults/main.yml @@ -1,4 +1,4 @@ -borg_pwd: "{{ lookup('password', '/tmp/borg.pwd length=24') }}" +borg_pwd: "{{ lookup('password', '/tmp/borg.pwd length=32') }}" borg_pwd_file: "/root/borg.pwd" borg_key_backup: "/root/borg-key.backup" diff --git a/roles/backup/templates/backup b/roles/backup/templates/backup index b20e97c..4d5c6e7 100755 --- a/roles/backup/templates/backup +++ b/roles/backup/templates/backup @@ -6,6 +6,7 @@ OPTIONS=({{ backup_opts }} {{ backup_opts_extra }}) export BORG_REPO="{{ backup_repo }}" export BORG_PASSCOMMAND="cat {{ borg_pwd_file }}" +KEY_BACKUP="{{ borg_key_backup }}" MOUNTED="" @@ -17,7 +18,7 @@ fi if [ ! -d "$BORG_REPO" ] ; then mkdir -vp --mode=0750 "$BORG_REPO" borg init --encryption=repokey - borg key export "{{ borg_key_backup }}" + borg key export "$BORG_REPO" "$KEY_BACKUP" fi if [ -e "{{ nc_dir }}/config/config.php" ] ; then diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 8dfd682..a8f0747 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -20,10 +20,11 @@ ## We can start with the installation now: -- name: install apache, php- and db-packages +- name: install apache, firewalld, php- and db-packages apt: name: - apache2 + - firewalld - mariadb-server - python3-pymysql - php-apcu @@ -38,6 +39,7 @@ - php-mysql - php-xml - php-zip + - unzip state: latest - name: disable apache modules @@ -212,7 +214,7 @@ changed_when: cmd_result.stdout is not search('Nothing to do.') when: allow_download -### app installations: +## app installations: - name: install extra apps command: "sudo -u www-data php ./occ app:install {{ item }}" args: @@ -224,6 +226,14 @@ failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 when: allow_download +- name: allow https in firewalld + firewalld: + service: https + permanent: Yes + immediate: Yes + state: enabled + + ## ToDo kerberox integration: # sudo -u www-data php ./occ app:enable user_ldap # sudo -u www-data php ./occ app:install user_saml From 8c72a4bec7be68c020ac1342276eb9592f026d35 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 24 Jan 2020 19:55:36 +0100 Subject: [PATCH 086/504] Implement direct download during installation. --- cloudbox.yml | 4 ++++ roles/nextcloud/tasks/main.yml | 34 +++++++++++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 3 deletions(-) diff --git a/cloudbox.yml b/cloudbox.yml index 9fcfeb7..16d8bfe 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -12,6 +12,10 @@ DNS: "192.168.2.1" ddns_domain: "something.ddnss.de" ddns_updkey: "138638.some.key.here.635620" + ## 'nc_download' and 'nc_checksum' are only + ## used for ansible-pull during installation: + nc_download: "https://download.nextcloud.com/server/releases/latest.tar.bz2" + nc_checksum: "sha256:194095a5586d84040bc455f77b8aa6c80f9a6a6dd713c9aebdad046713d4267b" nc_apps: - calendar - notes diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index a8f0747..b247284 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -16,7 +16,9 @@ The nextcloud archive nextcloud.tar.bz2 is not available. Download the latest stable release from 'nextcloud.com', check the signature, rename it and copy it next to 'cloudbox.yml'. - when: not nextcloud.stat.exists and not nc_archive.stat.exists + when: > + not nextcloud.stat.exists and not nc_archive.stat.exists and + not run_in_installer|default(false)|bool ## We can start with the installation now: @@ -136,6 +138,10 @@ group: www-data ## install nextcloud: +- name: start mariadb during installation + command: /etc/init.d/mysql start + when: run_in_installer|default(false)|bool + - name: create database with name 'nextcloud' mysql_db: login_unix_socket: /var/run/mysqld/mysqld.sock @@ -152,13 +158,29 @@ state: present when: not nextcloud.stat.exists -- name: unpack nextcloud archive +- name: download nextcloud archive + get_url: + url: "{{ nc_download }}" + dest: /tmp/nextcloud.tar.bz2 + checksum: "{{ nc_checksum }}" + when: run_in_installer|default(false)|bool + +- name: unpack downloaded nextcloud archive + unarchive: + src: /tmp/nextcloud.tar.bz2 + dest: "{{ www_root }}" + owner: www-data + group: www-data + remote_src: Yes + when: not nextcloud.stat.exists and run_in_installer|default(false)|bool + +- name: unpack provided nextcloud archive unarchive: src: nextcloud.tar.bz2 dest: "{{ www_root }}" owner: www-data group: www-data - when: not nextcloud.stat.exists + when: not nextcloud.stat.exists and not run_in_installer|default(false)|bool - name: initialize nextcloud command: @@ -232,6 +254,12 @@ permanent: Yes immediate: Yes state: enabled + when: not run_in_installer|default(false)|bool + +- name: allow https in firewalld, offline + command: "firewall-offline-cmd --add-service=https" + when: run_in_installer|default(false)|bool + ## ToDo kerberox integration: From f1008d778f1e5ae109d8550581fe9d05e6394b9b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 26 Jan 2020 10:37:29 +0100 Subject: [PATCH 087/504] Prepare database after (succussful) download only. --- roles/nextcloud/tasks/main.yml | 40 +++++++++++++++++----------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index b247284..4210376 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -138,26 +138,6 @@ group: www-data ## install nextcloud: -- name: start mariadb during installation - command: /etc/init.d/mysql start - when: run_in_installer|default(false)|bool - -- name: create database with name 'nextcloud' - mysql_db: - login_unix_socket: /var/run/mysqld/mysqld.sock - name: nextcloud - state: present - when: not nextcloud.stat.exists - -- name: create database user 'nextcloud' - mysql_user: - login_unix_socket: /var/run/mysqld/mysqld.sock - name: nextcloud - password: "{{ db_nextcloud_pwd }}" - priv: 'nextcloud.*:ALL' - state: present - when: not nextcloud.stat.exists - - name: download nextcloud archive get_url: url: "{{ nc_download }}" @@ -182,6 +162,26 @@ group: www-data when: not nextcloud.stat.exists and not run_in_installer|default(false)|bool +- name: start mariadb during installation + command: /etc/init.d/mysql start + when: run_in_installer|default(false)|bool + +- name: create database with name 'nextcloud' + mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: nextcloud + state: present + when: not nextcloud.stat.exists + +- name: create database user 'nextcloud' + mysql_user: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: nextcloud + password: "{{ db_nextcloud_pwd }}" + priv: 'nextcloud.*:ALL' + state: present + when: not nextcloud.stat.exists + - name: initialize nextcloud command: cmd: > From 849045bfae276b33bb24b18b6c29da66a0d00eba Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 26 Jan 2020 11:27:29 +0100 Subject: [PATCH 088/504] Add app update task. --- roles/nextcloud/tasks/main.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 4210376..f58e812 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -236,7 +236,16 @@ changed_when: cmd_result.stdout is not search('Nothing to do.') when: allow_download -## app installations: +## app updates and installations: +- name: update apps + command: "sudo -u www-data php ./occ app:update --all" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout | length > 0 + when: allow_download + - name: install extra apps command: "sudo -u www-data php ./occ app:install {{ item }}" args: From df0afe3b71679b9d3fd09c9f9eb74d96a7bd53d9 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 25 Feb 2020 19:56:14 +0100 Subject: [PATCH 089/504] Add default NIC to public zone in firewalld. --- cloudbox.yml | 2 +- roles/nextcloud/tasks/main.yml | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/cloudbox.yml b/cloudbox.yml index 16d8bfe..6e89cdd 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -15,7 +15,7 @@ ## 'nc_download' and 'nc_checksum' are only ## used for ansible-pull during installation: nc_download: "https://download.nextcloud.com/server/releases/latest.tar.bz2" - nc_checksum: "sha256:194095a5586d84040bc455f77b8aa6c80f9a6a6dd713c9aebdad046713d4267b" + nc_checksum: "sha256:770faf34b8f0d81273623daed4d64ec7919c38dfeb07328b613058addbed19c0" nc_apps: - calendar - notes diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index f58e812..ea46e31 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -257,8 +257,23 @@ failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 when: allow_download + +- name: add default NIC to public zone + firewalld: + interface: "{{ ansible_default_ipv4.interface }}" + zone: public + permanent: Yes + immediate: Yes + state: enabled + when: not run_in_installer|default(false)|bool + +- name: add default NIC to public zone, offline + command: "firewall-offline-cmd --add-interface={{ ansible_default_ipv4.interface }} --zone=public" + when: run_in_installer|default(false)|bool + - name: allow https in firewalld firewalld: + zone: public service: https permanent: Yes immediate: Yes From a6feab0e38ab2b9ca11b34ab7be53d6dbe2bb3d4 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 29 Feb 2020 18:26:20 +0100 Subject: [PATCH 090/504] Minor improvements, nextcloud maintenance task. --- README | 1 + roles/nextcloud/tasks/main.yml | 15 ++++++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/README b/README index 52a83b0..00e8c24 100644 --- a/README +++ b/README @@ -28,6 +28,7 @@ offers ansible playbooks and instructions for the following machines: - setup of a home cloud server - dynamic DNS name - nextcloud + - backup with borg - … Contributions like patches, suggestions, pull requests and/or further diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index ea46e31..e620a54 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -234,7 +234,7 @@ warn: False register: cmd_result changed_when: cmd_result.stdout is not search('Nothing to do.') - when: allow_download + when: allow_download|bool ## app updates and installations: - name: update apps @@ -244,7 +244,7 @@ warn: False register: cmd_result changed_when: cmd_result.stdout | length > 0 - when: allow_download + when: allow_download|bool - name: install extra apps command: "sudo -u www-data php ./occ app:install {{ item }}" @@ -255,7 +255,16 @@ register: cmd_result changed_when: cmd_result.stdout is not search('already installed') failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 - when: allow_download + when: allow_download|bool or run_in_installer|default(false)|bool + +## nextcloud maintenance +- name: add missing indices + command: "sudo -u www-data php ./occ db:add-missing-indices" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is search('table updated successfully') - name: add default NIC to public zone From 4d70971359d34b29c553bac84775cecba5b46343 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 29 Feb 2020 20:28:57 +0100 Subject: [PATCH 091/504] Make sure generated password do not start with dashes. --- roles/backup/defaults/main.yml | 2 +- roles/krb5-kdc-ldap/defaults/main.yml | 8 ++++---- roles/ldap/defaults/main.yml | 2 +- roles/nextcloud/defaults/main.yml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/roles/backup/defaults/main.yml b/roles/backup/defaults/main.yml index 172d822..9956676 100644 --- a/roles/backup/defaults/main.yml +++ b/roles/backup/defaults/main.yml @@ -1,4 +1,4 @@ -borg_pwd: "{{ lookup('password', '/tmp/borg.pwd length=32') }}" +borg_pwd: "{{ lookup('password', '/tmp/borg.pwd chars=ascii_letters,digits length=32') }}" borg_pwd_file: "/root/borg.pwd" borg_key_backup: "/root/borg-key.backup" diff --git a/roles/krb5-kdc-ldap/defaults/main.yml b/roles/krb5-kdc-ldap/defaults/main.yml index 8e22f30..0aa00f0 100644 --- a/roles/krb5-kdc-ldap/defaults/main.yml +++ b/roles/krb5-kdc-ldap/defaults/main.yml @@ -1,9 +1,9 @@ --- -kdc_master_pwd: "{{ lookup('password', '/tmp/kdc_master.pwd length=24') }}" +kdc_master_pwd: "{{ lookup('password', '/tmp/kdc_master.pwd chars=ascii_letters,digits length=32') }}" kdc_master_pwd_file: "/root/kdc-master.pwd" -kdc_service_pwd: "{{ lookup('password', '/tmp/kdc-service.pwd length=24') }}" -kadmin_service_pwd: "{{ lookup('password', '/tmp/kadmin-service.pwd length=24') }}" +kdc_service_pwd: "{{ lookup('password', '/tmp/kdc-service.pwd chars=ascii_letters,digits length=32') }}" +kadmin_service_pwd: "{{ lookup('password', '/tmp/kadmin-service.pwd chars=ascii_letters,digits length=32') }}" -kadmin_pwd: "{{ lookup('password', '/tmp/kadmin.pwd length=24') }}" +kadmin_pwd: "{{ lookup('password', '/tmp/kadmin.pwd chars=ascii_letters,digits length=32') }}" kadmin_pwd_file: "/root/kadmin.pwd" diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index 1400020..d383ca2 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -1,4 +1,4 @@ -ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd length=24') }}" +ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd chars=ascii_letters,digits length=32') }}" ldap_admin_pwd_file: "/root/ldap-admin.pwd" basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" lan_homes: /home/lan diff --git a/roles/nextcloud/defaults/main.yml b/roles/nextcloud/defaults/main.yml index f55220f..a4dfa67 100644 --- a/roles/nextcloud/defaults/main.yml +++ b/roles/nextcloud/defaults/main.yml @@ -1,5 +1,5 @@ -db_nextcloud_pwd: "{{ lookup('password', '/tmp/db-nextcloud.pwd length=24') }}" -nc_admin_pwd: "{{ lookup('password', '/tmp/nc-admin.pwd length=24') }}" +db_nextcloud_pwd: "{{ lookup('password', '/tmp/db-nextcloud.pwd chars=ascii_letters,digits length=32') }}" +nc_admin_pwd: "{{ lookup('password', '/tmp/nc-admin.pwd chars=ascii_letters,digits length=32') }}" nc_admin_pwd_file: "/root/nc-admin.pwd" www_root: "/var/www" nc_dir: "{{ www_root }}/nextcloud" From 3eae7e731a886b785004f5255da67d2e153a5cf3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 4 Mar 2020 18:23:13 +0100 Subject: [PATCH 092/504] Fix backup script for remote repositories. --- roles/backup/templates/backup | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/backup/templates/backup b/roles/backup/templates/backup index 4d5c6e7..1cc3c5c 100755 --- a/roles/backup/templates/backup +++ b/roles/backup/templates/backup @@ -15,8 +15,8 @@ if grep -q "$MNT" /etc/fstab ; then [ -d "$BORG_REPO" ] || mount -v "$MNT" && MOUNTED="TRUE" fi -if [ ! -d "$BORG_REPO" ] ; then - mkdir -vp --mode=0750 "$BORG_REPO" +if [ ! -e "$KEY_BACKUP" ] ; then + [[ "$BORG_REPO" =~ @ ]] || mkdir -vp --mode=0750 "$BORG_REPO" borg init --encryption=repokey borg key export "$BORG_REPO" "$KEY_BACKUP" fi From a5f7059df05eb2bb77d414b01601203e4a866c0f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 4 Mar 2020 18:25:21 +0100 Subject: [PATCH 093/504] Provide default variables for backup script. --- roles/backup/defaults/main.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/backup/defaults/main.yml b/roles/backup/defaults/main.yml index 9956676..680efc2 100644 --- a/roles/backup/defaults/main.yml +++ b/roles/backup/defaults/main.yml @@ -9,3 +9,7 @@ backup_dirs_extra: "" backup_opts: "--exclude-caches" backup_opts_extra: "" + +www_root: "/var/www" +nc_dir: "{{ www_root }}/nextcloud" +data_dir: "/var/nc-data" From a1751397459dc3bb6689dfe78cca76d48026d57c Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 11 Mar 2020 19:46:30 +0100 Subject: [PATCH 094/504] Do not try to git clone from the installer chroot. --- roles/prepare4clients/tasks/main.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 484d170..706882f 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -138,9 +138,11 @@ dest: "{{ repo_dir }}" update: no become_user: "ansible" + when: not run_in_installer|default(false)|bool - name: start git-repo template: src: git-repo.j2 dest: "/etc/systemd/system/git-repo.service" notify: start git-repo + when: not run_in_installer|default(false)|bool From 118e9ceac6f358b2eee4e0f3714c3f66f715deca Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 11 Mar 2020 20:43:09 +0100 Subject: [PATCH 095/504] Avoid line breaks when using xxd with long passwords. --- roles/krb5-kdc-ldap/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 13c9002..e89fd8c 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -127,12 +127,12 @@ state: exact - name: prepare password for kdc - shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile + shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps -c 256 | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists - name: prepare password for kadmin - shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile + shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | xxd -g0 -ps -c 256 | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists From 0b00ac560c22c1bc377d94acac6e75790a890f02 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 12 Mar 2020 16:47:22 +0100 Subject: [PATCH 096/504] Add clients to server's inventory file. --- kerberox.yml | 1 + roles/prepare4clients/tasks/main.yml | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/kerberox.yml b/kerberox.yml index 2335fcf..ce8bbed 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -17,6 +17,7 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 dhcp_range: 192.168.0.50,192.168.0.99,2h + in_inventory: 192.168.0.[50:99] di_dist: "{{ ansible_distribution_release }}" di_version: "{{ ansible_distribution_major_version }}" diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 706882f..2dccbfa 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -146,3 +146,12 @@ dest: "/etc/systemd/system/git-repo.service" notify: start git-repo when: not run_in_installer|default(false)|bool + +###################### + +- name: add clients to inventory + blockinfile: + dest: /etc/ansible/hosts + block: | + [kerberox-client] + {{ in_inventory }} From f0c65d3cce463eae3a80aa281ae3a98aa4c5fff7 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 12 Mar 2020 16:48:54 +0100 Subject: [PATCH 097/504] Activate firewalld rules immediately. --- roles/apt-cacher/tasks/main.yml | 1 + roles/krb5-kdc-ldap/tasks/main.yml | 1 + roles/ldap/tasks/main.yml | 1 + roles/nfs-server/tasks/main.yml | 1 + 4 files changed, 4 insertions(+) diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index 128d1fd..b97120a 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -28,6 +28,7 @@ zone: internal port: 3142/tcp permanent: yes + immediate: yes state: enabled - meta: flush_handlers diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index e89fd8c..cb6e78c 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -210,6 +210,7 @@ zone: internal service: "{{ item }}" permanent: yes + immediate: yes state: enabled with_items: - kerberos diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 51ac242..589b07c 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -155,4 +155,5 @@ zone: internal service: ldap permanent: yes + immediate: yes state: enabled diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index 950fde1..eaab5bb 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -88,4 +88,5 @@ zone: internal service: nfs permanent: yes + immediate: yes state: enabled From 6f0197f693c6d00c6c57ce972f129f289f046e29 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 16 Mar 2020 19:36:19 +0100 Subject: [PATCH 098/504] Restart slapd when keytab is available. HTTP service principal. --- roles/krb5-kdc-ldap/handlers/main.yml | 8 ++++++-- roles/krb5-kdc-ldap/tasks/main.yml | 3 +++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/roles/krb5-kdc-ldap/handlers/main.yml b/roles/krb5-kdc-ldap/handlers/main.yml index dd749e0..098de30 100644 --- a/roles/krb5-kdc-ldap/handlers/main.yml +++ b/roles/krb5-kdc-ldap/handlers/main.yml @@ -1,7 +1,11 @@ +- name: restart slapd + systemd: name=slapd state=restarted enabled=yes + listen: "restart slapd" + - name: restart krb5-kdc - service: name=krb5-kdc state=restarted enabled=yes + systemd: name=krb5-kdc state=restarted enabled=yes listen: "restart krb5-kdc" - name: restart krb5-admin-server - service: name=krb5-admin-server state=restarted enabled=yes + systemd: name=krb5-admin-server state=restarted enabled=yes listen: "restart krb5-admin-server" diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index cb6e78c..dec714d 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -173,6 +173,7 @@ with_items: - host - ldap + - HTTP when: not krb5kdc.stat.exists - name: add principal to the keytab @@ -180,6 +181,7 @@ with_items: - host - ldap + - HTTP when: not krb5kdc.stat.exists - name: allow slapd to read the keytab @@ -188,6 +190,7 @@ owner: root group: openldap mode: '0640' + notify: restart slapd - name: "make 'kerberos' an alias hostname resolvable from the LAN" replace: From 8ca41be45ad24c7958210352ed0adbaad92ef072 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 16 Mar 2020 19:37:54 +0100 Subject: [PATCH 099/504] Do not overwrite existing APT configuration. --- roles/apt-cacher/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index b97120a..7d33a9f 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -7,7 +7,7 @@ copy: src: apt.conf dest: /etc/apt/apt.conf - backup: yes + force: no notify: "start apt-cacher-ng" when: not run_in_installer|default(false)|bool ## do not enable apt-cacher during installation From c78cff820093d93865e74437e11b6d16e3c94919 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 16 Mar 2020 19:43:42 +0100 Subject: [PATCH 100/504] Move kerberos integration to the end of tasks. --- roles/nextcloud/files/krb5-nextcloud.conf | 2 +- roles/nextcloud/tasks/main.yml | 70 +++++++++++++++++------ 2 files changed, 55 insertions(+), 17 deletions(-) diff --git a/roles/nextcloud/files/krb5-nextcloud.conf b/roles/nextcloud/files/krb5-nextcloud.conf index 9ccb2ab..89415e9 100644 --- a/roles/nextcloud/files/krb5-nextcloud.conf +++ b/roles/nextcloud/files/krb5-nextcloud.conf @@ -7,5 +7,5 @@ GssapiUseSessions On GssapiNegotiateOnce On GssapiBasicAuth On - require valid-user + Require valid-user diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index e620a54..61d43de 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -101,26 +101,12 @@ dest: /etc/apache2/sites-available/nextcloud.conf notify: "restart apache2" -- name: provide kerberos SSO config - copy: - src: krb5-nextcloud.conf - dest: /etc/apache2/sites-available/krb5-nextcloud.conf - when: "'kerberize' in role_names" - notify: "restart apache2" - - name: enable nextcloud site command: a2ensite nextcloud.conf args: creates: /etc/apache2/sites-enabled/nextcloud.conf notify: "restart apache2" -- name: enable kerberos access to nextcloud site - command: a2ensite krb5-nextcloud.conf - args: - creates: /etc/apache2/sites-enabled/krb5-nextcloud.conf - notify: "restart apache2" - when: "'kerberize' in role_names" - - name: enable https shell: 'grep -q "VirtualHost .*:443" * || a2ensite default-ssl.conf' args: @@ -293,10 +279,62 @@ command: "firewall-offline-cmd --add-service=https" when: run_in_installer|default(false)|bool +################################################################# +## kerberox integration: + +- name: install libapache2-mod-auth-gssapi + apt: + name: libapache2-mod-auth-gssapi + state: latest + when: "'kerberize' in role_names" + notify: "restart apache2" + +- name: copy keytab for www-data + copy: + src: /etc/krb5.keytab + dest: /etc/krb5.keytab.http + group: www-data + mode: "0640" + remote_src: yes + force: no + when: "'kerberize' in role_names" + notify: "restart apache2" + +- name: provide kerberos SSO config + copy: + src: krb5-nextcloud.conf + dest: /etc/apache2/sites-available/krb5-nextcloud.conf + when: "'kerberize' in role_names" + notify: "restart apache2" + +- name: enable kerberos access to nextcloud site + command: a2ensite krb5-nextcloud.conf + args: + creates: /etc/apache2/sites-enabled/krb5-nextcloud.conf + notify: "restart apache2" + when: "'kerberize' in role_names" + +- name: allow https in firewalld + firewalld: + zone: internal + service: https + permanent: Yes + immediate: Yes + state: enabled + when: not run_in_installer|default(false)|bool and 'kerberize' in role_names + +- name: allow https in firewalld, offline + command: "firewall-offline-cmd --add-service=https --zone=internal" + when: run_in_installer|default(false)|bool and 'kerberize' in role_names + +- name: allow access from kerberized LAN + command: sudo -u www-data php ./occ config:system:set trusted_domains 2 --value='{{ ansible_hostname }}.{{ ansible_domain }}' + args: + chdir: "{{ nc_dir }}" + warn: False + when: not nextcloud.stat.exists and 'kerberize' in role_names -## ToDo kerberox integration: # sudo -u www-data php ./occ app:enable user_ldap # sudo -u www-data php ./occ app:install user_saml - # sudo -u www-data php ./occ ldap From c6ac5fec0f7719730e2c1e3c57a528da0586803d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 17 Mar 2020 08:52:06 +0100 Subject: [PATCH 101/504] Fix firewalld configuration during installation. --- roles/apt-cacher/tasks/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index 7d33a9f..5dd27c3 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -30,5 +30,11 @@ permanent: yes immediate: yes state: enabled + when: not run_in_installer|default(false)|bool + +- name: allow apt-cacher-ng service in firewalld, offline + command: "firewall-offline-cmd --zone=internal --add-port=3142/tcp" + when: run_in_installer|default(false)|bool + - meta: flush_handlers From a412984c0ba8a30623129e33a2b9a47e248500e9 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 17 Mar 2020 20:30:23 +0100 Subject: [PATCH 102/504] Modify proxy only if none given yet. --- roles/apt-cacher/tasks/main.yml | 2 +- roles/krb5-kdc-ldap/tasks/main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index 5dd27c3..7439eb4 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -19,7 +19,7 @@ - name: enable apt-cacher-ng for install-clients replace: dest: "{{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg" - regexp: '^(d-i mirror/http/proxy string.*)$' + regexp: '^d-i mirror/http/proxy string$' replace: 'd-i mirror/http/proxy string http://{{ ansible_hostname }}:3142/' when: preseedcfg.stat.exists diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index dec714d..76646b9 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -176,7 +176,7 @@ - HTTP when: not krb5kdc.stat.exists -- name: add principal to the keytab +- name: add principal to the default keytab command: kadmin.local -q 'ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' with_items: - host From 10010f587301df86a15403bd582b60c3486241c1 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 26 Oct 2020 20:48:03 +0100 Subject: [PATCH 103/504] Updates for nextcloud. --- roles/nextcloud/tasks/main.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 61d43de..1b5a755 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -30,9 +30,11 @@ - mariadb-server - python3-pymysql - php-apcu + - php-bcmath - php-fpm - php-curl - php-gd + - php-gmp - php-imagick - php-intl - php-json @@ -252,6 +254,14 @@ register: cmd_result changed_when: cmd_result.stdout is search('table updated successfully') +- name: add missing columns + command: "sudo -u www-data php ./occ db:add-missing-columns" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is search('table updated successfully') + - name: add default NIC to public zone firewalld: From 7e34ab8081405a5715ab390866c13fbfb4d8df99 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 26 Oct 2020 20:50:00 +0100 Subject: [PATCH 104/504] Services are socket activated. --- roles/lan-client/templates/sssd.conf.j2 | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/lan-client/templates/sssd.conf.j2 b/roles/lan-client/templates/sssd.conf.j2 index 90e5410..91d230e 100644 --- a/roles/lan-client/templates/sssd.conf.j2 +++ b/roles/lan-client/templates/sssd.conf.j2 @@ -1,6 +1,5 @@ [sssd] domains = LDAP -services = nss, pam config_file_version = 2 [nss] From 9264deb90dbc4597a3ba3546957dd411af34bf98 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 26 Oct 2020 20:53:53 +0100 Subject: [PATCH 105/504] Better group handling with keyword 'none'. --- roles/ldap/templates/debian-lan.j2 | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index 5572869..dba9532 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -8,7 +8,8 @@ set -eu usage(){ cat < [] [] [] + $(basename $0) adduser |none + $(basename $0) adduser [] $(basename $0) deluser $(basename $0) delhost $(basename $0) ldapvi @@ -16,13 +17,13 @@ Usage: : User ID (login name) : Password - : If given, the user is added to this posix group (in addition to his personal group). - The group must already exist in the LDAP DT. + : If given and not "none", the user is added to this posix group (in addition to his + personal group). The group must already exist in the LDAP DT. , : LDAP attributes 'givenName' and 'sn'. If omitted, is used. : File containing lines of the form: - adduser [] [] [] - adduser [] [] [] + adduser + adduser … deluser deluser @@ -160,7 +161,7 @@ gidNumber: ${gidNumber} ################################## EOF - if [ -n "$grp" ] ; then + if [ -n "$grp" -a "$grp" != "none" ] ; then cat < Date: Sat, 28 Nov 2020 09:23:44 +0100 Subject: [PATCH 106/504] Init fvs branch with LDAP auth and mk-homedir. --- kiosk_mkhome.yml | 23 +++++++++++ roles/fvs-client-mkhome/defaults/main.yml | 2 + roles/fvs-client-mkhome/handlers/main.yml | 8 ++++ roles/fvs-client-mkhome/tasks/main.yml | 40 +++++++++++++++++++ .../fvs-client-mkhome/templates/sssd.conf.j2 | 20 ++++++++++ 5 files changed, 93 insertions(+) create mode 100644 kiosk_mkhome.yml create mode 100644 roles/fvs-client-mkhome/defaults/main.yml create mode 100644 roles/fvs-client-mkhome/handlers/main.yml create mode 100644 roles/fvs-client-mkhome/tasks/main.yml create mode 100644 roles/fvs-client-mkhome/templates/sssd.conf.j2 diff --git a/kiosk_mkhome.yml b/kiosk_mkhome.yml new file mode 100644 index 0000000..1c53bd0 --- /dev/null +++ b/kiosk_mkhome.yml @@ -0,0 +1,23 @@ +--- +# This playbook deploys a kiosk-computer + +- name: apply configuration to the machines + hosts: all + remote_user: ansible + become: yes + vars: + auto_user: debi + wifi_ssid: "YOUR SSID HERE" + wifi_passwd: "YOUR WIFI-PW HERE" + extra_pkgs: + - webext-privacy-badger + - webext-ublock-origin + extra_pkgs_bpo: [] # [ libreoffice ] + + roles: + - up2date-debian + ## Choose either gnome or KDE: + - gnome + #- kde + - kiosk + - fvs-client-mkhome diff --git a/roles/fvs-client-mkhome/defaults/main.yml b/roles/fvs-client-mkhome/defaults/main.yml new file mode 100644 index 0000000..836e748 --- /dev/null +++ b/roles/fvs-client-mkhome/defaults/main.yml @@ -0,0 +1,2 @@ +basedn: "ou=Benutzer,ou=fvs,ou=SCHULEN,o=ml3" +ldap_server: ldap.steinbeisschule-reutlingen.de diff --git a/roles/fvs-client-mkhome/handlers/main.yml b/roles/fvs-client-mkhome/handlers/main.yml new file mode 100644 index 0000000..938f2c4 --- /dev/null +++ b/roles/fvs-client-mkhome/handlers/main.yml @@ -0,0 +1,8 @@ +- name: restart sssd + service: name=sssd state=restarted enabled=yes + listen: "restart sssd" + +- name: reload systemd + systemd: + daemon_reload: yes + listen: "reload systemd" diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml new file mode 100644 index 0000000..c682836 --- /dev/null +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -0,0 +1,40 @@ +--- +- name: install needed packages + apt: + name: + - sssd-ldap + state: latest + +- name: add URI to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "URI ldaps://{{ ldap_server }}/" + insertafter: "#URI.*" + +- name: add BASE to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "BASE {{ basedn }}" + insertafter: "#BASE.*" + + #- name: enable pam_umask + # lineinfile: + # dest: /etc/pam.d/common-session + # line: "session optional pam_umask.so usergroups" + +- name: enable pam_mkhomedir.so + lineinfile: + dest: /etc/pam.d/common-session + line: "session optional pam_mkhomedir.so" + insertafter: "# end of pam-auth-update config" + + # command: /usr/sbin/pam-auth-update --enable mkhomedir + +## oddjob-mkhomedir works only with sec=sys for the NFSv4 share + +- name: provide identities from directory + template: + src: sssd.conf.j2 + dest: /etc/sssd/sssd.conf + mode: 0600 + notify: restart sssd diff --git a/roles/fvs-client-mkhome/templates/sssd.conf.j2 b/roles/fvs-client-mkhome/templates/sssd.conf.j2 new file mode 100644 index 0000000..394207a --- /dev/null +++ b/roles/fvs-client-mkhome/templates/sssd.conf.j2 @@ -0,0 +1,20 @@ +[sssd] +domains = LDAP +config_file_version = 2 +services = nss, pam + +[nss] +filter_groups = root +filter_users = root + +[pam] + +[domain/LDAP] +id_provider = ldap +ldap_uri = ldaps://{{ ldap_server }}/ +ldap_search_base = {{ basedn }} + +auth_provider = ldap +cache_credentials = true + +ldap_tls_reqcert = never From 3c87bcbeee5d5f44b12e99e57a80e168f87e7b68 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 2 Dec 2020 13:03:44 +0100 Subject: [PATCH 107/504] Add package selection. --- kiosk_mkhome.yml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/kiosk_mkhome.yml b/kiosk_mkhome.yml index 1c53bd0..1dbaa39 100644 --- a/kiosk_mkhome.yml +++ b/kiosk_mkhome.yml @@ -12,7 +12,27 @@ extra_pkgs: - webext-privacy-badger - webext-ublock-origin - extra_pkgs_bpo: [] # [ libreoffice ] + - vim + - emacs + - vlc + - gimp + - inkscape + - bluefish + - git + - mc + - tmux + - wireshark + - nmap + - netcat-openbsd + - net-tools + - thonny + - mu-editor + - dia + - vym + - tree + - console-setup + - virt-manager + extra_pkgs_bpo: [ linux-image-amd64 ] # [ libreoffice ] roles: - up2date-debian From 1c14ea3939dafd2b0d5d76e4e331f0b463e5f1f6 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 4 Dec 2020 17:59:38 +0100 Subject: [PATCH 108/504] Add home page. Self-signed certificate. --- roles/fvs-client-mkhome/tasks/main.yml | 10 ++++++++++ roles/fvs-client-mkhome/templates/sssd.conf.j2 | 1 - 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index c682836..0d7657b 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -17,6 +17,16 @@ line: "BASE {{ basedn }}" insertafter: "#BASE.*" +- name: do not verify cert + lineinfile: + dest: /etc/ldap/ldap.conf + line: "LDAPTLS_REQCERT never" + +- name: set homepage + lineinfile: + dest: /etc/firefox-esr/firefox-esr.js + line: pref("browser.startup.homepage", "https://www.startpage.com"); + #- name: enable pam_umask # lineinfile: # dest: /etc/pam.d/common-session diff --git a/roles/fvs-client-mkhome/templates/sssd.conf.j2 b/roles/fvs-client-mkhome/templates/sssd.conf.j2 index 394207a..977426a 100644 --- a/roles/fvs-client-mkhome/templates/sssd.conf.j2 +++ b/roles/fvs-client-mkhome/templates/sssd.conf.j2 @@ -16,5 +16,4 @@ ldap_search_base = {{ basedn }} auth_provider = ldap cache_credentials = true - ldap_tls_reqcert = never From 8aec6687d785f5697c6197e4a864608c77f236eb Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 4 Dec 2020 18:01:41 +0100 Subject: [PATCH 109/504] Mount smb home next to local home directory. --- roles/fvs-client-mkhome/tasks/main.yml | 27 +++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index 0d7657b..a435c42 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -3,6 +3,8 @@ apt: name: - sssd-ldap + - libpam-mount + - cifs-utils state: latest - name: add URI to ldap.conf @@ -38,9 +40,28 @@ line: "session optional pam_mkhomedir.so" insertafter: "# end of pam-auth-update config" - # command: /usr/sbin/pam-auth-update --enable mkhomedir - -## oddjob-mkhomedir works only with sec=sys for the NFSv4 share +- name: configure pam_mount + blockinfile: + dest: /etc/security/pam_mount.conf.xml + block: | + + + insertafter: "" - name: provide identities from directory template: From b5f1e4b66f26ec893a1e6220f073175c814b6923 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 4 Dec 2020 18:40:07 +0100 Subject: [PATCH 110/504] Skip auto login user (kiosk mode), but keep useful tasks. --- kiosk_mkhome.yml => fvs_mkhome.yml | 4 ---- roles/fvs-client-mkhome/handlers/main.yml | 10 ++++++++++ roles/fvs-client-mkhome/tasks/main.yml | 23 +++++++++++++++++++++++ 3 files changed, 33 insertions(+), 4 deletions(-) rename kiosk_mkhome.yml => fvs_mkhome.yml (87%) diff --git a/kiosk_mkhome.yml b/fvs_mkhome.yml similarity index 87% rename from kiosk_mkhome.yml rename to fvs_mkhome.yml index 1dbaa39..9b1ddeb 100644 --- a/kiosk_mkhome.yml +++ b/fvs_mkhome.yml @@ -6,9 +6,6 @@ remote_user: ansible become: yes vars: - auto_user: debi - wifi_ssid: "YOUR SSID HERE" - wifi_passwd: "YOUR WIFI-PW HERE" extra_pkgs: - webext-privacy-badger - webext-ublock-origin @@ -39,5 +36,4 @@ ## Choose either gnome or KDE: - gnome #- kde - - kiosk - fvs-client-mkhome diff --git a/roles/fvs-client-mkhome/handlers/main.yml b/roles/fvs-client-mkhome/handlers/main.yml index 938f2c4..f334f3a 100644 --- a/roles/fvs-client-mkhome/handlers/main.yml +++ b/roles/fvs-client-mkhome/handlers/main.yml @@ -6,3 +6,13 @@ systemd: daemon_reload: yes listen: "reload systemd" + +- name: run update-grub + command: update-grub + listen: update grub + +- name: enable tmp.mount + systemd: + daemon_reload: yes + name: tmp.mount + enabled: yes diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index a435c42..1148859 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -69,3 +69,26 @@ dest: /etc/sssd/sssd.conf mode: 0600 notify: restart sssd + +################# from kiosk.yml ################## + +- name: grub timeout + lineinfile: + dest: /etc/default/grub + regexp: '^(GRUB_TIMEOUT=).*' + line: '\g<1>1' + backrefs: yes + notify: update grub + +- name: keyboard compose key + lineinfile: + dest: /etc/default/keyboard + regexp: '^(XKBOPTIONS=).*' + line: '\1"compose:caps"' + backrefs: yes + +- name: tmp on tmpfs + shell: cp /usr/share/systemd/tmp.mount /etc/systemd/system/ + args: + creates: /etc/systemd/system/tmp.mount + notify: enable tmp.mount From 9c3d5e5f2e8687656f03f696b5517735c51a5069 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 5 Dec 2020 08:53:29 +0100 Subject: [PATCH 111/504] Fix booting from network. --- roles/fvs-client-mkhome/tasks/main.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index 1148859..c90be6a 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -70,6 +70,11 @@ mode: 0600 notify: restart sssd + ## FIXME: preseeding grub nvram does not work +- name: reset boot order + command: efibootmgr --delete-bootorder + when: run_in_installer|default(false)|bool + ################# from kiosk.yml ################## - name: grub timeout From 7828de33479a400fbbe9d4fd0df93d642bb91f81 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 5 Dec 2020 11:07:43 +0100 Subject: [PATCH 112/504] mkhome must happen before creating the mount point. More privacy. --- roles/fvs-client-mkhome/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index c90be6a..5f5eb23 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -37,8 +37,8 @@ - name: enable pam_mkhomedir.so lineinfile: dest: /etc/pam.d/common-session - line: "session optional pam_mkhomedir.so" - insertafter: "# end of pam-auth-update config" + line: "session optional pam_mkhomedir.so umask=0027" + insertbefore: "session optional pam_mount.so" - name: configure pam_mount blockinfile: From e1cea0c0a3c0304942f0131b3cfae4c0afdef7f6 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 5 Dec 2020 18:16:43 +0100 Subject: [PATCH 113/504] Mount data disk next to homes. --- roles/fvs-client-mkhome/tasks/main.yml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index 5f5eb23..2da0050 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -75,8 +75,28 @@ command: efibootmgr --delete-bootorder when: run_in_installer|default(false)|bool -################# from kiosk.yml ################## +############## extra data partition ############### +- name: mount data partition + mount: + src: "UUID={{ hostvars[inventory_hostname]['ansible_devices']['%s'|format(item)]['partitions']['%s1'|format(item)]['uuid'] }}" + path: /home/data + fstype: ext4 + state: mounted + register: data_mounted + when: hostvars[inventory_hostname]['ansible_devices']['%s'|format(item)] | default(false) + loop: + - sdb + - sde + +- name: set sticky bit on data directory + file: + path: /home/data + state: directory + mode: '1777' + when: data_mounted.changed + +################# from kiosk.yml ################## - name: grub timeout lineinfile: dest: /etc/default/grub From 4f73a9ead6af7de1cca6384b3b27f93fedcda02e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 8 Dec 2020 13:08:26 +0100 Subject: [PATCH 114/504] Use private groups for all LDAP users. --- roles/fvs-client-mkhome/templates/sssd.conf.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/fvs-client-mkhome/templates/sssd.conf.j2 b/roles/fvs-client-mkhome/templates/sssd.conf.j2 index 977426a..1efcfc5 100644 --- a/roles/fvs-client-mkhome/templates/sssd.conf.j2 +++ b/roles/fvs-client-mkhome/templates/sssd.conf.j2 @@ -15,5 +15,8 @@ ldap_uri = ldaps://{{ ldap_server }}/ ldap_search_base = {{ basedn }} auth_provider = ldap +auto_private_groups = true + cache_credentials = true + ldap_tls_reqcert = never From c4b6d866388a826a6dd27bc2459fed6aa717c634 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 8 Dec 2020 13:16:00 +0100 Subject: [PATCH 115/504] Allow to use wireshark for all users. --- roles/fvs-client-mkhome/tasks/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index 2da0050..3f390a8 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -75,6 +75,12 @@ command: efibootmgr --delete-bootorder when: run_in_installer|default(false)|bool +- name: set capabilities (wireshark) + capabilities: + path: /usr/bin/dumpcap + capability: cap_net_raw,cap_net_admin+eip + state: present + ############## extra data partition ############### - name: mount data partition From eab730e0ea31d97ba10c57e40621660a8deaf748 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 9 Dec 2020 09:27:44 +0100 Subject: [PATCH 116/504] Mount share directory on login. --- roles/fvs-client-mkhome/tasks/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/fvs-client-mkhome/tasks/main.yml b/roles/fvs-client-mkhome/tasks/main.yml index 3f390a8..eaa2ae4 100644 --- a/roles/fvs-client-mkhome/tasks/main.yml +++ b/roles/fvs-client-mkhome/tasks/main.yml @@ -50,6 +50,12 @@ path="DOCS/fvs/home/" mountpoint="~/winhome" /> + - insertafter: "" - -- name: provide identities from directory - template: - src: sssd.conf.j2 - dest: /etc/sssd/sssd.conf - mode: 0600 - notify: restart sssd - - ## FIXME: preseeding grub nvram does not work -- name: reset boot order - command: efibootmgr --delete-bootorder - when: run_in_installer|default(false)|bool diff --git a/roles/fvs-mkhome/defaults/main.yml b/roles/fvs-mount/defaults/main.yml similarity index 52% rename from roles/fvs-mkhome/defaults/main.yml rename to roles/fvs-mount/defaults/main.yml index 26a03ba..775517a 100644 --- a/roles/fvs-mkhome/defaults/main.yml +++ b/roles/fvs-mount/defaults/main.yml @@ -1,5 +1,4 @@ -basedn: "ou=Benutzer,ou=fvs,ou=SCHULEN,o=ml3" -ldap_server: "ldap.steinbeisschule-reutlingen.de" smb_server: "smb.steinbeisschule-reutlingen.de" +home_server: "home.steinbeisschule-reutlingen.de" smb_home: "DOCS/fvs/home/" smb_share: "DOCS/fvs/tausch/" diff --git a/roles/fvs-mount/tasks/main.yml b/roles/fvs-mount/tasks/main.yml new file mode 100644 index 0000000..b27192e --- /dev/null +++ b/roles/fvs-mount/tasks/main.yml @@ -0,0 +1,35 @@ +--- +- name: install needed packages + apt: + name: + - libpam-mount + - cifs-utils + - sshfs + state: latest + +- name: configure pam_mount + blockinfile: + dest: /etc/security/pam_mount.conf.xml + block: | + ansibleDebian-gdm + ansibleDebian-gdm + ansibleDebian-gdm + insertafter: "" diff --git a/roles/fvs-sssd/defaults/main.yml b/roles/fvs-sssd/defaults/main.yml new file mode 100644 index 0000000..dd40e38 --- /dev/null +++ b/roles/fvs-sssd/defaults/main.yml @@ -0,0 +1,2 @@ +basedn: "ou=Benutzer,ou=fvs,ou=SCHULEN,o=ml3" +ldap_server: "ldap.steinbeisschule-reutlingen.de" diff --git a/roles/fvs-mkhome/handlers/main.yml b/roles/fvs-sssd/handlers/main.yml similarity index 100% rename from roles/fvs-mkhome/handlers/main.yml rename to roles/fvs-sssd/handlers/main.yml diff --git a/roles/fvs-sssd/tasks/main.yml b/roles/fvs-sssd/tasks/main.yml new file mode 100644 index 0000000..3879cfa --- /dev/null +++ b/roles/fvs-sssd/tasks/main.yml @@ -0,0 +1,30 @@ +--- +- name: install needed packages + apt: + name: + - sssd-ldap + state: latest + +- name: add URI to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "URI ldaps://{{ ldap_server }}/" + insertafter: "#URI.*" + +- name: add BASE to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "BASE {{ basedn }}" + insertafter: "#BASE.*" + +- name: do not verify cert + lineinfile: + dest: /etc/ldap/ldap.conf + line: "LDAPTLS_REQCERT never" + +- name: provide identities from directory + template: + src: sssd.conf.j2 + dest: /etc/sssd/sssd.conf + mode: 0600 + notify: restart sssd diff --git a/roles/fvs-mkhome/templates/sssd.conf.j2 b/roles/fvs-sssd/templates/sssd.conf.j2 similarity index 100% rename from roles/fvs-mkhome/templates/sssd.conf.j2 rename to roles/fvs-sssd/templates/sssd.conf.j2 From de52a1eb332149bb4026a294733a8e03dd9ac50a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 18 Dec 2020 08:52:25 +0100 Subject: [PATCH 122/504] Provide ssh hostkey. --- roles/fvs-mount/defaults/main.yml | 1 + roles/fvs-mount/tasks/main.yml | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/roles/fvs-mount/defaults/main.yml b/roles/fvs-mount/defaults/main.yml index 775517a..d27fc27 100644 --- a/roles/fvs-mount/defaults/main.yml +++ b/roles/fvs-mount/defaults/main.yml @@ -2,3 +2,4 @@ smb_server: "smb.steinbeisschule-reutlingen.de" home_server: "home.steinbeisschule-reutlingen.de" smb_home: "DOCS/fvs/home/" smb_share: "DOCS/fvs/tausch/" +ssh_hostkey: '|1|vZQ8Yc2MBY3tYCzTCVOmaIRnep8=|kCp5RNmtBR7WSBX6L9fo9URSOmI= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFil1umj7jbBfJ7o80WDXToPidypuD915VNM7mN6mMF/gSJ7QYKtYDgBOR5KDUSB5dvc/itlSobw4rYQr2rE5dQ=' diff --git a/roles/fvs-mount/tasks/main.yml b/roles/fvs-mount/tasks/main.yml index b27192e..3933616 100644 --- a/roles/fvs-mount/tasks/main.yml +++ b/roles/fvs-mount/tasks/main.yml @@ -33,3 +33,15 @@ ssh="0" noroot="0" >ansibleDebian-gdm insertafter: "" + +- name: make sure .ssh exists + file: + path: /root/.ssh + state: directory + mode: '0700' + +- name: provide public key of home server + lineinfile: + path: /root/.ssh/known_hosts + line: "{{ ssh_hostkey }}" + create: yes From 25dd1161e4dd8d0c216a9d3dfb3b80af898b0f98 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 8 Feb 2021 10:57:43 +0100 Subject: [PATCH 123/504] Nicer ordering. --- roles/fvs-mount/tasks/main.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/roles/fvs-mount/tasks/main.yml b/roles/fvs-mount/tasks/main.yml index 3933616..c88df14 100644 --- a/roles/fvs-mount/tasks/main.yml +++ b/roles/fvs-mount/tasks/main.yml @@ -11,6 +11,14 @@ blockinfile: dest: /etc/security/pam_mount.conf.xml block: | + ansibleDebian-gdm + ansibleDebian-gdm + ansibleDebian-gdm - ansibleDebian-gdm insertafter: "" - name: make sure .ssh exists From 449b4ff6537212cdc70a24332a1aa96998bb4f2b Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 8 Feb 2021 10:59:01 +0100 Subject: [PATCH 124/504] Disable extra drive for now. --- roles/fvs-client/tasks/main.yml | 37 +++++++++++++++++---------------- 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/roles/fvs-client/tasks/main.yml b/roles/fvs-client/tasks/main.yml index 16ea639..9f90944 100644 --- a/roles/fvs-client/tasks/main.yml +++ b/roles/fvs-client/tasks/main.yml @@ -12,24 +12,25 @@ ############## extra data partition ############### -- name: mount data partition - mount: - src: "UUID={{ hostvars[inventory_hostname]['ansible_devices']['%s'|format(item)]['partitions']['%s1'|format(item)]['uuid'] }}" - path: /home/data - fstype: ext4 - state: mounted - register: data_mounted - when: item + '1' in hostvars[inventory_hostname]['ansible_devices']['%s'|format(item)]['partitions'] - loop: - - sdb - - sde - -- name: set sticky bit on data directory - file: - path: /home/data - state: directory - mode: '1777' - when: data_mounted.changed +#- name: all devices +# set_fact: +# all_devices: "{{ ansible_devices.keys() | select('match', '^sd(.*)$|^nv(.*)$') | list | sort }}" +# +#- name: mount data partition +# mount: +# src: "UUID={{ hostvars[inventory_hostname]['ansible_devices'][all_devices[-1]]['partitions']['%s1'|format(item)]['uuid'] }}" +# path: /home/data +# fstype: ext4 +# state: mounted +# register: data_mounted +# when: all_devices | length > 1 +# +#- name: set sticky bit on data directory +# file: +# path: /home/data +# state: directory +# mode: '1777' +# when: data_mounted.changed ################# from kiosk.yml ################## - name: grub timeout From 6be0eefcaa69d88d42087b40df3daee7ac318f4a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 13 Apr 2021 09:40:57 +0200 Subject: [PATCH 125/504] Avoid mounting attempts when switching to 'root'. --- roles/fvs-mount/tasks/main.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/fvs-mount/tasks/main.yml b/roles/fvs-mount/tasks/main.yml index c88df14..c75b4a4 100644 --- a/roles/fvs-mount/tasks/main.yml +++ b/roles/fvs-mount/tasks/main.yml @@ -17,7 +17,7 @@ mountpoint="/home/%(USER)" options="allow_other,default_permissions,reconnect,password_stdin,disable-hardlink" ssh="0" noroot="0" - >ansibleDebian-gdm + >rootansibleDebian-gdm ansibleDebian-gdm + >rootansibleDebian-gdm ansibleDebian-gdm + >rootansibleDebian-gdm insertafter: "" - name: make sure .ssh exists From cbc1e62659b7ac1b791a7a3e1b7c4fa718d37d10 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 5 Jul 2021 10:29:20 +0200 Subject: [PATCH 126/504] Disable backports for bullseye. --- fvs-client.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fvs-client.yml b/fvs-client.yml index a363e7f..6152a40 100644 --- a/fvs-client.yml +++ b/fvs-client.yml @@ -29,7 +29,7 @@ - tree - console-setup - virt-manager - extra_pkgs_bpo: [ linux-image-amd64 ] # [ libreoffice ] + extra_pkgs_bpo: [] # [ linux-image-amd64 ] # [ libreoffice ] roles: - up2date-debian From 156d932bf4426abcb0191860266069f0bb60b1e8 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 5 Jul 2021 10:53:05 +0200 Subject: [PATCH 127/504] PAM-mount fails with this option set. --- roles/fvs-mount/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/fvs-mount/tasks/main.yml b/roles/fvs-mount/tasks/main.yml index c75b4a4..76520e2 100644 --- a/roles/fvs-mount/tasks/main.yml +++ b/roles/fvs-mount/tasks/main.yml @@ -15,7 +15,7 @@ fstype="fuse" path="sshfs#%(USER)@{{ home_server }}:" mountpoint="/home/%(USER)" - options="allow_other,default_permissions,reconnect,password_stdin,disable-hardlink" + options="allow_other,default_permissions,reconnect,password_stdin" ssh="0" noroot="0" >rootansibleDebian-gdm From bc012494dfd2222ef7bf7473e2307d50e4a3945e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 5 Jul 2021 14:11:56 +0200 Subject: [PATCH 128/504] SSSD is socket activated by now. --- roles/fvs-sssd/templates/sssd.conf.j2 | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/fvs-sssd/templates/sssd.conf.j2 b/roles/fvs-sssd/templates/sssd.conf.j2 index 1efcfc5..bc39a46 100644 --- a/roles/fvs-sssd/templates/sssd.conf.j2 +++ b/roles/fvs-sssd/templates/sssd.conf.j2 @@ -1,7 +1,6 @@ [sssd] domains = LDAP config_file_version = 2 -services = nss, pam [nss] filter_groups = root From db1ed7ff30a1e37e6c20cb77da1faf1667c8f73d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 27 Jul 2021 11:54:54 +0200 Subject: [PATCH 129/504] Make sure gnome keyring-daemon is not started on sshfs. --- roles/fvs-client/tasks/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/fvs-client/tasks/main.yml b/roles/fvs-client/tasks/main.yml index 9f90944..c428a5c 100644 --- a/roles/fvs-client/tasks/main.yml +++ b/roles/fvs-client/tasks/main.yml @@ -53,3 +53,9 @@ args: creates: /etc/systemd/system/tmp.mount notify: enable tmp.mount + +## make sure gnome keyring-daemon is not started on sshfs: +- name: disable gnome keyring-daemon + command: dpkg-divert --divert /usr/bin/gnome-keyring-daemon.bak --rename /usr/bin/gnome-keyring-daemon + args: + creates: /usr/bin/gnome-keyring-daemon.bak From e2abbb114b09b6d11f7823cb5551a25c655ef741 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 27 Jul 2021 12:13:40 +0200 Subject: [PATCH 130/504] Fix for buster ansible release. --- fvs-client.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/fvs-client.yml b/fvs-client.yml index 6152a40..0c716d7 100644 --- a/fvs-client.yml +++ b/fvs-client.yml @@ -30,6 +30,7 @@ - console-setup - virt-manager extra_pkgs_bpo: [] # [ linux-image-amd64 ] # [ libreoffice ] + ansible_python_interpreter: "/usr/bin/python3" roles: - up2date-debian From 42d3fa4c2515302fb3370102e28aae88863297a5 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 13 Oct 2021 12:33:20 +0200 Subject: [PATCH 131/504] Desktop fine tuning (compare netboot image). --- roles/gnome/files/defaults | 11 ++++++----- roles/gnome/tasks/main.yml | 3 ++- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/roles/gnome/files/defaults b/roles/gnome/files/defaults index e2f99d0..ffde793 100644 --- a/roles/gnome/files/defaults +++ b/roles/gnome/files/defaults @@ -1,5 +1,5 @@ [org/gnome/shell] -enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com', 'desktop-icons@csoriano'] +enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com', 'dash-to-dock@micxgx.gmail.com'] [org/gnome/desktop/input-sources] sources=[('xkb', 'de'), ('xkb', 'us')] @@ -19,11 +19,11 @@ default-folder-viewer='list-view' use-tree-view=true [org/gnome/settings-daemon/plugins/power] -power-button-action='hibernate' -sleep-inactive-battery-timeout=900 +power-button-action='interactive' +sleep-inactive-battery-timeout=600 sleep-inactive-battery-type='hibernate' -sleep-inactive-ac-timeout=7200 -sleep-inactive-ac-type='suspend' +sleep-inactive-ac-timeout=6000 +sleep-inactive-ac-type='nothing' [org/gnome/desktop/screensaver] lock-enabled=false @@ -31,3 +31,4 @@ lock-enabled=false [org/gnome/desktop/interface] clock-show-date=true clock-show-seconds=true +clock-show-weekday=true diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index 32b985d..432229c 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -5,8 +5,9 @@ apt: name: - task-gnome-desktop - - gnome-shell-extension-desktop-icons - cups + - ssh-askpass-gnome + - gnome-shell-extension-dashtodock state: latest - name: make sure /etc/dconf/profile/ exists From 080356bfa487458d0c4b5312335c9c88e8e8ba2f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 14 Oct 2021 19:13:03 +0200 Subject: [PATCH 132/504] Clean up FvS playbooks and add VM server playbook. --- fvs-client.yml => fvs-desktop.yml | 3 +-- fvs-home.yml => fvs-home-server.yml | 1 + fvs-mkhome.yml | 25 ------------------------- fvs-vm-server.yml | 28 ++++++++++++++++++++++++++++ 4 files changed, 30 insertions(+), 27 deletions(-) rename fvs-client.yml => fvs-desktop.yml (93%) rename fvs-home.yml => fvs-home-server.yml (89%) delete mode 100644 fvs-mkhome.yml create mode 100644 fvs-vm-server.yml diff --git a/fvs-client.yml b/fvs-desktop.yml similarity index 93% rename from fvs-client.yml rename to fvs-desktop.yml index 0c716d7..d28b333 100644 --- a/fvs-client.yml +++ b/fvs-desktop.yml @@ -1,6 +1,5 @@ +## This playbook deploys a FvS desktop machine. --- -# This playbook deploys a kiosk-computer - - name: apply configuration to the machines hosts: all remote_user: ansible diff --git a/fvs-home.yml b/fvs-home-server.yml similarity index 89% rename from fvs-home.yml rename to fvs-home-server.yml index 20aafa8..9ae178b 100644 --- a/fvs-home.yml +++ b/fvs-home-server.yml @@ -1,3 +1,4 @@ +## This playbook deploys a FvS home server machine. --- - name: apply configuration to the home server hosts: all diff --git a/fvs-mkhome.yml b/fvs-mkhome.yml deleted file mode 100644 index e4528d6..0000000 --- a/fvs-mkhome.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# This playbook deploys a kiosk-computer - -- name: apply configuration to the machines - hosts: all - remote_user: ansible - become: yes - vars: - extra_pkgs: - - vim - - git - - mc - - tmux - - nmap - - netcat-openbsd - - net-tools - - tree - - console-setup - - virt-manager - extra_pkgs_bpo: [ linux-image-amd64 ] # [ libreoffice ] - - roles: - - up2date-debian - ## Choose either gnome or KDE: - - fvs-mkhome diff --git a/fvs-vm-server.yml b/fvs-vm-server.yml new file mode 100644 index 0000000..351706e --- /dev/null +++ b/fvs-vm-server.yml @@ -0,0 +1,28 @@ +## This playbook deploys a FvS VM server machine. +--- +- name: apply configuration to the VM server + hosts: all + remote_user: ansible + become: yes + vars: + extra_pkgs: + - vim + - libvirt-daemon-system + extra_pkgs_bpo: [ ] # [ libreoffice ] + + roles: + - up2date-debian + - fvs-sssd + + tasks: + - name: enable pam_mkhomedir.so + lineinfile: + dest: /etc/pam.d/common-session + line: "session optional pam_mkhomedir.so umask=0027" + insertbefore: "session optional pam_mount.so" + + - name: allow all users to use VMs + lineinfile: + dest: /etc/libvirt/libvirtd.conf + line: 'auth_unix_rw = "none"' + insertafter: '#auth_unix_rw = "polkit"' From d1bc338ef9b7a93fd9a3252dba6d0fdede18ed62 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 19 Oct 2021 20:01:20 +0200 Subject: [PATCH 133/504] Web server playbook. --- fvs-www-server.yml | 29 +++++++++++++++++++++++++++++ roles/fvs-client/tasks/main.yml | 10 +++++----- 2 files changed, 34 insertions(+), 5 deletions(-) create mode 100644 fvs-www-server.yml diff --git a/fvs-www-server.yml b/fvs-www-server.yml new file mode 100644 index 0000000..d7a690c --- /dev/null +++ b/fvs-www-server.yml @@ -0,0 +1,29 @@ +## This playbook deploys a FvS web server machine. +--- +- name: apply configuration to the web server + hosts: all + remote_user: ansible + become: yes + vars: + extra_pkgs: + - vim + - apache2 + - python3-flask + + extra_pkgs_bpo: [ ] # [ libreoffice ] + + roles: + - up2date-debian + - fvs-sssd + + tasks: + - name: enable pam_mkhomedir.so + lineinfile: + dest: /etc/pam.d/common-session + line: "session optional pam_mkhomedir.so umask=0026" + insertbefore: "session optional pam_mount.so" + + - name: enable apache mod userdir + apache2_module: + state: present + name: userdir diff --git a/roles/fvs-client/tasks/main.yml b/roles/fvs-client/tasks/main.yml index c428a5c..6a98698 100644 --- a/roles/fvs-client/tasks/main.yml +++ b/roles/fvs-client/tasks/main.yml @@ -4,11 +4,11 @@ dest: /etc/firefox-esr/firefox-esr.js line: pref("browser.startup.homepage", "https://www.startpage.com"); -- name: set capabilities (wireshark) - capabilities: - path: /usr/bin/dumpcap - capability: cap_net_raw,cap_net_admin+eip - state: present + #- name: set capabilities (wireshark) + #capabilities: + #path: /usr/bin/dumpcap + #capability: cap_net_raw,cap_net_admin+eip + #state: present ############## extra data partition ############### From 98cfd86b013b879ffb1c56d63eb20d9e99db4bf5 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 13 Mar 2022 10:27:15 +0100 Subject: [PATCH 134/504] Add packages. --- fvs-desktop.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fvs-desktop.yml b/fvs-desktop.yml index d28b333..16fa1dd 100644 --- a/fvs-desktop.yml +++ b/fvs-desktop.yml @@ -21,6 +21,7 @@ - nmap - netcat-openbsd - net-tools + - ghex - thonny - mu-editor - dia @@ -28,6 +29,7 @@ - tree - console-setup - virt-manager + - libreoffice-l10n-de extra_pkgs_bpo: [] # [ linux-image-amd64 ] # [ libreoffice ] ansible_python_interpreter: "/usr/bin/python3" From 8d357397f6ee63c08ede9a0d5b764d6f91d03abd Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 13 Mar 2022 10:27:57 +0100 Subject: [PATCH 135/504] Prepare shared directory for ISO images. --- fvs-vm-server.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fvs-vm-server.yml b/fvs-vm-server.yml index 351706e..90268cf 100644 --- a/fvs-vm-server.yml +++ b/fvs-vm-server.yml @@ -26,3 +26,9 @@ dest: /etc/libvirt/libvirtd.conf line: 'auth_unix_rw = "none"' insertafter: '#auth_unix_rw = "polkit"' + + - name: shared directory for ISO installer images + file: + path: /home/ISOsVM + state: directory + mode: '1777' From 3059ba0cd69954c6243001df65638b84beb6c4b3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 1 Apr 2021 21:59:48 +0200 Subject: [PATCH 136/504] Make sure ansible is installed. --- roles/prepare4clients/tasks/main.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 2dccbfa..8324881 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -1,3 +1,8 @@ +- name: make sure ansible is available + apt: + name: ansible + state: latest + - name: generate ssh key command: "su -l {{ ansible_user }} -c \"ssh-keygen -t rsa -f /home/{{ ansible_user }}/.ssh/id_rsa -P ''\"" args: From c06aa6e519e6814ec8b0ef033b77cd100b49822e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 1 Apr 2021 22:01:46 +0200 Subject: [PATCH 137/504] Fix ending up with no link on WAN interface. --- roles/two-interface-firewalld/handlers/main.yml | 4 ++-- roles/two-interface-firewalld/tasks/main.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/two-interface-firewalld/handlers/main.yml b/roles/two-interface-firewalld/handlers/main.yml index 51bb215..81201d4 100644 --- a/roles/two-interface-firewalld/handlers/main.yml +++ b/roles/two-interface-firewalld/handlers/main.yml @@ -1,6 +1,6 @@ - name: restart networking - systemd: name=networking state=restarted enabled=yes - listen: restart networking + command: ifup {{ if_lan }} + listen: "bring up LAN interface" when: not run_in_installer|default(false)|bool - name: start firewalld diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/two-interface-firewalld/tasks/main.yml index d61dc39..c3c2c9e 100644 --- a/roles/two-interface-firewalld/tasks/main.yml +++ b/roles/two-interface-firewalld/tasks/main.yml @@ -2,7 +2,7 @@ template: src: interfaces-static.j2 dest: /etc/network/interfaces.d/static - notify: "restart networking" + notify: "bring up LAN interface" - name: install firewalld package apt: name=firewalld state=latest From d8ab7bc73ee0887c9c3c1816bdec29be16b158b3 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 1 Apr 2021 22:05:55 +0200 Subject: [PATCH 138/504] Add data base maintenance command. --- roles/nextcloud/tasks/main.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 1b5a755..8e395a0 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -262,6 +262,15 @@ register: cmd_result changed_when: cmd_result.stdout is search('table updated successfully') +- name: convert filecache to bigint + command: "sudo -u www-data php ./occ -n db:convert-filecache-bigint" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is not search('tables already up to date') + + - name: add default NIC to public zone firewalld: From 1b2707b474a67efdf4f9f6ee02b29fae8e560884 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 1 Apr 2021 22:08:34 +0200 Subject: [PATCH 139/504] Services are socket activated. --- roles/nfs-server/templates/sssd.conf.j2 | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/nfs-server/templates/sssd.conf.j2 b/roles/nfs-server/templates/sssd.conf.j2 index 48eae04..815ea54 100644 --- a/roles/nfs-server/templates/sssd.conf.j2 +++ b/roles/nfs-server/templates/sssd.conf.j2 @@ -1,6 +1,5 @@ [sssd] domains = LDAP -services = nss, pam config_file_version = 2 [nss] From 6bdd207f1e90c632dc75eb85c09eaf2036fca135 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 1 Apr 2021 22:36:06 +0200 Subject: [PATCH 140/504] Fix (not) reloading systemd service during installation. --- roles/kerberize/handlers/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/kerberize/handlers/main.yml b/roles/kerberize/handlers/main.yml index 9adbeaa..d0a508b 100644 --- a/roles/kerberize/handlers/main.yml +++ b/roles/kerberize/handlers/main.yml @@ -3,3 +3,4 @@ name: sshd state: reloaded notify: "reload sshd" + when: not run_in_installer|default(false)|bool From fc67adddd554f90eee23883371de775378a32bd6 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 1 Apr 2021 23:22:47 +0200 Subject: [PATCH 141/504] Fix for missing 'python-apt' package. --- kerberox-client.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/kerberox-client.yml b/kerberox-client.yml index 201d5d5..cd7b29f 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -11,6 +11,7 @@ - webext-ublock-origin - krb5-auth-dialog extra_pkgs_bpo: [] # [ libreoffice ] + ansible_python_interpreter: "/usr/bin/python3" vars_prompt: - name: "kadmin_pwd" From 318672dabc9836320951e9cc5e8c050e81b1f564 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 2 Apr 2021 10:34:16 +0200 Subject: [PATCH 142/504] Modifications need to be applied immediately. --- roles/two-interface-firewalld/tasks/main.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/two-interface-firewalld/tasks/main.yml index c3c2c9e..a5e9850 100644 --- a/roles/two-interface-firewalld/tasks/main.yml +++ b/roles/two-interface-firewalld/tasks/main.yml @@ -19,6 +19,7 @@ interface: "{{ if_wan }}" permanent: yes state: enabled + immediate: true when: not run_in_installer|default(false)|bool - name: enable masquerading @@ -27,6 +28,7 @@ masquerade: 'yes' permanent: yes state: enabled + immediate: true when: not run_in_installer|default(false)|bool - name: add LAN interface to zone intern @@ -35,6 +37,7 @@ interface: "{{ if_lan }}" permanent: yes state: enabled + immediate: true when: not run_in_installer|default(false)|bool - name: enable services @@ -43,6 +46,7 @@ service: "{{ item }}" permanent: yes state: enabled + immediate: true with_items: - dhcp - dns From cef622fa33762fc2a6c02f6c589763c31ca865dd Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 2 Apr 2021 11:07:45 +0200 Subject: [PATCH 143/504] Add README to explain the deployment of the keytabs. --- README.kerberox | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 README.kerberox diff --git a/README.kerberox b/README.kerberox new file mode 100644 index 0000000..9362321 --- /dev/null +++ b/README.kerberox @@ -0,0 +1,11 @@ +## After installation of the clients, prepare and copy all machine +## credentials to the machines in the following way: + +## Find the kadmin password to be used soon: + sudo cat /root/kadmin.pwd + +## Then: + cd /home/ansible/debian-lan/ + ansible-playbook --ask-become-pass kerberox-client.yml + +## Enter the 'BECOME' password and the kadmin password obtained above. From 51f01858c1abf8520d66377b0353acaad08c9826 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 3 Apr 2021 23:10:24 +0200 Subject: [PATCH 144/504] Implement self signed certificate for slapd. --- roles/ldap/defaults/main.yml | 2 ++ roles/ldap/tasks/main.yml | 37 +++++++++++++++++++++++++---- roles/ldap/templates/slapd-TLS.ldif | 9 +++++++ 3 files changed, 44 insertions(+), 4 deletions(-) create mode 100644 roles/ldap/templates/slapd-TLS.ldif diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index d383ca2..e126f1e 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -1,6 +1,8 @@ ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd chars=ascii_letters,digits length=32') }}" ldap_admin_pwd_file: "/root/ldap-admin.pwd" basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +TLSCertificateFile: "/etc/ssl/certs/ssl-cert-snakeoil.pem" +TLSCertificateKeyFile: "/etc/ssl/private/ssl-cert-snakeoil.key" lan_homes: /home/lan min_id: 10000 max_id: 20000 diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 589b07c..6e88311 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -39,27 +39,49 @@ no_log: true when: not slapd.stat.exists -- name: install slapd, ldap-utils, ldapvi and python3-ldap +- name: install packages for LDAP apt: name: - slapd - ldap-utils - ldapvi - python3-ldap + - ssl-cert state: latest +- name: add openldap to the ssl-cert group + user: + name: openldap + groups: ssl-cert + append: yes + register: ssl_cert_group + +- name: restart slapd + systemd: name=slapd state=restarted + when: ssl_cert_group.changed + - name: make initial slapd configuration available copy: src: slapd-config.ldif - dest: /etc/ldap/slapd.d/slapd-config.ldif + dest: /etc/ldap/slapd.d/ + when: not slapd.stat.exists + +- name: make slapd TLS configuration available + template: + src: slapd-TLS.ldif + dest: /etc/ldap/slapd.d/ when: not slapd.stat.exists - name: activate ppolicy schema - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif when: not slapd.stat.exists - name: initialize slapd if it has just been installed - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif + when: not slapd.stat.exists + +- name: configure LDAP TLS + command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif when: not slapd.stat.exists - name: "make 'ldap' an alias hostname resolvable from the LAN" @@ -81,6 +103,13 @@ line: "BASE {{ basedn }}" insertafter: "#BASE.*" +- name: check against self signed certificate + replace: + path: /etc/ldap/ldap.conf + regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$" + replace: '#\1\nTLS_CACERT\t{{ TLSCertificateFile }}' + when: not slapd.stat.exists + ####################################################################################### ## Use the admin password saved to file from now on (available also after installation): - name: slurp admin password diff --git a/roles/ldap/templates/slapd-TLS.ldif b/roles/ldap/templates/slapd-TLS.ldif new file mode 100644 index 0000000..e94216f --- /dev/null +++ b/roles/ldap/templates/slapd-TLS.ldif @@ -0,0 +1,9 @@ +#### ENABLE LDAP TLS #### +dn: cn=config +changetype: modify +add: olcTLSCertificateFile +olcTLSCertificateFile: {{ TLSCertificateFile }} +- +add: olcTLSCertificateKeyFile +olcTLSCertificateKeyFile: {{ TLSCertificateKeyFile }} +- From c976c69bed0294b8a4c67cab1806f6c607d3ab3a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 5 Apr 2021 19:12:31 +0200 Subject: [PATCH 145/504] Move LDAP install/setup tasks into extra file. --- roles/ldap/tasks/main.yml | 116 ++++--------------------------------- roles/ldap/tasks/setup.yml | 94 ++++++++++++++++++++++++++++++ 2 files changed, 104 insertions(+), 106 deletions(-) create mode 100644 roles/ldap/tasks/setup.yml diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 6e88311..4d0c307 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -1,117 +1,18 @@ -## Install and configure slapd (if not done yet), -## run most tasks only on slapd installation. +## Install and configure slapd. --- - fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 -- name: check if slapd is already there - stat: path=/etc/ldap/slapd.d/slapd-config.ldif +- name: check if slapd is already set up + stat: path=/usr/sbin/slapd register: slapd -- name: preseed ldap domain - debconf: - name: slapd - question: slapd/domain - value: "{{ ansible_domain }}" - vtype: string - when: not slapd.stat.exists - -- name: preseed slapd admin password1 - debconf: - name: slapd - question: slapd/password1 - value: "{{ ldap_admin_pwd }}" - vtype: password - no_log: true - when: not slapd.stat.exists - -- name: preseed slapd admin password2 - debconf: - name: slapd - question: slapd/password2 - value: "{{ ldap_admin_pwd }}" - vtype: password - no_log: true - when: not slapd.stat.exists - -- name: dump admin password - shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}" - no_log: true - when: not slapd.stat.exists - -- name: install packages for LDAP - apt: - name: - - slapd - - ldap-utils - - ldapvi - - python3-ldap - - ssl-cert - state: latest - -- name: add openldap to the ssl-cert group - user: - name: openldap - groups: ssl-cert - append: yes - register: ssl_cert_group - -- name: restart slapd - systemd: name=slapd state=restarted - when: ssl_cert_group.changed - -- name: make initial slapd configuration available - copy: - src: slapd-config.ldif - dest: /etc/ldap/slapd.d/ - when: not slapd.stat.exists - -- name: make slapd TLS configuration available - template: - src: slapd-TLS.ldif - dest: /etc/ldap/slapd.d/ - when: not slapd.stat.exists - -- name: activate ppolicy schema - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif - when: not slapd.stat.exists - -- name: initialize slapd if it has just been installed - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif - when: not slapd.stat.exists - -- name: configure LDAP TLS - command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif - when: not slapd.stat.exists - -- name: "make 'ldap' an alias hostname resolvable from the LAN" - replace: - path: /etc/hosts - regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 ldap' - when: not slapd.stat.exists - -- name: add URI to ldap.conf - lineinfile: - dest: /etc/ldap/ldap.conf - line: "URI ldapi:///" - insertafter: "#URI.*" - -- name: add BASE to ldap.conf - lineinfile: - dest: /etc/ldap/ldap.conf - line: "BASE {{ basedn }}" - insertafter: "#BASE.*" - -- name: check against self signed certificate - replace: - path: /etc/ldap/ldap.conf - regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$" - replace: '#\1\nTLS_CACERT\t{{ TLSCertificateFile }}' +- name: install and configure slapd + include_tasks: setup.yml when: not slapd.stat.exists ####################################################################################### -## Use the admin password saved to file from now on (available also after installation): +## Use the admin password saved to file (available also after installation): - name: slurp admin password slurp: src: "{{ ldap_admin_pwd_file }}" @@ -133,6 +34,7 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + - name: add group for ldap users ldap_entry: dn: "cn=ldapuser,ou=groups,{{ basedn }}" @@ -143,13 +45,14 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + - name: provide simple script to manage ldap/kdc template: src: debian-lan.j2 dest: /usr/local/sbin/debian-lan mode: 0744 -## Add user + - name: add dummy user foo ldap_entry: dn: "uid=foo,ou=people,{{ basedn }}" @@ -179,6 +82,7 @@ bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" when: foo_pwd is defined and foo_pwd | length > 0 + - name: allow ldap service in firewalld firewalld: zone: internal diff --git a/roles/ldap/tasks/setup.yml b/roles/ldap/tasks/setup.yml new file mode 100644 index 0000000..43067eb --- /dev/null +++ b/roles/ldap/tasks/setup.yml @@ -0,0 +1,94 @@ +## Install and configure slapd. +--- +- name: preseed ldap domain + debconf: + name: slapd + question: slapd/domain + value: "{{ ansible_domain }}" + vtype: string + +- name: preseed slapd admin password1 + debconf: + name: slapd + question: slapd/password1 + value: "{{ ldap_admin_pwd }}" + vtype: password + no_log: true + +- name: preseed slapd admin password2 + debconf: + name: slapd + question: slapd/password2 + value: "{{ ldap_admin_pwd }}" + vtype: password + no_log: true + +- name: dump admin password + shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}" + no_log: true + +- name: install packages for LDAP + apt: + name: + - slapd + - ldap-utils + - ldapvi + - python3-ldap + - ssl-cert + state: latest + +- name: add openldap to the ssl-cert group + user: + name: openldap + groups: ssl-cert + append: yes + register: ssl_cert_group + +- name: restart slapd + systemd: name=slapd state=restarted + when: ssl_cert_group.changed + +- name: make initial slapd configuration available + copy: + src: slapd-config.ldif + dest: /etc/ldap/slapd.d/ + +- name: make slapd TLS configuration available + template: + src: slapd-TLS.ldif + dest: /etc/ldap/slapd.d/ + +- name: activate ppolicy schema + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif + +- name: initialize slapd if it has just been installed + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif + +- name: configure LDAP TLS + command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif + +- name: "make 'ldap' an alias hostname resolvable from the LAN" + replace: + path: /etc/hosts + regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" + replace: '\1 ldap' + +- name: add URI to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "URI ldapi:///" + insertafter: "#URI.*" + +- name: add BASE to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "BASE {{ basedn }}" + insertafter: "#BASE.*" + +- name: check against self signed certificate + replace: + path: /etc/ldap/ldap.conf + regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$" + replace: '#\1\nTLS_CACERT\t{{ TLSCertificateFile }}' + +## Use 'sudo ldapvi -Y EXTERNAL -h ldapi:/// -b "cn=config"' to modify certificate and key. From e5ae626936f3f73c285c7cf149afb5cd775e9204 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 8 Apr 2021 09:01:25 +0200 Subject: [PATCH 146/504] Implement LAN server sharing home directories via smb or sshfs. --- roles/lan-client/tasks/main.yml | 2 +- roles/ldap/tasks/setup.yml | 4 + roles/samba-ldap/defaults/main.yml | 4 + roles/samba-ldap/handlers/main.yml | 8 ++ roles/samba-ldap/meta/main.yml | 3 + roles/samba-ldap/tasks/main.yml | 118 ++++++++++++++++++++++++ roles/samba-ldap/templates/sssd.conf.j2 | 20 ++++ sambox.yml | 55 +++++++++++ 8 files changed, 213 insertions(+), 1 deletion(-) create mode 100644 roles/samba-ldap/defaults/main.yml create mode 100644 roles/samba-ldap/handlers/main.yml create mode 100644 roles/samba-ldap/meta/main.yml create mode 100644 roles/samba-ldap/tasks/main.yml create mode 100644 roles/samba-ldap/templates/sssd.conf.j2 create mode 100644 sambox.yml diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index 9b793a3..e394016 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -93,6 +93,6 @@ - name: automount lineinfile: dest: /etc/fstab - line: "{{ nfs_server}}:/home {{ lan_homes }} nfs4 sec=krb5p,_netdev,noauto,x-systemd.automount,x-systemd.idle-timeout=60 0 0" + line: "{{ nfs_server }}:/home {{ lan_homes }} nfs4 sec=krb5p,_netdev,noauto,x-systemd.automount,x-systemd.idle-timeout=60 0 0" notify: reload systemd when: not run_in_installer|default(false)|bool diff --git a/roles/ldap/tasks/setup.yml b/roles/ldap/tasks/setup.yml index 43067eb..e01f556 100644 --- a/roles/ldap/tasks/setup.yml +++ b/roles/ldap/tasks/setup.yml @@ -91,4 +91,8 @@ regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$" replace: '#\1\nTLS_CACERT\t{{ TLSCertificateFile }}' +- name: enable pam-mkhomedir + command: pam-auth-update --enable mkhomedir + when: foo_pwd is defined and foo_pwd | length > 0 + ## Use 'sudo ldapvi -Y EXTERNAL -h ldapi:/// -b "cn=config"' to modify certificate and key. diff --git a/roles/samba-ldap/defaults/main.yml b/roles/samba-ldap/defaults/main.yml new file mode 100644 index 0000000..575579c --- /dev/null +++ b/roles/samba-ldap/defaults/main.yml @@ -0,0 +1,4 @@ +basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +ldap_server: ldap +min_id_sssd: 5000 +max_id_sssd: 20000 diff --git a/roles/samba-ldap/handlers/main.yml b/roles/samba-ldap/handlers/main.yml new file mode 100644 index 0000000..99844ab --- /dev/null +++ b/roles/samba-ldap/handlers/main.yml @@ -0,0 +1,8 @@ +- name: restart sssd + service: name=sssd state=restarted enabled=yes + listen: "restart sssd" + +- name: restart smbd + service: name=smbd state=restarted enabled=yes + listen: "restart smbd" + diff --git a/roles/samba-ldap/meta/main.yml b/roles/samba-ldap/meta/main.yml new file mode 100644 index 0000000..b19fb35 --- /dev/null +++ b/roles/samba-ldap/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: ldap diff --git a/roles/samba-ldap/tasks/main.yml b/roles/samba-ldap/tasks/main.yml new file mode 100644 index 0000000..cf0e871 --- /dev/null +++ b/roles/samba-ldap/tasks/main.yml @@ -0,0 +1,118 @@ +## Install and configure samba-ldap. +--- +- name: check if samba is already there + stat: path=/etc/ldap/schema/samba.ldif + register: samba_ldap + +- name: install samba and provide samba schema + apt: + name: + - samba + - sssd-ldap + state: latest + + +- name: provide identities from LDAP + template: + src: sssd.conf.j2 + dest: /etc/sssd/sssd.conf + mode: 0600 + notify: restart sssd + +- meta: flush_handlers + + +- name: prepare samba schema + command: cp /usr/share/doc/samba/examples/LDAP/samba.ldif /etc/ldap/schema/ + args: + creates: /etc/ldap/schema/samba.ldif + +- name: activate samba.ldif schema + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/samba.ldif + when: not samba_ldap.stat.exists + +- name: add indexes to LDAP + ldap_attr: + dn: "olcDatabase={1}mdb,cn=config" + name: olcDbIndex + values: + - sambaSID eq + - sambaPrimaryGroupSID eq + - sambaGroupType eq + - sambaSIDList eq + - sambaDomainName eq + state: present + +- name: modify ACLs to account for Samba + ldap_attr: + dn: "olcDatabase={1}mdb,cn=config" + name: olcAccess + values: + - >- + to attrs=userPassword + by self write + by anonymous auth + by * none + - >- + to attrs=shadowLastChange + by self write + by * read + - >- + to attrs=sambaNTPassword + by dn.exact=cn=admin,{{ basedn }} write + by self write + by * none + - >- + to * by * read + state: exact + +- name: customize smb.conf + blockinfile: + dest: /etc/samba/smb.conf + insertafter: '^\s*server role =' + block: | + ####### LDAP Settings ####### + passdb backend = ldapsam:ldapi:/// + ldap suffix = {{ basedn }} + ldap user suffix = ou=people + ldap group suffix = ou=groups + ldap machine suffix = ou=computers + ldap idmap suffix = ou=idmap + ldap admin dn = cn=admin,{{ basedn }} + ldap ssl = no + ldap passwd sync = yes + notify: restart smbd + + +- name: slurp admin password for samba setup + slurp: + src: "{{ ldap_admin_pwd_file }}" + register: ldap_admin_pwd + no_log: true + when: not samba_ldap.stat.exists + +- name: make samba admin password available to smbd + command: smbpasswd -w "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + no_log: true + notify: restart smbd + when: not samba_ldap.stat.exists + +- meta: flush_handlers + +- name: add samba attributes to dummy user foo + command: + cmd: smbpasswd -s -a foo + stdin: "{{ foo_pwd }}\n{{ foo_pwd }}" + when: foo_pwd is defined and foo_pwd | length > 0 + +######################## + +- name: allow services in firewalld + firewalld: + zone: internal + service: "{{ item }}" + permanent: yes + immediate: yes + state: enabled + with_items: + - samba diff --git a/roles/samba-ldap/templates/sssd.conf.j2 b/roles/samba-ldap/templates/sssd.conf.j2 new file mode 100644 index 0000000..eb6d50e --- /dev/null +++ b/roles/samba-ldap/templates/sssd.conf.j2 @@ -0,0 +1,20 @@ +[sssd] +domains = LDAP +config_file_version = 2 + +[nss] +filter_groups = root +filter_users = root + +[pam] + +[domain/LDAP] +id_provider = ldap +ldap_uri = ldap://{{ ldap_server }}/ +ldap_search_base = {{ basedn }} + +auth_provider = ldap +cache_credentials = true + +min_id = {{ min_id_sssd }} +max_id = {{ max_id_sssd }} diff --git a/sambox.yml b/sambox.yml new file mode 100644 index 0000000..6160297 --- /dev/null +++ b/sambox.yml @@ -0,0 +1,55 @@ +--- +## This playbook deploys the sambox server. Add 'hostname=XXX' and 'domain=YYY' +## to the installer boot parameters to set hostname and domain. +## + + +- name: apply configuration to the sambox server + hosts: all + remote_user: ansible + become: yes + + vars: + ## This interface provides the default route: + if_wan: "{{ ansible_default_ipv4.interface }}" + + ## Use the first remaining interface for the LAN: + if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}" + + ## LAN IP address range: + ipaddr_lan: 192.168.0.10/24 + dhcp_range: 192.168.0.50,192.168.0.99,2h + in_inventory: 192.168.0.[50:99] + + di_dist: "{{ ansible_distribution_release }}" + di_version: 10 #"{{ ansible_distribution_major_version }}" + di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" + + ansible_user: ansible + repo_dir: "/home/{{ ansible_user }}/debian-lan" + ansible_python_interpreter: "/usr/bin/python3" ## needed for firewalld module + + + vars_prompt: + - name: "foo_pwd" + prompt: + In case you would like to prepare a test user 'foo' and have + not done so yet, provide foo's password here. Leave empty to + just continue + private: yes + + + pre_tasks: + - name: validate if interfaces are available + fail: + msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." + when: (if_lan not in ansible_interfaces) or (if_wan not in ansible_interfaces) or (if_lan == if_wan) + + + roles: + - up2date-debian + - two-interface-firewalld + - dhcp-dns-dnsmasq + - tftp-netboot-installer + - apt-cacher + - samba-ldap From e55997a01cf5372888609ae3c5b67d5c35dbc0d0 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 9 Apr 2021 10:17:45 +0200 Subject: [PATCH 147/504] Draft implementation of sambox-client. --- roles/ldap/tasks/setup.yml | 6 -- roles/prepare4clients/tasks/main.yml | 33 +++++++++++ roles/samba-ldap/defaults/main.yml | 2 +- roles/samba-ldap/templates/sssd.conf.j2 | 3 + roles/smb-sshfs-client/defaults/main.yml | 5 ++ roles/smb-sshfs-client/handlers/main.yml | 9 +++ roles/smb-sshfs-client/tasks/main.yml | 58 +++++++++++++++++++ roles/smb-sshfs-client/templates/sssd.conf.j2 | 22 +++++++ sambox-client.yml | 20 +++++++ sambox.yml | 1 + 10 files changed, 152 insertions(+), 7 deletions(-) create mode 100644 roles/smb-sshfs-client/defaults/main.yml create mode 100644 roles/smb-sshfs-client/handlers/main.yml create mode 100644 roles/smb-sshfs-client/tasks/main.yml create mode 100644 roles/smb-sshfs-client/templates/sssd.conf.j2 create mode 100644 sambox-client.yml diff --git a/roles/ldap/tasks/setup.yml b/roles/ldap/tasks/setup.yml index e01f556..d5ccfbe 100644 --- a/roles/ldap/tasks/setup.yml +++ b/roles/ldap/tasks/setup.yml @@ -67,12 +67,6 @@ - name: configure LDAP TLS command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif -- name: "make 'ldap' an alias hostname resolvable from the LAN" - replace: - path: /etc/hosts - regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 ldap' - - name: add URI to ldap.conf lineinfile: dest: /etc/ldap/ldap.conf diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 8324881..f83ad9b 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -135,8 +135,41 @@ notify: "rebuild di-netboot-assistant menu" when: krb5kdc.stat.exists +######## sambox-client ####### + +- name: check if we operate on sambox + stat: path=/etc/samba/smb.conf + register: samba + +- name: add sambox-client auto pxe boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/pxelinux.HEAD + insertbefore: EOF + block: | + LABEL autoinstall + MENU LABEL Debian {{ di_version }} (amd64) + preseed + sambox-client.yml + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical domain={{ ansible_domain }} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + marker: "# {mark} ANSIBLE MANAGED BLOCK sambox-client" + notify: "rebuild di-netboot-assistant menu" + when: samba.stat.exists + +- name: add sambox-client auto efi boot entry to di-netboot-assistant + blockinfile: + dest: /etc/di-netboot-assistant/grub.cfg.HEAD + insertbefore: EOF + block: | + menuentry 'Debian {{ di_version }} (amd64) + preseed + sambox-client.yml' { + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical domain={{ ansible_domain }} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz + } + marker: "# {mark} ANSIBLE MANAGED BLOCK sambox-client" + notify: "rebuild di-netboot-assistant menu" + when: samba.stat.exists + ###################### + - name: provide git repo if not available already git: repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' diff --git a/roles/samba-ldap/defaults/main.yml b/roles/samba-ldap/defaults/main.yml index 575579c..37ab18a 100644 --- a/roles/samba-ldap/defaults/main.yml +++ b/roles/samba-ldap/defaults/main.yml @@ -1,4 +1,4 @@ basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" -ldap_server: ldap +ldap_server: sambox min_id_sssd: 5000 max_id_sssd: 20000 diff --git a/roles/samba-ldap/templates/sssd.conf.j2 b/roles/samba-ldap/templates/sssd.conf.j2 index eb6d50e..c5c4187 100644 --- a/roles/samba-ldap/templates/sssd.conf.j2 +++ b/roles/samba-ldap/templates/sssd.conf.j2 @@ -18,3 +18,6 @@ cache_credentials = true min_id = {{ min_id_sssd }} max_id = {{ max_id_sssd }} + +## remove this after providing propper certificates: +ldap_tls_reqcert = allow diff --git a/roles/smb-sshfs-client/defaults/main.yml b/roles/smb-sshfs-client/defaults/main.yml new file mode 100644 index 0000000..120b76a --- /dev/null +++ b/roles/smb-sshfs-client/defaults/main.yml @@ -0,0 +1,5 @@ +basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +ldap_server: sambox +home_server: sambox +min_id_sssd: 5000 +max_id_sssd: 20000 diff --git a/roles/smb-sshfs-client/handlers/main.yml b/roles/smb-sshfs-client/handlers/main.yml new file mode 100644 index 0000000..3c18dd6 --- /dev/null +++ b/roles/smb-sshfs-client/handlers/main.yml @@ -0,0 +1,9 @@ +- name: restart sssd + service: name=sssd state=restarted enabled=yes + listen: "restart sssd" + +- name: reload systemd + systemd: + daemon_reload: yes + listen: "reload systemd" + diff --git a/roles/smb-sshfs-client/tasks/main.yml b/roles/smb-sshfs-client/tasks/main.yml new file mode 100644 index 0000000..0e9391f --- /dev/null +++ b/roles/smb-sshfs-client/tasks/main.yml @@ -0,0 +1,58 @@ +--- +- fail: msg="The machine's domain must not be empty." + when: ansible_domain | length == 0 + +- name: install needed packages + apt: + name: + - sssd-ldap + - libpam-mount + - cifs-utils + - sshfs + state: latest + +- name: add URI to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "URI ldap://ldap/" + insertafter: "#URI.*" + +- name: add BASE to ldap.conf + lineinfile: + dest: /etc/ldap/ldap.conf + line: "BASE {{ basedn }}" + insertafter: "#BASE.*" + +- name: enable pam_umask + lineinfile: + dest: /etc/pam.d/common-session + line: "session optional pam_umask.so usergroups" + +- name: provide identities from directory + template: + src: sssd.conf.j2 + dest: /etc/sssd/sssd.conf + mode: 0600 + notify: restart sssd + +- name: configure pam_mount + blockinfile: + dest: /etc/security/pam_mount.conf.xml + block: | + + rootansibleDebian-gdm + insertafter: "" + + diff --git a/roles/smb-sshfs-client/templates/sssd.conf.j2 b/roles/smb-sshfs-client/templates/sssd.conf.j2 new file mode 100644 index 0000000..f39b856 --- /dev/null +++ b/roles/smb-sshfs-client/templates/sssd.conf.j2 @@ -0,0 +1,22 @@ +[sssd] +domains = LDAP +config_file_version = 2 + +[nss] +filter_groups = root +filter_users = root + +[pam] + +[domain/LDAP] +id_provider = ldap +ldap_uri = ldap://{{ ldap_server }}/ +ldap_search_base = {{ basedn }} + +auth_provider = ldap +cache_credentials = true + +min_id = {{ min_id_sssd }} +max_id = {{ max_id_sssd }} + +ldap_tls_reqcert = allow diff --git a/sambox-client.yml b/sambox-client.yml new file mode 100644 index 0000000..8b63293 --- /dev/null +++ b/sambox-client.yml @@ -0,0 +1,20 @@ +--- +# This playbook deploys a client for the kerberox LAN. + +- name: apply configuration to the machines + hosts: all + remote_user: ansible + become: yes + vars: + extra_pkgs: + - webext-privacy-badger + - webext-ublock-origin + extra_pkgs_bpo: [] # [ libreoffice ] + ansible_python_interpreter: "/usr/bin/python3" + + roles: + - up2date-debian + - smb-sshfs-client + ## Choose either gnome or KDE: + #- gnome + #- kde diff --git a/sambox.yml b/sambox.yml index 6160297..c24d2ee 100644 --- a/sambox.yml +++ b/sambox.yml @@ -53,3 +53,4 @@ - tftp-netboot-installer - apt-cacher - samba-ldap + - prepare4clients From ebcfd88ef4bdd9b48f0ff3b087a81b9b5ccfdb82 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 9 Apr 2021 10:31:16 +0200 Subject: [PATCH 148/504] Restructuring/renaming DNS, DHCP, TFTP and netboot installer. Idea: The role 'dnsmasq' and a new role 'dns-dhcp-tftp' are drop-in replacements and interchangeable. 'netboot-installer' works indepently of the role chosen for DNS, DHCP and TFTP. --- kerberox.yml | 4 ++-- roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 | 3 --- roles/{dhcp-dns-dnsmasq => dnsmasq}/handlers/main.yml | 0 roles/{dhcp-dns-dnsmasq => dnsmasq}/tasks/main.yml | 8 +++++++- roles/dnsmasq/templates/dnsmasq-dhcp.j2 | 3 +++ .../templates/dnsmasq-tftp-netboot-installer.j2 | 0 .../defaults/main.yml | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 9 +-------- sambox.yml | 9 +++++---- 10 files changed, 18 insertions(+), 18 deletions(-) delete mode 100644 roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 rename roles/{dhcp-dns-dnsmasq => dnsmasq}/handlers/main.yml (100%) rename roles/{dhcp-dns-dnsmasq => dnsmasq}/tasks/main.yml (61%) create mode 100644 roles/dnsmasq/templates/dnsmasq-dhcp.j2 rename roles/{tftp-netboot-installer => dnsmasq}/templates/dnsmasq-tftp-netboot-installer.j2 (100%) rename roles/{tftp-netboot-installer => netboot-installer}/defaults/main.yml (100%) rename roles/{tftp-netboot-installer => netboot-installer}/handlers/main.yml (100%) rename roles/{tftp-netboot-installer => netboot-installer}/tasks/main.yml (78%) diff --git a/kerberox.yml b/kerberox.yml index ce8bbed..edb56d3 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -47,8 +47,8 @@ roles: - up2date-debian - two-interface-firewalld - - dhcp-dns-dnsmasq - - tftp-netboot-installer + - netboot-installer + - dnsmasq - apt-cacher - { role: krb5-kdc-ldap, when: not run_in_installer|default(false)|bool } - { role: nfs-server, when: not run_in_installer|default(false)|bool } diff --git a/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 b/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 deleted file mode 100644 index 61f82c2..0000000 --- a/roles/dhcp-dns-dnsmasq/templates/dnsmasq-dhcp.j2 +++ /dev/null @@ -1,3 +0,0 @@ -interface={{ if_lan }} -dhcp-range={{ dhcp_range }} -dhcp-generate-names diff --git a/roles/dhcp-dns-dnsmasq/handlers/main.yml b/roles/dnsmasq/handlers/main.yml similarity index 100% rename from roles/dhcp-dns-dnsmasq/handlers/main.yml rename to roles/dnsmasq/handlers/main.yml diff --git a/roles/dhcp-dns-dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml similarity index 61% rename from roles/dhcp-dns-dnsmasq/tasks/main.yml rename to roles/dnsmasq/tasks/main.yml index 48bae66..d5e7fc2 100644 --- a/roles/dhcp-dns-dnsmasq/tasks/main.yml +++ b/roles/dnsmasq/tasks/main.yml @@ -9,8 +9,14 @@ - resolvconf state: latest -- name: configure dnsmasq +- name: configure dnsmasq dhcp template: src: dnsmasq-dhcp.j2 dest: /etc/dnsmasq.d/dnsmasq-dhcp notify: "restart dnsmasq" + +- name: configure dnsmasq tftp + template: + src: dnsmasq-tftp-netboot-installer.j2 + dest: /etc/dnsmasq.d/tftp-netboot-installer + notify: "restart dnsmasq" diff --git a/roles/dnsmasq/templates/dnsmasq-dhcp.j2 b/roles/dnsmasq/templates/dnsmasq-dhcp.j2 new file mode 100644 index 0000000..29f73dd --- /dev/null +++ b/roles/dnsmasq/templates/dnsmasq-dhcp.j2 @@ -0,0 +1,3 @@ +interface={{ if_lan }} +dhcp-range={{ dhcp_start }},{{ dhcp_stop }},2h +dhcp-generate-names diff --git a/roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 b/roles/dnsmasq/templates/dnsmasq-tftp-netboot-installer.j2 similarity index 100% rename from roles/tftp-netboot-installer/templates/dnsmasq-tftp-netboot-installer.j2 rename to roles/dnsmasq/templates/dnsmasq-tftp-netboot-installer.j2 diff --git a/roles/tftp-netboot-installer/defaults/main.yml b/roles/netboot-installer/defaults/main.yml similarity index 100% rename from roles/tftp-netboot-installer/defaults/main.yml rename to roles/netboot-installer/defaults/main.yml diff --git a/roles/tftp-netboot-installer/handlers/main.yml b/roles/netboot-installer/handlers/main.yml similarity index 100% rename from roles/tftp-netboot-installer/handlers/main.yml rename to roles/netboot-installer/handlers/main.yml diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/netboot-installer/tasks/main.yml similarity index 78% rename from roles/tftp-netboot-installer/tasks/main.yml rename to roles/netboot-installer/tasks/main.yml index f6daa83..e2e88bc 100644 --- a/roles/tftp-netboot-installer/tasks/main.yml +++ b/roles/netboot-installer/tasks/main.yml @@ -17,14 +17,7 @@ src: /usr/share/doc/di-netboot-assistant/examples/preseed.cfg dest: "{{ tftp_root }}/d-i/{{ di_dist }}" force: no - -- name: configure dnsmasq - template: - src: dnsmasq-tftp-netboot-installer.j2 - dest: /etc/dnsmasq.d/tftp-netboot-installer - notify: - - restart dnsmasq - - rebuild di-netboot-assistant menu + remote_src: yes - name: make the hostname resolvable from the LAN replace: diff --git a/sambox.yml b/sambox.yml index c24d2ee..85560e1 100644 --- a/sambox.yml +++ b/sambox.yml @@ -18,8 +18,9 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - dhcp_range: 192.168.0.50,192.168.0.99,2h - in_inventory: 192.168.0.[50:99] + dhcp_start: 192.168.0.50 + dhcp_stop: 192.168.0.150 + in_inventory: 192.168.0.[50:150] di_dist: "{{ ansible_distribution_release }}" di_version: 10 #"{{ ansible_distribution_major_version }}" @@ -49,8 +50,8 @@ roles: - up2date-debian - two-interface-firewalld - - dhcp-dns-dnsmasq - - tftp-netboot-installer + - netboot-installer + - dns-dhcp-tftp - apt-cacher - samba-ldap - prepare4clients From d8366d2ca26cb13a23def3e0f426981bbcf9ad88 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 9 Apr 2021 11:20:21 +0200 Subject: [PATCH 149/504] Implement DNS (bind9) and DHCP (isc-dhcp-server) and TFTP (tftpd-hpa). --- roles/dns-dhcp-tftp/defaults/main.yml | 1 + roles/dns-dhcp-tftp/handlers/main.yml | 11 ++ roles/dns-dhcp-tftp/tasks/main.yml | 84 +++++++++++ roles/dns-dhcp-tftp/templates/db.192.168.0.j2 | 11 ++ roles/dns-dhcp-tftp/templates/db.intern.j2 | 17 +++ roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 | 137 ++++++++++++++++++ roles/dns-dhcp-tftp/templates/localzones.j2 | 13 ++ roles/dns-dhcp-tftp/templates/resolv.conf.j2 | 3 + roles/prepare4clients/tasks/main.yml | 3 +- 9 files changed, 279 insertions(+), 1 deletion(-) create mode 100644 roles/dns-dhcp-tftp/defaults/main.yml create mode 100644 roles/dns-dhcp-tftp/handlers/main.yml create mode 100644 roles/dns-dhcp-tftp/tasks/main.yml create mode 100644 roles/dns-dhcp-tftp/templates/db.192.168.0.j2 create mode 100644 roles/dns-dhcp-tftp/templates/db.intern.j2 create mode 100644 roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 create mode 100644 roles/dns-dhcp-tftp/templates/localzones.j2 create mode 100644 roles/dns-dhcp-tftp/templates/resolv.conf.j2 diff --git a/roles/dns-dhcp-tftp/defaults/main.yml b/roles/dns-dhcp-tftp/defaults/main.yml new file mode 100644 index 0000000..d91fadf --- /dev/null +++ b/roles/dns-dhcp-tftp/defaults/main.yml @@ -0,0 +1 @@ +name_servers: ns1.{{ ansible_domain }} diff --git a/roles/dns-dhcp-tftp/handlers/main.yml b/roles/dns-dhcp-tftp/handlers/main.yml new file mode 100644 index 0000000..8dec007 --- /dev/null +++ b/roles/dns-dhcp-tftp/handlers/main.yml @@ -0,0 +1,11 @@ +- name: restart isc-dhcp-server + systemd: name=isc-dhcp-server state=restarted enabled=yes + listen: restart isc-dhcp-server + +- name: restart bind + systemd: name=bind9 state=restarted enabled=yes + listen: restart bind + +- name: restart tftpd-hpa + systemd: name=tftpd-hpa state=restarted enabled=yes + listen: restart tftpd-hpa diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dns-dhcp-tftp/tasks/main.yml new file mode 100644 index 0000000..c3feb3c --- /dev/null +++ b/roles/dns-dhcp-tftp/tasks/main.yml @@ -0,0 +1,84 @@ +--- +- name: preseed tftpd-hpa + debconf: + name: tftpd-hpa + question: tftpd-hpa/directory + value: /var/lib/tftpboot + vtype: string + +- name: install tftpd, dhcpd and named packages + apt: + name: + - isc-dhcp-server + - tftpd-hpa + - bind9 + state: latest + +## FIXME: preseeding seems to be ignored +- name: configure TFTP root directory + replace: + path: /etc/default/tftpd-hpa + regexp: '^TFTP_DIRECTORY=".*"$' + replace: 'TFTP_DIRECTORY="/var/lib/tftpboot"' + notify: restart tftpd-hpa + +- name: serve dhcp on LAN interface + replace: + path: /etc/default/isc-dhcp-server + regexp: '^INTERFACESv4=".*"$' + replace: 'INTERFACESv4="{{ if_lan }}"' + notify: restart isc-dhcp-server + +- name: deploy config files for isc-dhcp-server + template: + src: dhcpd.conf.j2 + dest: /etc/dhcp/dhcpd.conf + backup: yes + notify: restart isc-dhcp-server + +- name: deploy config files for bind9 + template: + src: "{{ item }}.j2" + dest: "/etc/bind/{{ item }}" + loop: + - db.intern + - db.192.168.0 + - localzones + notify: restart bind + +- name: enable local bind config + lineinfile: + path: /etc/bind/named.conf.local + line: 'include "/etc/bind/localzones";' + notify: restart bind + +- name: adapt resolv.conf + template: + src: resolv.conf.j2 + dest: /etc/resolv.conf + +## stop dhclient from overwriting /etc/resolv.conf: +- name: supersede dhcp client data + blockinfile: + dest: /etc/dhcp/dhclient.conf + block: | + supersede domain-name "{{ ansible_domain }}"; + supersede domain-search "{{ ansible_domain }}"; + supersede domain-name-servers 127.0.0.1; + insertbefore: "#send dhcp-client-identifier.*" + +- name: generate rndc key + command: + cmd: rndc-confgen -a + creates: /etc/bind/rndc.key + +- name: copy rndc key + copy: + src: /etc/bind/rndc.key + dest: /etc/dhcp/ + owner: root + group: root + mode: '0640' + remote_src: yes + notify: restart isc-dhcp-server + diff --git a/roles/dns-dhcp-tftp/templates/db.192.168.0.j2 b/roles/dns-dhcp-tftp/templates/db.192.168.0.j2 new file mode 100644 index 0000000..3f942c1 --- /dev/null +++ b/roles/dns-dhcp-tftp/templates/db.192.168.0.j2 @@ -0,0 +1,11 @@ +$TTL 500 +@ IN SOA {{ ansible_fqdn }}. root.{{ ansible_domain }}. ( + 1 ; Serial + 3600 ; Refresh + 1800 ; Retry + 720000 ; Expire + 6400 ) ; Negative Cache TTL +; +@ NS {{ ansible_fqdn }}. + MX 10 {{ ansible_fqdn }}. +{{ ipaddr_lan | ipaddr("address") | regex_replace("^.*\.(.+$)", "\\1") }} PTR {{ ansible_fqdn }}. diff --git a/roles/dns-dhcp-tftp/templates/db.intern.j2 b/roles/dns-dhcp-tftp/templates/db.intern.j2 new file mode 100644 index 0000000..3bc6776 --- /dev/null +++ b/roles/dns-dhcp-tftp/templates/db.intern.j2 @@ -0,0 +1,17 @@ +$TTL 500 +@ IN SOA {{ ansible_fqdn }}. root.{{ ansible_domain }}. ( + 1 ; Serial + 3600 ; Refresh + 1800 ; Retry + 720000 ; Expire + 6400 ) ; Negative Cache TTL +; +@ NS {{ ansible_fqdn }}. + MX 10 {{ ansible_fqdn }}. +{{ ansible_hostname }} A {{ ipaddr_lan | ipaddr("address") }} +_ldap._tcp SRV 100 0 389 {{ ansible_fqdn }}. +ns1 CNAME {{ ansible_fqdn }}. +ns2 CNAME {{ ansible_fqdn }}. +aptcache CNAME {{ ansible_fqdn }}. +homes CNAME {{ ansible_fqdn }}. +ldap CNAME {{ ansible_fqdn }}. diff --git a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 new file mode 100644 index 0000000..95209ae --- /dev/null +++ b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 @@ -0,0 +1,137 @@ +# dhcpd.conf +# +# Sample configuration file for ISC dhcpd +# + +# option definitions common to all supported networks... +option domain-name "{{ ansible_domain }}"; +option domain-name-servers {{ name_servers }}; + +default-lease-time 600; +max-lease-time 7200; + +# The ddns-updates-style parameter controls whether or not the server will +# attempt to do a DNS update when a lease is confirmed. We default to the +# behavior of the version 2 packages ('none', since DHCP v2 didn't +# have support for DDNS.) +#ddns-update-style none; +use-host-decl-names on; + +include "/etc/dhcp/rndc.key"; + +zone intern. { + primary dns; + key rndc-key; +} + +zone 0.168.192.in-addr.arpa. { + primary dns; + key rndc-key; +} + + +# If this DHCP server is the official DHCP server for the local +# network, the authoritative directive should be uncommented. +authoritative; + +# Use this to send dhcp log messages to a different log file (you also +# have to hack syslog.conf to complete the redirection). +#log-facility local7; + +## The tftpd server IP address, for all clients. +next-server 192.168.0.10; + +option arch code 93 = unsigned integer 16; +if option arch = 00:07 { + filename "d-i/n-a/bootnetx64.efi"; +} else { + filename "d-i/n-a/pxelinux.0"; +} + +subnet 192.168.0.0 netmask 255.255.255.0 { + option routers {{ ipaddr_lan | ipaddr("address") }}; + range {{ dhcp_start }} {{ dhcp_stop }}; +} + + +# No service will be given on this subnet, but declaring it helps the +# DHCP server to understand the network topology. + +#subnet 10.152.187.0 netmask 255.255.255.0 { +#} + +# This is a very basic subnet declaration. + +#subnet 10.254.239.0 netmask 255.255.255.224 { +# range 10.254.239.10 10.254.239.20; +# option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org; +#} + +# This declaration allows BOOTP clients to get dynamic addresses, +# which we don't really recommend. + +#subnet 10.254.239.32 netmask 255.255.255.224 { +# range dynamic-bootp 10.254.239.40 10.254.239.60; +# option broadcast-address 10.254.239.31; +# option routers rtr-239-32-1.example.org; +#} + +# A slightly different configuration for an internal subnet. +#subnet 10.5.5.0 netmask 255.255.255.224 { +# range 10.5.5.26 10.5.5.30; +# option domain-name-servers ns1.internal.example.org; +# option domain-name "internal.example.org"; +# option routers 10.5.5.1; +# option broadcast-address 10.5.5.31; +# default-lease-time 600; +# max-lease-time 7200; +#} + +# Hosts which require special configuration options can be listed in +# host statements. If no address is specified, the address will be +# allocated dynamically (if possible), but the host-specific information +# will still come from the host declaration. + +#host passacaglia { +# hardware ethernet 0:0:c0:5d:bd:95; +# filename "vmunix.passacaglia"; +# server-name "toccata.example.com"; +#} + +# Fixed IP addresses can also be specified for hosts. These addresses +# should not also be listed as being available for dynamic assignment. +# Hosts for which fixed IP addresses have been specified can boot using +# BOOTP or DHCP. Hosts for which no fixed address is specified can only +# be booted with DHCP, unless there is an address range on the subnet +# to which a BOOTP client is connected which has the dynamic-bootp flag +# set. +#host fantasia { +# hardware ethernet 08:00:07:26:c0:a5; +# fixed-address fantasia.example.com; +#} + +# You can declare a class of clients and then do address allocation +# based on that. The example below shows a case where all clients +# in a certain class get addresses on the 10.17.224/24 subnet, and all +# other clients get addresses on the 10.0.29/24 subnet. + +#class "foo" { +# match if substring (option vendor-class-identifier, 0, 4) = "SUNW"; +#} + +#shared-network 224-29 { +# subnet 10.17.224.0 netmask 255.255.255.0 { +# option routers rtr-224.example.org; +# } +# subnet 10.0.29.0 netmask 255.255.255.0 { +# option routers rtr-29.example.org; +# } +# pool { +# allow members of "foo"; +# range 10.17.224.10 10.17.224.250; +# } +# pool { +# deny members of "foo"; +# range 10.0.29.10 10.0.29.230; +# } +#} diff --git a/roles/dns-dhcp-tftp/templates/localzones.j2 b/roles/dns-dhcp-tftp/templates/localzones.j2 new file mode 100644 index 0000000..cb2a9a0 --- /dev/null +++ b/roles/dns-dhcp-tftp/templates/localzones.j2 @@ -0,0 +1,13 @@ +zone "0.168.192.in-addr.arpa" { + type master; + notify no; + file "/etc/bind/db.192.168.0"; + journal "/var/lib/bind/db.192.168.0.jnl"; +}; + +zone "intern" { + type master; + notify no; + file "/etc/bind/db.intern"; + journal "/var/lib/bind/db.intern.jnl"; +}; diff --git a/roles/dns-dhcp-tftp/templates/resolv.conf.j2 b/roles/dns-dhcp-tftp/templates/resolv.conf.j2 new file mode 100644 index 0000000..56bda43 --- /dev/null +++ b/roles/dns-dhcp-tftp/templates/resolv.conf.j2 @@ -0,0 +1,3 @@ +domain {{ ansible_domain }} +search {{ ansible_domain }}. +nameserver 127.0.0.1 diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index f83ad9b..7124106 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -160,7 +160,8 @@ insertbefore: EOF block: | menuentry 'Debian {{ di_version }} (amd64) + preseed + sambox-client.yml' { - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical domain={{ ansible_domain }} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + regexp --set=1:oct4 --set=2:oct5 --set=3:oct6 "\:([[:xdigit:]]+)\:([[:xdigit:]]+)\:([[:xdigit:]]+)\$" $net_default_mac + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} domain={{ ansible_domain }} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } marker: "# {mark} ANSIBLE MANAGED BLOCK sambox-client" From a6b408d86611a806eaf664e14f1e1de186df3e46 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 9 Apr 2021 11:22:39 +0200 Subject: [PATCH 150/504] Fix git-daemon service complaints. --- roles/prepare4clients/templates/git-repo.j2 | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/roles/prepare4clients/templates/git-repo.j2 b/roles/prepare4clients/templates/git-repo.j2 index be9f853..667fff4 100644 --- a/roles/prepare4clients/templates/git-repo.j2 +++ b/roles/prepare4clients/templates/git-repo.j2 @@ -7,12 +7,10 @@ ExecStart=/usr/bin/git daemon --reuseaddr --export-all --base-path={{ repo_dir } Restart=always RestartSec=500ms -StandardOutput=syslog -StandardError=syslog SyslogIdentifier=git-daemon -User=nobody -Group=nogroup +User=git +Group=git [Install] WantedBy=multi-user.target From 16ac6d7169054ae75e94f2c0794caddb312c51b4 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 10:09:57 +0200 Subject: [PATCH 151/504] Fixes for DHCP, DDNS. --- roles/dns-dhcp-tftp/tasks/main.yml | 11 ++++++++++- roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 | 8 +++++--- roles/dns-dhcp-tftp/templates/localzones.j2 | 4 ++++ roles/dns-dhcp-tftp/templates/resolv.conf.j2 | 3 +-- 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dns-dhcp-tftp/tasks/main.yml index c3feb3c..521f8b6 100644 --- a/roles/dns-dhcp-tftp/tasks/main.yml +++ b/roles/dns-dhcp-tftp/tasks/main.yml @@ -46,6 +46,16 @@ - localzones notify: restart bind +- name: link zone files to writeable directory for DDNS + file: + src: "/etc/bind/{{ item }}" + dest: "/var/lib/bind/{{ item }}" + state: link + loop: + - db.intern + - db.192.168.0 + notify: restart bind + - name: enable local bind config lineinfile: path: /etc/bind/named.conf.local @@ -62,7 +72,6 @@ blockinfile: dest: /etc/dhcp/dhclient.conf block: | - supersede domain-name "{{ ansible_domain }}"; supersede domain-search "{{ ansible_domain }}"; supersede domain-name-servers 127.0.0.1; insertbefore: "#send dhcp-client-identifier.*" diff --git a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 index 95209ae..b548beb 100644 --- a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 +++ b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 @@ -15,17 +15,19 @@ max-lease-time 7200; # behavior of the version 2 packages ('none', since DHCP v2 didn't # have support for DDNS.) #ddns-update-style none; -use-host-decl-names on; + +use-host-decl-names on; +ddns-update-style standard; include "/etc/dhcp/rndc.key"; zone intern. { - primary dns; + primary 127.0.0.1; key rndc-key; } zone 0.168.192.in-addr.arpa. { - primary dns; + primary 127.0.0.1; key rndc-key; } diff --git a/roles/dns-dhcp-tftp/templates/localzones.j2 b/roles/dns-dhcp-tftp/templates/localzones.j2 index cb2a9a0..b0d958c 100644 --- a/roles/dns-dhcp-tftp/templates/localzones.j2 +++ b/roles/dns-dhcp-tftp/templates/localzones.j2 @@ -1,8 +1,11 @@ +include "/etc/bind/rndc.key"; + zone "0.168.192.in-addr.arpa" { type master; notify no; file "/etc/bind/db.192.168.0"; journal "/var/lib/bind/db.192.168.0.jnl"; + allow-update { key rndc-key; }; }; zone "intern" { @@ -10,4 +13,5 @@ zone "intern" { notify no; file "/etc/bind/db.intern"; journal "/var/lib/bind/db.intern.jnl"; + allow-update { key rndc-key; }; }; diff --git a/roles/dns-dhcp-tftp/templates/resolv.conf.j2 b/roles/dns-dhcp-tftp/templates/resolv.conf.j2 index 56bda43..7118830 100644 --- a/roles/dns-dhcp-tftp/templates/resolv.conf.j2 +++ b/roles/dns-dhcp-tftp/templates/resolv.conf.j2 @@ -1,3 +1,2 @@ -domain {{ ansible_domain }} -search {{ ansible_domain }}. +search {{ ansible_domain }} nameserver 127.0.0.1 From 4fab918db94fe7030adaa519984e4ee0aab86fba Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 10:11:46 +0200 Subject: [PATCH 152/504] Work around missing domain name. --- roles/smb-sshfs-client/defaults/main.yml | 6 +++--- roles/smb-sshfs-client/tasks/main.yml | 3 --- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/roles/smb-sshfs-client/defaults/main.yml b/roles/smb-sshfs-client/defaults/main.yml index 120b76a..19fe2da 100644 --- a/roles/smb-sshfs-client/defaults/main.yml +++ b/roles/smb-sshfs-client/defaults/main.yml @@ -1,5 +1,5 @@ -basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" -ldap_server: sambox -home_server: sambox +basedn: "{{ 'dc=' + ( ansible_dns['domain'] | default('intern') | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +ldap_server: ldap +home_server: homes min_id_sssd: 5000 max_id_sssd: 20000 diff --git a/roles/smb-sshfs-client/tasks/main.yml b/roles/smb-sshfs-client/tasks/main.yml index 0e9391f..adedc0e 100644 --- a/roles/smb-sshfs-client/tasks/main.yml +++ b/roles/smb-sshfs-client/tasks/main.yml @@ -1,7 +1,4 @@ --- -- fail: msg="The machine's domain must not be empty." - when: ansible_domain | length == 0 - - name: install needed packages apt: name: From 4b5818b883dc16e121a3f1ff6edb6decc4e2a955 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 10:13:58 +0200 Subject: [PATCH 153/504] Add daily installer to menu for testing. --- roles/prepare4clients/tasks/main.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 7124106..3cefa14 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -161,9 +161,15 @@ block: | menuentry 'Debian {{ di_version }} (amd64) + preseed + sambox-client.yml' { regexp --set=1:oct4 --set=2:oct5 --set=3:oct6 "\:([[:xdigit:]]+)\:([[:xdigit:]]+)\:([[:xdigit:]]+)\$" $net_default_mac - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} domain={{ ansible_domain }} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } + + menuentry 'Debian daily (amd64) + preseed + sambox-client.yml' { + regexp --set=1:oct4 --set=2:oct5 --set=3:oct6 "\:([[:xdigit:]]+)\:([[:xdigit:]]+)\:([[:xdigit:]]+)\$" $net_default_mac + linux /d-i/n-a/daily/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + initrd /d-i/n-a/daily/amd64/initrd.gz + } marker: "# {mark} ANSIBLE MANAGED BLOCK sambox-client" notify: "rebuild di-netboot-assistant menu" when: samba.stat.exists From 657185cd4619134368bd48738bbbf12aeb055898 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 10:15:18 +0200 Subject: [PATCH 154/504] Deploy server's ssh pubkey to clients. --- roles/smb-sshfs-client/tasks/main.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/roles/smb-sshfs-client/tasks/main.yml b/roles/smb-sshfs-client/tasks/main.yml index adedc0e..c3cd238 100644 --- a/roles/smb-sshfs-client/tasks/main.yml +++ b/roles/smb-sshfs-client/tasks/main.yml @@ -52,4 +52,13 @@ >rootansibleDebian-gdm insertafter: "" +- name: make sure .ssh exists + file: + path: /root/.ssh + state: directory + mode: '0700' +- name: fetch homes server host key for sshfs + shell: + cmd: ssh-keyscan -H {{ home_server }} >> /root/.ssh/known_hosts + creates: /root/.ssh/known_hosts From 013c250e50ff407cc6c8f87617b985013d2d42d2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 11:42:18 +0200 Subject: [PATCH 155/504] Fix/improve git-repo service. --- roles/prepare4clients/templates/git-repo.j2 | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/roles/prepare4clients/templates/git-repo.j2 b/roles/prepare4clients/templates/git-repo.j2 index 667fff4..8ac7cee 100644 --- a/roles/prepare4clients/templates/git-repo.j2 +++ b/roles/prepare4clients/templates/git-repo.j2 @@ -8,9 +8,7 @@ Restart=always RestartSec=500ms SyslogIdentifier=git-daemon - -User=git -Group=git +DynamicUser=yes [Install] WantedBy=multi-user.target From 13993ef45e21eee7be9361f97e07dacb806dc6a7 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 20:59:41 +0200 Subject: [PATCH 156/504] Minor fixes for the DHCP and DNS setup. --- roles/dns-dhcp-tftp/handlers/main.yml | 4 ++++ roles/dns-dhcp-tftp/tasks/main.yml | 2 ++ roles/dns-dhcp-tftp/templates/resolv.conf.j2 | 2 +- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/roles/dns-dhcp-tftp/handlers/main.yml b/roles/dns-dhcp-tftp/handlers/main.yml index 8dec007..1f48f0f 100644 --- a/roles/dns-dhcp-tftp/handlers/main.yml +++ b/roles/dns-dhcp-tftp/handlers/main.yml @@ -9,3 +9,7 @@ - name: restart tftpd-hpa systemd: name=tftpd-hpa state=restarted enabled=yes listen: restart tftpd-hpa + +- name: restart dhcp-client + systemd: name=ifup@{{ if_wan }} state=restarted enabled=yes + listen: restart dhcp-client diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dns-dhcp-tftp/tasks/main.yml index 521f8b6..1d4d741 100644 --- a/roles/dns-dhcp-tftp/tasks/main.yml +++ b/roles/dns-dhcp-tftp/tasks/main.yml @@ -66,6 +66,7 @@ template: src: resolv.conf.j2 dest: /etc/resolv.conf + notify: restart isc-dhcp-server ## stop dhclient from overwriting /etc/resolv.conf: - name: supersede dhcp client data @@ -75,6 +76,7 @@ supersede domain-search "{{ ansible_domain }}"; supersede domain-name-servers 127.0.0.1; insertbefore: "#send dhcp-client-identifier.*" + notify: restart dhcp-client - name: generate rndc key command: diff --git a/roles/dns-dhcp-tftp/templates/resolv.conf.j2 b/roles/dns-dhcp-tftp/templates/resolv.conf.j2 index 7118830..36d45af 100644 --- a/roles/dns-dhcp-tftp/templates/resolv.conf.j2 +++ b/roles/dns-dhcp-tftp/templates/resolv.conf.j2 @@ -1,2 +1,2 @@ -search {{ ansible_domain }} +search {{ ansible_domain }}. nameserver 127.0.0.1 From 89545ab4a73f667d78f8722510253d3751ef3c61 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 10 Apr 2021 21:34:46 +0200 Subject: [PATCH 157/504] Make sure gnome-keyring-daemon is not started, it fails with sshfs. --- roles/smb-sshfs-client/tasks/main.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/smb-sshfs-client/tasks/main.yml b/roles/smb-sshfs-client/tasks/main.yml index c3cd238..0aaedde 100644 --- a/roles/smb-sshfs-client/tasks/main.yml +++ b/roles/smb-sshfs-client/tasks/main.yml @@ -62,3 +62,7 @@ shell: cmd: ssh-keyscan -H {{ home_server }} >> /root/.ssh/known_hosts creates: /root/.ssh/known_hosts + +## gnome-keyring fails with sshfs: +- name: disable gnome-keyring-daemon + command: dpkg-divert --divert /usr/bin/gnome-keyring-daemon.distrib --rename /usr/bin/gnome-keyring-daemon From 08cc1889fcdb87a627f1e98df2835224a6c42c54 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 1 May 2021 09:04:22 +0200 Subject: [PATCH 158/504] Fixes and shellcheck-cleanup. --- roles/ldap/templates/debian-lan.j2 | 56 ++++++++++++++++-------------- 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/roles/ldap/templates/debian-lan.j2 b/roles/ldap/templates/debian-lan.j2 index dba9532..b2014e1 100644 --- a/roles/ldap/templates/debian-lan.j2 +++ b/roles/ldap/templates/debian-lan.j2 @@ -8,12 +8,12 @@ set -eu usage(){ cat < |none - $(basename $0) adduser [] - $(basename $0) deluser - $(basename $0) delhost - $(basename $0) ldapvi - $(basename $0) + $(basename "$0") adduser |none + $(basename "$0") adduser [] + $(basename "$0") deluser + $(basename "$0") delhost + $(basename "$0") ldapvi + $(basename "$0") : User ID (login name) : Password @@ -28,7 +28,7 @@ Usage: deluser deluser … - Every line is processed like a single call to the $(basename $0) program. + Every line is processed like a single call to the $(basename "$0") program. EOF } @@ -48,13 +48,13 @@ if [ $# -lt 2 ] ; then $0 $LINE done < "$1" ## reset cache after mass import/deletion: - sss_cache -U -G + which sss_cache > /dev/null && sss_cache -U -G exit 0 else usage exit 1 fi -elif [ $1 = adduser -a $# -lt 3 ] ; then +elif [ "$1" = adduser ] && [ $# -lt 3 ] ; then echo "Error: Password missing." usage exit 1 @@ -93,11 +93,11 @@ nextnum(){ local bsta bend all uids gids num ## Search for the next pair of identical free IDs: - while [ $id -le $MAXID ] ; do + while [ "$id" -le "$MAXID" ] ; do bsta=$id - bend=$(( $bsta + $RANGE )) + bend=$(( bsta + RANGE )) - all="$(seq $bsta $bend)" + all="$(seq "$bsta" "$bend")" uids="$(ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=people,$BASEDN" "(&(objectClass=posixAccount)(uidNumber>=$bsta)(uidNumber<=$bend))" \ uidNumber 2>/dev/null | grep "uidNumber: " | cut -f2 -d ' ' | sort -g | uniq)" gids="$(ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=groups,$BASEDN" "(&(objectClass=posixGroup)(gidNumber>=$bsta)(uidNumber<=$bend))" \ @@ -108,10 +108,10 @@ nextnum(){ num=$(comm -12 <(echo "$fuids") <(echo "$fgids") | head -1) if [ -n "$num" ] ; then - echo $num + echo "$num" return else - id=$(( $bend + 1 )) + id=$(( bend + 1 )) fi done ## something went wrong: @@ -125,6 +125,8 @@ add-user(){ local grp="$3" local gn="$4" local sn="$5" + local uidNumber + local gidNumber if ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b "ou=people,$BASEDN" "(&(objectClass=posixAccount)(uid=$id))" uid 2>/dev/null \ | grep -q "uid: $id" ; then @@ -132,10 +134,10 @@ add-user(){ return fi - local uidNumber=$(nextnum) - local gidNumber=$uidNumber + uidNumber=$(nextnum) + gidNumber=$uidNumber - if [ $uidNumber -ge $MAXID -o $gidNumber -ge $MAXID ] ; then + if [ "$uidNumber" -ge "$MAXID" ] || [ "$gidNumber" -ge "$MAXID" ] ; then echo "Error: $uidNumber and/or $gidNumber exceed max ID number ${MAXID}." exit 1 fi @@ -161,7 +163,7 @@ gidNumber: ${gidNumber} ################################## EOF - if [ -n "$grp" -a "$grp" != "none" ] ; then + if [ -n "$grp" ] && [ "$grp" != "none" ] ; then cat < /dev/null && sss_cache -U -G ## clear cache +echo "==== $* ====" case $COMMAND in adduser) add-user "${id}" "${pwEntry}" "${grp}" "${gn}" "${sn}" From 708f6df86ceec4ccb97932ad5f625a675ff09503 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 23 Aug 2021 11:15:35 +0200 Subject: [PATCH 159/504] Updates/fixes for bullseye and nextcloud 21. --- roles/nextcloud/tasks/main.yml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 8e395a0..240812f 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -36,6 +36,7 @@ - php-gd - php-gmp - php-imagick + - libmagickcore-6.q16-6-extra - php-intl - php-json - php-ldap @@ -84,10 +85,10 @@ regexp: "{{ item.regex }}" replace: "{{ item.replace }}" with_items: - - { regex: "^pm.max_children = .*$", replace: "pm.max_children = 120" } - - { regex: "^pm.start_servers = .*$", replace: "pm.start_servers = 12" } - - { regex: "^pm.min_spare_servers = .*$", replace: "pm.min_spare_servers = 6" } - - { regex: "^pm.max_spare_servers = .*$", replace: "pm.max_spare_servers = 18" } + - { regex: "^pm.max_children = .*$", replace: "pm.max_children = 10" } + - { regex: "^pm.start_servers = .*$", replace: "pm.start_servers = 4" } + - { regex: "^pm.min_spare_servers = .*$", replace: "pm.min_spare_servers = 2" } + - { regex: "^pm.max_spare_servers = .*$", replace: "pm.max_spare_servers = 6" } notify: "restart php-fpm" - name: increase php memory limit @@ -198,12 +199,21 @@ warn: False when: not nextcloud.stat.exists +- name: enable acpu for nextcloud updates + lineinfile: + path: /etc/php/{{ php_ver.stdout }}/mods-available/apcu.ini + line: "apc.enable_cli=1" + - name: allow access from LAN - command: sudo -u www-data php ./occ config:system:set trusted_domains 1 --value='192.168.*.*' + command: sudo -u www-data php ./occ config:system:set trusted_domains {{ item[0] }} --value='{{ item[1] }}' args: chdir: "{{ nc_dir }}" warn: False when: not nextcloud.stat.exists + loop: + - [1, '192.168.*.*'] + - [2, '10.*.*.*'] + - [3, '172.16.*.*'] ## nextcloudcron - name: provide nextcloudcron.service and .timer From 89ff43e126c5d1b0080570f3763a9ec3aa4a9852 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 18 Oct 2021 15:04:15 +0200 Subject: [PATCH 160/504] Fix some '.well-known/' redirects. --- roles/nextcloud/files/nextcloud.conf | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/roles/nextcloud/files/nextcloud.conf b/roles/nextcloud/files/nextcloud.conf index 17ee2ac..7c8baa6 100644 --- a/roles/nextcloud/files/nextcloud.conf +++ b/roles/nextcloud/files/nextcloud.conf @@ -19,9 +19,10 @@ Alias /nextcloud "/var/www/nextcloud" RewriteEngine on RewriteRule ^\.well-known/host-meta /nextcloud/public.php?service=host-meta [QSA,L] RewriteRule ^\.well-known/host-meta\.json /nextcloud/public.php?service=host-meta-json [QSA,L] - RewriteRule ^\.well-known/webfinger /nextcloud/public.php?service=webfinger [QSA,L] - RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L] - RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L] + RewriteRule ^\.well-known/webfinger /nextcloud/index.php/.well-known/webfinger [R=301,L] + RewriteRule ^\.well-known/nodeinfo /nextcloud/index.php/.well-known/nodeinfo [R=301,L] + RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav [R=301,L] + RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav [R=301,L] From 1e44ff34c394f4e2fd221f3ad7cfebd7d4207fa2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 1 Nov 2021 09:34:23 +0100 Subject: [PATCH 161/504] Move nextcloud upgrade to separate role. --- roles/nextcloud-upgrade/tasks/main.yml | 51 +++++++++++++++++++++++ roles/nextcloud/tasks/main.yml | 57 -------------------------- 2 files changed, 51 insertions(+), 57 deletions(-) create mode 100644 roles/nextcloud-upgrade/tasks/main.yml diff --git a/roles/nextcloud-upgrade/tasks/main.yml b/roles/nextcloud-upgrade/tasks/main.yml new file mode 100644 index 0000000..12e3964 --- /dev/null +++ b/roles/nextcloud-upgrade/tasks/main.yml @@ -0,0 +1,51 @@ +--- + +- name: check/run upgrade + command: sudo -u www-data php updater.phar --no-interaction + args: + chdir: "{{ nc_dir }}/updater" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is not search('Nothing to do.') + +- name: update apps + command: "sudo -u www-data php ./occ app:update --all" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout | length > 0 + +- name: install extra apps + command: "sudo -u www-data php ./occ app:install {{ item }}" + args: + chdir: "{{ nc_dir }}" + warn: False + with_items: "{{ nc_apps }}" + register: cmd_result + changed_when: cmd_result.stdout is not search('already installed') + failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 + +- name: add missing indices + command: "sudo -u www-data php ./occ db:add-missing-indices" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is search('table updated successfully') + +- name: add missing columns + command: "sudo -u www-data php ./occ db:add-missing-columns" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is search('table updated successfully') + +- name: convert filecache to bigint + command: "sudo -u www-data php ./occ -n db:convert-filecache-bigint" + args: + chdir: "{{ nc_dir }}" + warn: False + register: cmd_result + changed_when: cmd_result.stdout is not search('tables already up to date') diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 240812f..5506349 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -225,63 +225,6 @@ - nextcloudcron.timer notify: "enable nextcloudcron.timer" -- name: check/run upgrade - command: sudo -u www-data php updater.phar --no-interaction - args: - chdir: "{{ nc_dir }}/updater" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is not search('Nothing to do.') - when: allow_download|bool - -## app updates and installations: -- name: update apps - command: "sudo -u www-data php ./occ app:update --all" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout | length > 0 - when: allow_download|bool - -- name: install extra apps - command: "sudo -u www-data php ./occ app:install {{ item }}" - args: - chdir: "{{ nc_dir }}" - warn: False - with_items: "{{ nc_apps }}" - register: cmd_result - changed_when: cmd_result.stdout is not search('already installed') - failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 - when: allow_download|bool or run_in_installer|default(false)|bool - -## nextcloud maintenance -- name: add missing indices - command: "sudo -u www-data php ./occ db:add-missing-indices" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is search('table updated successfully') - -- name: add missing columns - command: "sudo -u www-data php ./occ db:add-missing-columns" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is search('table updated successfully') - -- name: convert filecache to bigint - command: "sudo -u www-data php ./occ -n db:convert-filecache-bigint" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is not search('tables already up to date') - - - - name: add default NIC to public zone firewalld: interface: "{{ ansible_default_ipv4.interface }}" From ede02d476129064975551140ab18bc38a55d6456 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 1 Nov 2021 09:59:10 +0100 Subject: [PATCH 162/504] Run DB tasks only on nextcloud upgrade. --- roles/nextcloud-upgrade/tasks/main.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/roles/nextcloud-upgrade/tasks/main.yml b/roles/nextcloud-upgrade/tasks/main.yml index 12e3964..497c9aa 100644 --- a/roles/nextcloud-upgrade/tasks/main.yml +++ b/roles/nextcloud-upgrade/tasks/main.yml @@ -5,9 +5,9 @@ args: chdir: "{{ nc_dir }}/updater" warn: False - register: cmd_result - changed_when: cmd_result.stdout is not search('Nothing to do.') - + register: upgrade_result + changed_when: upgrade_result.stdout is not search('Nothing to do.') + - name: update apps command: "sudo -u www-data php ./occ app:update --all" args: @@ -26,6 +26,7 @@ changed_when: cmd_result.stdout is not search('already installed') failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 +## DB fixes (only on upgrade) - name: add missing indices command: "sudo -u www-data php ./occ db:add-missing-indices" args: @@ -33,6 +34,7 @@ warn: False register: cmd_result changed_when: cmd_result.stdout is search('table updated successfully') + when: upgrade_result.changed | default(true) - name: add missing columns command: "sudo -u www-data php ./occ db:add-missing-columns" @@ -41,6 +43,7 @@ warn: False register: cmd_result changed_when: cmd_result.stdout is search('table updated successfully') + when: upgrade_result.changed | default(true) - name: convert filecache to bigint command: "sudo -u www-data php ./occ -n db:convert-filecache-bigint" @@ -49,3 +52,4 @@ warn: False register: cmd_result changed_when: cmd_result.stdout is not search('tables already up to date') + when: upgrade_result.changed | default(true) From b120a31c7d9f0983bbf71130922e5b2ce1b8aa28 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 1 Nov 2021 12:54:03 +0100 Subject: [PATCH 163/504] Combined playbook for cloudboxes and separate (nextcloud) hosts. --- cloudbox.yml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/cloudbox.yml b/cloudbox.yml index 6e89cdd..81634fd 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -2,7 +2,7 @@ # This playbook deploys the cloudbox on a minimal installation. - name: apply configuration to the cloudbox - hosts: all + hosts: cloudboxes remote_user: ansible become: Yes vars: @@ -31,4 +31,24 @@ # - ddns-update # - low-power - nextcloud + - nextcloud-upgrade - backup + + +## Hosts in the the 'only_nextcloud'-group are only upgraded: + +- name: upgrade nextcloud only + hosts: only_nextcloud + remote_user: ansible + become: Yes + vars: + nc_dir: "/var/www/nextcloud" + nc_apps: + - calendar + - notes + ansible_python_interpreter: "/usr/bin/python3" + + roles: + - up2date-debian + - nextcloud-upgrade + From b920bdf52b48a783150b05e703c97cc7914ba135 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 10 Nov 2021 17:01:56 +0100 Subject: [PATCH 164/504] Provide playbook and role to deploy containers. The containers are deployed for educational purposes with user 'ansible' in the sudo group and an empty password. SSH login is available via ports 10000 upwards on the host. Port 80 is forwarded as well (ssh port + 100). The container's rootfs is read only with an overlay: After restart of the container, modifications are lost. --- edubox.yml | 16 +++ roles/educontainer/tasks/main.yml | 114 ++++++++++++++++++ .../educontainer/templates/contcfg.nspawn.j2 | 11 ++ roles/educontainer/templates/hostname.j2 | 1 + 4 files changed, 142 insertions(+) create mode 100644 edubox.yml create mode 100644 roles/educontainer/tasks/main.yml create mode 100644 roles/educontainer/templates/contcfg.nspawn.j2 create mode 100644 roles/educontainer/templates/hostname.j2 diff --git a/edubox.yml b/edubox.yml new file mode 100644 index 0000000..f952c29 --- /dev/null +++ b/edubox.yml @@ -0,0 +1,16 @@ +--- +# ansible-playbook edubox.yml -i , --ask-become-pass + +- name: apply configuration to the edubox + hosts: all # eduboxes + remote_user: ansible + become: yes + vars: + contname: cont + containers: "{{ range(0, 9 + 1) | list }}" + extra_pkgs: [apt-cacher-ng] + + roles: + - up2date-debian + - educontainer + diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml new file mode 100644 index 0000000..1f503b2 --- /dev/null +++ b/roles/educontainer/tasks/main.yml @@ -0,0 +1,114 @@ +## Prepare minimal systemd-nspawn containers for educational use. +## +## Port mapping to the host: +## +## container 0: ssh → host port 10000, HTTP → 10100 +## container 1: ssh → host port 10001, HTTP → 10101 +## ... ... ... +## +## User 'ansible' in the sudo group. Password is empty. +## + +- name: start all containers + command: machinectl start {{ contname }}{{ "%02d" | format(item|int) }} + loop: "{{ containers }}" + tags: + - never + - start + +- name: stop all containers + command: machinectl stop {{ contname }}{{ "%02d" | format(item|int) }} + loop: "{{ containers }}" + tags: + - never + - stop + +- name: purge all containers + command: machinectl remove {{ contname }}{{ "%02d" | format(item|int) }} + loop: "{{ containers }}" + tags: + - never + - purge + +- name: debootstrap minimal system + command: + cmd: > + debootstrap + --include=systemd-{{ contname }}ainer,openssh-server,sudo + --components=main,{{ contname }}rib,non-free stable + {{ contname }}00 http://deb.debian.org/debian + args: + chdir: /var/lib/machines/ + creates: /var/lib/machines/{{ contname }}00 + environment: + http_proxy: http://localhost:3142 + +- name: provide ansible user account + command: + cmd: > + chroot . sh -c '/usr/sbin/useradd -m -s /bin/bash + -c "Ansible User,,," -G sudo ansible' + args: + chdir: /var/lib/machines/{{ contname }}00 + creates: /var/lib/machines/{{ contname }}00/home/ansible + register: user_account + +- name: provide empty password for ansible user + command: + cmd: chroot . sh -c "passwd -d ansible" + args: + chdir: /var/lib/machines/{{ contname }}00 + when: user_account.changed | default(false) + +- name: allow empty passwords in ssh + lineinfile: + path: /var/lib/machines/{{ contname }}00/etc/ssh/sshd_config + insertafter: '#PermitEmptyPasswords no' + line: 'PermitEmptyPasswords yes' + # when: user_account.changed | default(false) + +- name: prepare directories + file: + path: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item }} + state: directory + loop: + - multi-user.target.wants + - sockets.target.wants + - network-online.target.wants + +- name: enable systemd-networkd service + file: + src: /lib/systemd/system/{{ item.src }} + dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} + state: link + force: yes + loop: + - { src: systemd-networkd.service, dest: dbus-org.freedesktop.network1.service } + - { src: systemd-networkd.service, dest: multi-user.target.wants/systemd-networkd.service } + - { src: systemd-networkd.socket, dest: sockets.target.wants/systemd-networkd.socket } + - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } + +- name: clone the initial container + command: machinectl clone {{ contname }}00 {{ contname }}{{ "%02d" | format(item|int) }} + args: + creates: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} + loop: "{{ containers[1:] }}" + +- name: provide container configuration + template: + src: contcfg.nspawn.j2 + dest: /etc/systemd/nspawn/{{ contname}}{{ "%02d" | format(item|int) }}.nspawn + loop: "{{ containers }}" + +- name: provide container hostname + template: + src: hostname.j2 + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}/etc/hostname + loop: "{{ containers }}" + +- name: start all containers on boot + systemd: + name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service + state: started + enabled: yes + loop: "{{ containers }}" diff --git a/roles/educontainer/templates/contcfg.nspawn.j2 b/roles/educontainer/templates/contcfg.nspawn.j2 new file mode 100644 index 0000000..c436224 --- /dev/null +++ b/roles/educontainer/templates/contcfg.nspawn.j2 @@ -0,0 +1,11 @@ +[Exec] +Capability=CAP_NET_ADMIN +ResolvConf=copy-host + +[Network] +Port=10{{ "%03d" | format(item|int) }}:22 +Port=10{{ "%03d" | format(item|int + 100) }}:80 + +[Files] +Volatile=overlay +PrivateUsersChown=false diff --git a/roles/educontainer/templates/hostname.j2 b/roles/educontainer/templates/hostname.j2 new file mode 100644 index 0000000..3c3ac55 --- /dev/null +++ b/roles/educontainer/templates/hostname.j2 @@ -0,0 +1 @@ +{{ contname }}{{ "%02d" | format(item|int) }} From fed5f71357c6a9212beaaa1e0bbb06f7f805511c Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 11 Nov 2021 18:40:14 +0100 Subject: [PATCH 165/504] Instead of cloning the image, link to the rootfs. Provide more individual files. --- roles/educontainer/tasks/main.yml | 21 ++++++++++++------- .../educontainer/templates/contcfg.nspawn.j2 | 2 ++ roles/educontainer/templates/hosts.j2 | 4 ++++ 3 files changed, 20 insertions(+), 7 deletions(-) create mode 100644 roles/educontainer/templates/hosts.j2 diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 1f503b2..6cc80b3 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -88,10 +88,11 @@ - { src: systemd-networkd.socket, dest: sockets.target.wants/systemd-networkd.socket } - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } -- name: clone the initial container - command: machinectl clone {{ contname }}00 {{ contname }}{{ "%02d" | format(item|int) }} - args: - creates: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} +- name: generate links to the initial container + file: + src: "{{ contname }}00" + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} + state: link loop: "{{ containers[1:] }}" - name: provide container configuration @@ -100,15 +101,21 @@ dest: /etc/systemd/nspawn/{{ contname}}{{ "%02d" | format(item|int) }}.nspawn loop: "{{ containers }}" -- name: provide container hostname +- name: provide container hostname file template: src: hostname.j2 - dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}/etc/hostname + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname + loop: "{{ containers }}" + +- name: provide container hosts file + template: + src: hosts.j2 + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts loop: "{{ containers }}" - name: start all containers on boot systemd: name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service - state: started + state: restarted enabled: yes loop: "{{ containers }}" diff --git a/roles/educontainer/templates/contcfg.nspawn.j2 b/roles/educontainer/templates/contcfg.nspawn.j2 index c436224..c15c32f 100644 --- a/roles/educontainer/templates/contcfg.nspawn.j2 +++ b/roles/educontainer/templates/contcfg.nspawn.j2 @@ -9,3 +9,5 @@ Port=10{{ "%03d" | format(item|int + 100) }}:80 [Files] Volatile=overlay PrivateUsersChown=false +BindReadOnly=/var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname:/etc/hostname +BindReadOnly=/var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts:/etc/hosts diff --git a/roles/educontainer/templates/hosts.j2 b/roles/educontainer/templates/hosts.j2 new file mode 100644 index 0000000..9767fea --- /dev/null +++ b/roles/educontainer/templates/hosts.j2 @@ -0,0 +1,4 @@ +127.0.0.1 localhost {{ contname }}{{ "%02d" | format(item|int) }} +::1 localhost {{ contname }}{{ "%02d" | format(item|int) }} ip6-localhost ip6-loopback +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters From 7bbfd817f81611388f14b9f747f428e2bfa03409 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 11 Nov 2021 23:10:48 +0100 Subject: [PATCH 166/504] Switch to persistent overlays. With tmpfs the containers' disk space is too limited. Better keep changes on the disk. --- roles/educontainer/tasks/main.yml | 34 +++++++++++++------ .../educontainer/templates/contcfg.nspawn.j2 | 4 ++- 2 files changed, 27 insertions(+), 11 deletions(-) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 6cc80b3..eb9f4f3 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -9,19 +9,14 @@ ## User 'ansible' in the sudo group. Password is empty. ## -- name: start all containers - command: machinectl start {{ contname }}{{ "%02d" | format(item|int) }} - loop: "{{ containers }}" - tags: - - never - - start - - name: stop all containers command: machinectl stop {{ contname }}{{ "%02d" | format(item|int) }} loop: "{{ containers }}" tags: - never - stop + - reset + - purge - name: purge all containers command: machinectl remove {{ contname }}{{ "%02d" | format(item|int) }} @@ -30,12 +25,31 @@ - never - purge +- name: reset all containers to the template + file: + path: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}-delta + state: absent + loop: "{{ containers }}" + tags: + - never + - reset + +- name: start all containers + command: machinectl start {{ contname }}{{ "%02d" | format(item|int) }} + loop: "{{ containers }}" + tags: + - never + - start + - reset + +########### + - name: debootstrap minimal system command: cmd: > debootstrap - --include=systemd-{{ contname }}ainer,openssh-server,sudo - --components=main,{{ contname }}rib,non-free stable + --include=systemd-container,openssh-server,sudo,python3 + --components=main,contrib,non-free stable {{ contname }}00 http://deb.debian.org/debian args: chdir: /var/lib/machines/ @@ -113,7 +127,7 @@ dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts loop: "{{ containers }}" -- name: start all containers on boot +- name: start all containers on boot and restart now systemd: name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service state: restarted diff --git a/roles/educontainer/templates/contcfg.nspawn.j2 b/roles/educontainer/templates/contcfg.nspawn.j2 index c15c32f..9f8b5ea 100644 --- a/roles/educontainer/templates/contcfg.nspawn.j2 +++ b/roles/educontainer/templates/contcfg.nspawn.j2 @@ -5,9 +5,11 @@ ResolvConf=copy-host [Network] Port=10{{ "%03d" | format(item|int) }}:22 Port=10{{ "%03d" | format(item|int + 100) }}:80 +Port=10{{ "%03d" | format(item|int + 200) }}:443 [Files] -Volatile=overlay +ReadOnly=yes +Overlay=+/:/var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}-delta:/ PrivateUsersChown=false BindReadOnly=/var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname:/etc/hostname BindReadOnly=/var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts:/etc/hosts From cb5ade4c84740e0db9ba7d242733d192768cb0b2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 11 Nov 2021 23:19:39 +0100 Subject: [PATCH 167/504] Provide 'sources.list' from the host and upgrade initial container. --- roles/educontainer/tasks/main.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index eb9f4f3..e2b5bdd 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -57,6 +57,20 @@ environment: http_proxy: http://localhost:3142 +- name: provide complete apt sources + copy: + src: /etc/apt/sources.list + dest: /var/lib/machines/{{ contname }}00/etc/apt/sources.list + remote_src: yes + +- name: upgrade container + command: + cmd: > + chroot . sh -c '/usr/bin/apt-get update && + /usr/bin/apt-get full-upgrade --yes' + args: + chdir: /var/lib/machines/{{ contname }}00 + - name: provide ansible user account command: cmd: > From e058def6674ee9830a0020d3829c1b9008943879 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 11 Nov 2021 23:38:20 +0100 Subject: [PATCH 168/504] Run in reverse order to remove the initial container last. --- roles/educontainer/tasks/main.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index e2b5bdd..52d31ca 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -11,7 +11,7 @@ - name: stop all containers command: machinectl stop {{ contname }}{{ "%02d" | format(item|int) }} - loop: "{{ containers }}" + loop: "{{ containers | reverse}}" tags: - never - stop @@ -20,7 +20,7 @@ - name: purge all containers command: machinectl remove {{ contname }}{{ "%02d" | format(item|int) }} - loop: "{{ containers }}" + loop: "{{ containers | reverse }}" tags: - never - purge @@ -29,14 +29,14 @@ file: path: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}-delta state: absent - loop: "{{ containers }}" + loop: "{{ containers | reverse }}" tags: - never - reset - name: start all containers command: machinectl start {{ contname }}{{ "%02d" | format(item|int) }} - loop: "{{ containers }}" + loop: "{{ containers | reverse }}" tags: - never - start From 426a6e8895f85810f7fea57ce8323870e61db20d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 12 Nov 2021 11:07:07 +0100 Subject: [PATCH 169/504] Prepare the host in pre_tasks. --- edubox.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/edubox.yml b/edubox.yml index f952c29..87ca8ee 100644 --- a/edubox.yml +++ b/edubox.yml @@ -10,7 +10,19 @@ containers: "{{ range(0, 9 + 1) | list }}" extra_pkgs: [apt-cacher-ng] + pre_tasks: + - name: enable apt-cacher-ng + lineinfile: + path: /etc/apt/apt.conf.d/30proxy + line: 'Acquire::http::Proxy "http://localhost:3142/";' + create: yes + + - name: enable and start systemd-networkd on the host + systemd: + name: systemd-networkd + state: started + enabled: yes + roles: - up2date-debian - educontainer - From 1b5f7ea0b516686fdd444b82f8090c30b9e25aed Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 12 Nov 2021 12:42:40 +0100 Subject: [PATCH 170/504] Minor fixes and improvements. --- roles/educontainer/tasks/main.yml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 52d31ca..46b8f5c 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -11,6 +11,7 @@ - name: stop all containers command: machinectl stop {{ contname }}{{ "%02d" | format(item|int) }} + register: stop_cont loop: "{{ containers | reverse}}" tags: - never @@ -18,6 +19,16 @@ - reset - purge +- name: wait for containers to shut down + pause: + seconds: 30 + when: stop_cont.changed | default(false) + tags: + - never + - stop + - reset + - purge + - name: purge all containers command: machinectl remove {{ contname }}{{ "%02d" | format(item|int) }} loop: "{{ containers | reverse }}" @@ -33,6 +44,7 @@ tags: - never - reset + - purge - name: start all containers command: machinectl start {{ contname }}{{ "%02d" | format(item|int) }} @@ -48,7 +60,7 @@ command: cmd: > debootstrap - --include=systemd-container,openssh-server,sudo,python3 + --include=systemd-container,openssh-server,sudo,python3,auto-apt-proxy --components=main,contrib,non-free stable {{ contname }}00 http://deb.debian.org/debian args: @@ -63,6 +75,11 @@ dest: /var/lib/machines/{{ contname }}00/etc/apt/sources.list remote_src: yes +- name: configure locale + lineinfile: + path: /var/lib/machines/{{ contname }}00/etc/profile + line: 'export LANG=C' + - name: upgrade container command: cmd: > @@ -93,7 +110,7 @@ path: /var/lib/machines/{{ contname }}00/etc/ssh/sshd_config insertafter: '#PermitEmptyPasswords no' line: 'PermitEmptyPasswords yes' - # when: user_account.changed | default(false) + when: user_account.changed | default(false) - name: prepare directories file: From baba55e05a7d065ed8ae3252d765c70092e32c6e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 12 Nov 2021 15:29:39 +0100 Subject: [PATCH 171/504] Optional non-empty passwords for the container user. --- edubox.yml | 3 +++ roles/educontainer/tasks/main.yml | 11 +++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/edubox.yml b/edubox.yml index 87ca8ee..60c2e13 100644 --- a/edubox.yml +++ b/edubox.yml @@ -7,6 +7,9 @@ become: yes vars: contname: cont + ## Password for the user 'ansible' in the container, + ## leave empty to log in without password: + contpwd: "" containers: "{{ range(0, 9 + 1) | list }}" extra_pkgs: [apt-cacher-ng] diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 46b8f5c..3ce27c5 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -103,14 +103,21 @@ cmd: chroot . sh -c "passwd -d ansible" args: chdir: /var/lib/machines/{{ contname }}00 - when: user_account.changed | default(false) + when: user_account.changed | default(false) and contpwd | length == 0 + +- name: provide password for container ansible user + command: + cmd: chroot . sh -c "echo ansible:{{ contpwd }} | chpasswd" + args: + chdir: /var/lib/machines/{{ contname }}00 + when: user_account.changed | default(true) and contpwd | length > 0 - name: allow empty passwords in ssh lineinfile: path: /var/lib/machines/{{ contname }}00/etc/ssh/sshd_config insertafter: '#PermitEmptyPasswords no' line: 'PermitEmptyPasswords yes' - when: user_account.changed | default(false) + when: user_account.changed | default(false) and contpwd | length == 0 - name: prepare directories file: From fcb2e99cc569f3767c0c2b3a599e4a2c69ab3ce9 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 12 Nov 2021 16:46:41 +0100 Subject: [PATCH 172/504] Add some documentation. --- edubox.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/edubox.yml b/edubox.yml index 60c2e13..b1b102d 100644 --- a/edubox.yml +++ b/edubox.yml @@ -1,5 +1,22 @@ --- -# ansible-playbook edubox.yml -i , --ask-become-pass +## This playbook deploys a series of minimal systemd-nspawn containers +## for educational use on a host, for example to learn ansible! +## All containers use an apt cache on the host system and forward port +## 22 (ssh), 80 (http) and 443 (https) to ports >= 10000, 10100 and 10200 +## respectively. A user 'ansible' in the 'sudo' group is prepared, +## either with empty password or an initial password to be set below. +## +## Modifications of the initial containers are kept in an overlay +## directory next to the container images in '/var/lib/machines/'. +## This allows to visit and compare the work of students on the host. +## To manage the containers after installation, run the playbook with +## one of the the following tags: +## +## --tags=start start all containers +## --tags=stop stop all containers +## --tags=reset reset all containers to the initial image +## --tags=purge purge all containers +## - name: apply configuration to the edubox hosts: all # eduboxes @@ -10,6 +27,7 @@ ## Password for the user 'ansible' in the container, ## leave empty to log in without password: contpwd: "" + ## Adjust the number of containers here: containers: "{{ range(0, 9 + 1) | list }}" extra_pkgs: [apt-cacher-ng] From 85836e311e6547ab6e7989dc7885be19a5fce022 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Fri, 12 Nov 2021 20:23:58 +0100 Subject: [PATCH 173/504] Move container restart task to handlers. --- roles/educontainer/handlers/main.yml | 7 +++++++ roles/educontainer/tasks/main.yml | 18 ++++++++++-------- 2 files changed, 17 insertions(+), 8 deletions(-) create mode 100644 roles/educontainer/handlers/main.yml diff --git a/roles/educontainer/handlers/main.yml b/roles/educontainer/handlers/main.yml new file mode 100644 index 0000000..44ccc8e --- /dev/null +++ b/roles/educontainer/handlers/main.yml @@ -0,0 +1,7 @@ +- name: enable and restart containers + systemd: + name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service + state: restarted + enabled: yes + loop: "{{ containers }}" + listen: enable and restart containers diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 3ce27c5..3e6f1f8 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -6,7 +6,7 @@ ## container 1: ssh → host port 10001, HTTP → 10101 ## ... ... ... ## -## User 'ansible' in the sudo group. Password is empty. +## User 'ansible' in the sudo group. Password is {{ contpwd }}. ## - name: stop all containers @@ -68,6 +68,7 @@ creates: /var/lib/machines/{{ contname }}00 environment: http_proxy: http://localhost:3142 + notify: enable and restart containers - name: provide complete apt sources copy: @@ -127,6 +128,7 @@ - multi-user.target.wants - sockets.target.wants - network-online.target.wants + notify: enable and restart containers - name: enable systemd-networkd service file: @@ -139,6 +141,9 @@ - { src: systemd-networkd.service, dest: multi-user.target.wants/systemd-networkd.service } - { src: systemd-networkd.socket, dest: sockets.target.wants/systemd-networkd.socket } - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } + notify: enable and restart containers + +######## - name: generate links to the initial container file: @@ -146,28 +151,25 @@ dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} state: link loop: "{{ containers[1:] }}" + notify: enable and restart containers - name: provide container configuration template: src: contcfg.nspawn.j2 dest: /etc/systemd/nspawn/{{ contname}}{{ "%02d" | format(item|int) }}.nspawn loop: "{{ containers }}" + notify: enable and restart containers - name: provide container hostname file template: src: hostname.j2 dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname loop: "{{ containers }}" + notify: enable and restart containers - name: provide container hosts file template: src: hosts.j2 dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts loop: "{{ containers }}" - -- name: start all containers on boot and restart now - systemd: - name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service - state: restarted - enabled: yes - loop: "{{ containers }}" + notify: enable and restart containers From 90d340a1d5ca45720878be73dd90d4b1c729aa0a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 16 Nov 2021 20:39:23 +0100 Subject: [PATCH 174/504] Make sure stuff exists when needed. --- edubox.yml | 6 +++++- roles/educontainer/tasks/main.yml | 12 ++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/edubox.yml b/edubox.yml index b1b102d..b490eae 100644 --- a/edubox.yml +++ b/edubox.yml @@ -29,9 +29,13 @@ contpwd: "" ## Adjust the number of containers here: containers: "{{ range(0, 9 + 1) | list }}" - extra_pkgs: [apt-cacher-ng] pre_tasks: + - name: install apt-cacher-ng + apt: + name: apt-cacher-ng + state: latest + - name: enable apt-cacher-ng lineinfile: path: /etc/apt/apt.conf.d/30proxy diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 3e6f1f8..70381af 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -56,6 +56,13 @@ ########### +- name: install packages + apt: + name: + - systemd-container + - debootstrap + state: latest + - name: debootstrap minimal system command: cmd: > @@ -153,6 +160,11 @@ loop: "{{ containers[1:] }}" notify: enable and restart containers +- name: prepare nspawn config directory + file: + path: /etc/systemd/nspawn + state: directory + - name: provide container configuration template: src: contcfg.nspawn.j2 From ae0c26b117c658e93a0bd9a175ea068a47a1641d Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 16 Nov 2021 23:12:45 +0100 Subject: [PATCH 175/504] Fix too many open files error with more containers. --- roles/educontainer/tasks/main.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 70381af..5dea0d7 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -151,6 +151,16 @@ notify: enable and restart containers ######## +- name: prepare sysctl configuration + file: + path: /etc/sysctl.d/inotify.conf + state: touch + +- name: fix too many open files error + sysctl: + name: fs.inotify.max_user_instances + value: '1024' + sysctl_file: /etc/sysctl.d/inotify.conf - name: generate links to the initial container file: From 245c08c125b7ca0a74f3337df82e4c60b14aabaf Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 18 Nov 2021 20:18:56 +0100 Subject: [PATCH 176/504] Improve container management tasks. --- roles/educontainer/tasks/main.yml | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 5dea0d7..0e022af 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -10,19 +10,10 @@ ## - name: stop all containers - command: machinectl stop {{ contname }}{{ "%02d" | format(item|int) }} - register: stop_cont - loop: "{{ containers | reverse}}" - tags: - - never - - stop - - reset - - purge - -- name: wait for containers to shut down - pause: - seconds: 30 - when: stop_cont.changed | default(false) + systemd: + name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service + state: stopped + loop: "{{ containers | reverse }}" tags: - never - stop @@ -30,13 +21,15 @@ - purge - name: purge all containers - command: machinectl remove {{ contname }}{{ "%02d" | format(item|int) }} + command: + cmd: machinectl remove {{ contname }}{{ "%02d" | format(item|int) }} + removes: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} loop: "{{ containers | reverse }}" tags: - never - purge -- name: reset all containers to the template +- name: remove container overlay file: path: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}-delta state: absent @@ -47,7 +40,9 @@ - purge - name: start all containers - command: machinectl start {{ contname }}{{ "%02d" | format(item|int) }} + systemd: + name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service + state: started loop: "{{ containers | reverse }}" tags: - never From 0c48d933e711770c7348001f02c388581b15e71c Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 18 Nov 2021 20:20:28 +0100 Subject: [PATCH 177/504] Add more packages to the container. --- roles/educontainer/defaults/main.yml | 24 ++++++++++++++++++++++++ roles/educontainer/tasks/main.yml | 4 ++-- 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 roles/educontainer/defaults/main.yml diff --git a/roles/educontainer/defaults/main.yml b/roles/educontainer/defaults/main.yml new file mode 100644 index 0000000..34b95b2 --- /dev/null +++ b/roles/educontainer/defaults/main.yml @@ -0,0 +1,24 @@ +## generate most of this list with 'tasksel --task-packages standard' +cont_packages: + - systemd-container + - openssh-server + - sudo + - python3 + - auto-apt-proxy + + - bash-completion + - bind9-dnsutils + - file + - locales + - xz-utils + - lsof + - wget + - bind9-host + - man-db + - ca-certificates + - manpages + - libc-l10n + - traceroute + - bzip2 + - netcat-traditional + - telnet diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 0e022af..74876de 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -58,11 +58,11 @@ - debootstrap state: latest -- name: debootstrap minimal system +- name: debootstrap base system command: cmd: > debootstrap - --include=systemd-container,openssh-server,sudo,python3,auto-apt-proxy + --include={{ cont_packages | join(',') }} --components=main,contrib,non-free stable {{ contname }}00 http://deb.debian.org/debian args: From 327f2eefacf2e4a18372f853857d2ba164625000 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Thu, 18 Nov 2021 20:22:00 +0100 Subject: [PATCH 178/504] Username variable. --- edubox.yml | 2 ++ roles/educontainer/tasks/main.yml | 16 ++++++++-------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/edubox.yml b/edubox.yml index b490eae..5bee3f2 100644 --- a/edubox.yml +++ b/edubox.yml @@ -24,6 +24,8 @@ become: yes vars: contname: cont + ## User name for the user in the container: + contuser: ansi ## Password for the user 'ansible' in the container, ## leave empty to log in without password: contpwd: "" diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 74876de..b175ff2 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -6,7 +6,7 @@ ## container 1: ssh → host port 10001, HTTP → 10101 ## ... ... ... ## -## User 'ansible' in the sudo group. Password is {{ contpwd }}. +## User '{{ contuser }}' in the sudo group. Password is '{{ contpwd }}'. ## - name: stop all containers @@ -91,26 +91,26 @@ args: chdir: /var/lib/machines/{{ contname }}00 -- name: provide ansible user account +- name: provide {{ contuser }} user account command: cmd: > chroot . sh -c '/usr/sbin/useradd -m -s /bin/bash - -c "Ansible User,,," -G sudo ansible' + -c "User {{ contuser }},,," -G sudo {{ contuser }}' args: chdir: /var/lib/machines/{{ contname }}00 - creates: /var/lib/machines/{{ contname }}00/home/ansible + creates: /var/lib/machines/{{ contname }}00/home/{{ contuser }} register: user_account -- name: provide empty password for ansible user +- name: provide empty password for {{ contuser }} user command: - cmd: chroot . sh -c "passwd -d ansible" + cmd: chroot . sh -c "passwd -d {{ contuser }}" args: chdir: /var/lib/machines/{{ contname }}00 when: user_account.changed | default(false) and contpwd | length == 0 -- name: provide password for container ansible user +- name: provide password for container {{ contuser }} user command: - cmd: chroot . sh -c "echo ansible:{{ contpwd }} | chpasswd" + cmd: chroot . sh -c "echo {{ contuser }}:{{ contpwd }} | chpasswd" args: chdir: /var/lib/machines/{{ contname }}00 when: user_account.changed | default(true) and contpwd | length > 0 From 0ed4230794add0c322c00e96b54328b8ae1196b0 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 20 Nov 2021 14:38:22 +0100 Subject: [PATCH 179/504] Split container package list. --- edubox.yml | 16 +++++++++++++++- roles/educontainer/defaults/main.yml | 17 +++-------------- roles/educontainer/tasks/main.yml | 2 +- 3 files changed, 19 insertions(+), 16 deletions(-) diff --git a/edubox.yml b/edubox.yml index 5bee3f2..47eb7c9 100644 --- a/edubox.yml +++ b/edubox.yml @@ -3,7 +3,7 @@ ## for educational use on a host, for example to learn ansible! ## All containers use an apt cache on the host system and forward port ## 22 (ssh), 80 (http) and 443 (https) to ports >= 10000, 10100 and 10200 -## respectively. A user 'ansible' in the 'sudo' group is prepared, +## respectively. A user 'ansi' in the 'sudo' group is prepared, ## either with empty password or an initial password to be set below. ## ## Modifications of the initial containers are kept in an overlay @@ -31,6 +31,20 @@ contpwd: "" ## Adjust the number of containers here: containers: "{{ range(0, 9 + 1) | list }}" + ## Additional packages to be installed in the container: + cont_packages_extra: + - bind9-dnsutils + - file + - locales + - xz-utils + - lsof + - wget + - bind9-host + - libc-l10n + - traceroute + - bzip2 + - netcat-traditional + - telnet pre_tasks: - name: install apt-cacher-ng diff --git a/roles/educontainer/defaults/main.yml b/roles/educontainer/defaults/main.yml index 34b95b2..b58b8b7 100644 --- a/roles/educontainer/defaults/main.yml +++ b/roles/educontainer/defaults/main.yml @@ -5,20 +5,9 @@ cont_packages: - sudo - python3 - auto-apt-proxy - - bash-completion - - bind9-dnsutils - - file - - locales - - xz-utils - - lsof - - wget - - bind9-host - - man-db - ca-certificates + - man-db - manpages - - libc-l10n - - traceroute - - bzip2 - - netcat-traditional - - telnet + +cont_packages_extra: [] diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index b175ff2..2d051c8 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -62,7 +62,7 @@ command: cmd: > debootstrap - --include={{ cont_packages | join(',') }} + --include={{ cont_packages | union(cont_packages_extra) | join(',') }} --components=main,contrib,non-free stable {{ contname }}00 http://deb.debian.org/debian args: From 2c0a1c539262f437cdef77688190b5964ca9825e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 20 Nov 2021 17:00:19 +0100 Subject: [PATCH 180/504] Implement 'setup'-tag to re-setup the containers. --- edubox.yml | 1 + roles/educontainer/tasks/main.yml | 147 ++--------------------------- roles/educontainer/tasks/setup.yml | 141 +++++++++++++++++++++++++++ 3 files changed, 152 insertions(+), 137 deletions(-) create mode 100644 roles/educontainer/tasks/setup.yml diff --git a/edubox.yml b/edubox.yml index 47eb7c9..919eb47 100644 --- a/edubox.yml +++ b/edubox.yml @@ -16,6 +16,7 @@ ## --tags=stop stop all containers ## --tags=reset reset all containers to the initial image ## --tags=purge purge all containers +## --tags=setup purge all containers and setup again ## - name: apply configuration to the edubox diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 2d051c8..0bd2fb4 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -19,6 +19,7 @@ - stop - reset - purge + - setup - name: purge all containers command: @@ -28,6 +29,7 @@ tags: - never - purge + - setup - name: remove container overlay file: @@ -38,6 +40,7 @@ - never - reset - purge + - setup - name: start all containers systemd: @@ -51,142 +54,12 @@ ########### -- name: install packages - apt: - name: - - systemd-container - - debootstrap - state: latest +- name: import setup.yml tasks + import_tasks: setup.yml + tags: + - never + - setup -- name: debootstrap base system - command: - cmd: > - debootstrap - --include={{ cont_packages | union(cont_packages_extra) | join(',') }} - --components=main,contrib,non-free stable - {{ contname }}00 http://deb.debian.org/debian - args: - chdir: /var/lib/machines/ - creates: /var/lib/machines/{{ contname }}00 - environment: - http_proxy: http://localhost:3142 - notify: enable and restart containers +- name: import setup.yml tasks + import_tasks: setup.yml -- name: provide complete apt sources - copy: - src: /etc/apt/sources.list - dest: /var/lib/machines/{{ contname }}00/etc/apt/sources.list - remote_src: yes - -- name: configure locale - lineinfile: - path: /var/lib/machines/{{ contname }}00/etc/profile - line: 'export LANG=C' - -- name: upgrade container - command: - cmd: > - chroot . sh -c '/usr/bin/apt-get update && - /usr/bin/apt-get full-upgrade --yes' - args: - chdir: /var/lib/machines/{{ contname }}00 - -- name: provide {{ contuser }} user account - command: - cmd: > - chroot . sh -c '/usr/sbin/useradd -m -s /bin/bash - -c "User {{ contuser }},,," -G sudo {{ contuser }}' - args: - chdir: /var/lib/machines/{{ contname }}00 - creates: /var/lib/machines/{{ contname }}00/home/{{ contuser }} - register: user_account - -- name: provide empty password for {{ contuser }} user - command: - cmd: chroot . sh -c "passwd -d {{ contuser }}" - args: - chdir: /var/lib/machines/{{ contname }}00 - when: user_account.changed | default(false) and contpwd | length == 0 - -- name: provide password for container {{ contuser }} user - command: - cmd: chroot . sh -c "echo {{ contuser }}:{{ contpwd }} | chpasswd" - args: - chdir: /var/lib/machines/{{ contname }}00 - when: user_account.changed | default(true) and contpwd | length > 0 - -- name: allow empty passwords in ssh - lineinfile: - path: /var/lib/machines/{{ contname }}00/etc/ssh/sshd_config - insertafter: '#PermitEmptyPasswords no' - line: 'PermitEmptyPasswords yes' - when: user_account.changed | default(false) and contpwd | length == 0 - -- name: prepare directories - file: - path: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item }} - state: directory - loop: - - multi-user.target.wants - - sockets.target.wants - - network-online.target.wants - notify: enable and restart containers - -- name: enable systemd-networkd service - file: - src: /lib/systemd/system/{{ item.src }} - dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} - state: link - force: yes - loop: - - { src: systemd-networkd.service, dest: dbus-org.freedesktop.network1.service } - - { src: systemd-networkd.service, dest: multi-user.target.wants/systemd-networkd.service } - - { src: systemd-networkd.socket, dest: sockets.target.wants/systemd-networkd.socket } - - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } - notify: enable and restart containers - -######## -- name: prepare sysctl configuration - file: - path: /etc/sysctl.d/inotify.conf - state: touch - -- name: fix too many open files error - sysctl: - name: fs.inotify.max_user_instances - value: '1024' - sysctl_file: /etc/sysctl.d/inotify.conf - -- name: generate links to the initial container - file: - src: "{{ contname }}00" - dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} - state: link - loop: "{{ containers[1:] }}" - notify: enable and restart containers - -- name: prepare nspawn config directory - file: - path: /etc/systemd/nspawn - state: directory - -- name: provide container configuration - template: - src: contcfg.nspawn.j2 - dest: /etc/systemd/nspawn/{{ contname}}{{ "%02d" | format(item|int) }}.nspawn - loop: "{{ containers }}" - notify: enable and restart containers - -- name: provide container hostname file - template: - src: hostname.j2 - dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname - loop: "{{ containers }}" - notify: enable and restart containers - -- name: provide container hosts file - template: - src: hosts.j2 - dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts - loop: "{{ containers }}" - notify: enable and restart containers diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml new file mode 100644 index 0000000..391ad4b --- /dev/null +++ b/roles/educontainer/tasks/setup.yml @@ -0,0 +1,141 @@ +--- + +- name: install packages + apt: + name: + - systemd-container + - debootstrap + state: latest + +- name: debootstrap base system + command: + cmd: > + debootstrap + --include={{ cont_packages | union(cont_packages_extra) | join(',') }} + --components=main,contrib,non-free stable + {{ contname }}00 http://deb.debian.org/debian + args: + chdir: /var/lib/machines/ + creates: /var/lib/machines/{{ contname }}00 + environment: + http_proxy: http://localhost:3142 + notify: enable and restart containers + +- name: provide complete apt sources + copy: + src: /etc/apt/sources.list + dest: /var/lib/machines/{{ contname }}00/etc/apt/sources.list + remote_src: yes + +- name: configure locale + lineinfile: + path: /var/lib/machines/{{ contname }}00/etc/profile + line: 'export LANG=C' + +- name: upgrade container + command: + cmd: > + chroot . sh -c '/usr/bin/apt-get update && + /usr/bin/apt-get full-upgrade --yes' + args: + chdir: /var/lib/machines/{{ contname }}00 + +- name: provide {{ contuser }} user account + command: + cmd: > + chroot . sh -c '/usr/sbin/useradd -m -s /bin/bash + -c "User {{ contuser }},,," -G sudo {{ contuser }}' + args: + chdir: /var/lib/machines/{{ contname }}00 + creates: /var/lib/machines/{{ contname }}00/home/{{ contuser }} + register: user_account + +- name: provide empty password for {{ contuser }} user + command: + cmd: chroot . sh -c "passwd -d {{ contuser }}" + args: + chdir: /var/lib/machines/{{ contname }}00 + when: user_account.changed | default(false) and contpwd | length == 0 + +- name: provide password for container {{ contuser }} user + command: + cmd: chroot . sh -c "echo {{ contuser }}:{{ contpwd }} | chpasswd" + args: + chdir: /var/lib/machines/{{ contname }}00 + when: user_account.changed | default(true) and contpwd | length > 0 + +- name: allow empty passwords in ssh + lineinfile: + path: /var/lib/machines/{{ contname }}00/etc/ssh/sshd_config + insertafter: '#PermitEmptyPasswords no' + line: 'PermitEmptyPasswords yes' + when: user_account.changed | default(false) and contpwd | length == 0 + +- name: prepare directories + file: + path: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item }} + state: directory + loop: + - multi-user.target.wants + - sockets.target.wants + - network-online.target.wants + notify: enable and restart containers + +- name: enable systemd-networkd service + file: + src: /lib/systemd/system/{{ item.src }} + dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} + state: link + force: yes + loop: + - { src: systemd-networkd.service, dest: dbus-org.freedesktop.network1.service } + - { src: systemd-networkd.service, dest: multi-user.target.wants/systemd-networkd.service } + - { src: systemd-networkd.socket, dest: sockets.target.wants/systemd-networkd.socket } + - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } + notify: enable and restart containers + +######## +- name: prepare sysctl configuration + file: + path: /etc/sysctl.d/inotify.conf + state: touch + +- name: fix too many open files error + sysctl: + name: fs.inotify.max_user_instances + value: '1024' + sysctl_file: /etc/sysctl.d/inotify.conf + +- name: generate links to the initial container + file: + src: "{{ contname }}00" + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }} + state: link + loop: "{{ containers[1:] }}" + notify: enable and restart containers + +- name: prepare nspawn config directory + file: + path: /etc/systemd/nspawn + state: directory + +- name: provide container configuration + template: + src: contcfg.nspawn.j2 + dest: /etc/systemd/nspawn/{{ contname}}{{ "%02d" | format(item|int) }}.nspawn + loop: "{{ containers }}" + notify: enable and restart containers + +- name: provide container hostname file + template: + src: hostname.j2 + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname + loop: "{{ containers }}" + notify: enable and restart containers + +- name: provide container hosts file + template: + src: hosts.j2 + dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts + loop: "{{ containers }}" + notify: enable and restart containers From d3e732bc89f803fcd4097c27d545e09fac7f417f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 20 Nov 2021 18:06:25 +0100 Subject: [PATCH 181/504] Fix tasks that falsely report 'changes'. --- roles/educontainer/tasks/setup.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index 391ad4b..b3bef38 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -39,6 +39,8 @@ /usr/bin/apt-get full-upgrade --yes' args: chdir: /var/lib/machines/{{ contname }}00 + register: cmd_result + changed_when: cmd_result.stdout is not search('0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.') - name: provide {{ contuser }} user account command: @@ -95,10 +97,11 @@ notify: enable and restart containers ######## -- name: prepare sysctl configuration - file: - path: /etc/sysctl.d/inotify.conf - state: touch +- name: prepare local sysctl config file + copy: + content: "# Avoid 'too many open files' error:" + dest: /etc/sysctl.d/inotify.conf + force: no - name: fix too many open files error sysctl: From 5b2407329103bea93ba8af37add8a23f69777453 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 14 Mar 2022 13:45:25 +0100 Subject: [PATCH 182/504] Fix apt problems. --- roles/educontainer/tasks/setup.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index b3bef38..42fdb55 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -36,7 +36,7 @@ command: cmd: > chroot . sh -c '/usr/bin/apt-get update && - /usr/bin/apt-get full-upgrade --yes' + DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get full-upgrade --yes' args: chdir: /var/lib/machines/{{ contname }}00 register: cmd_result From 6e350463e7492f3cb70516ebb9d933787d4622b1 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 14 Mar 2022 13:45:32 +0100 Subject: [PATCH 183/504] Fix preseeded ansible-pull run. --- roles/educontainer/tasks/setup.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index 42fdb55..91ce6f4 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -7,6 +7,12 @@ - debootstrap state: latest +- name: prepare machine directory + file: + path: /var/lib/machines/ + state: directory + mode: 0700 + - name: debootstrap base system command: cmd: > From aa34a0a9104747185b66f6a421ab5922e1b74169 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 14 Mar 2022 15:24:50 +0100 Subject: [PATCH 184/504] During preseeded install, apt-cacher is not yet available. --- roles/educontainer/tasks/setup.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index 91ce6f4..e3d1517 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -16,7 +16,7 @@ - name: debootstrap base system command: cmd: > - debootstrap + debootstrap --include={{ cont_packages | union(cont_packages_extra) | join(',') }} --components=main,contrib,non-free stable {{ contname }}00 http://deb.debian.org/debian @@ -24,7 +24,7 @@ chdir: /var/lib/machines/ creates: /var/lib/machines/{{ contname }}00 environment: - http_proxy: http://localhost:3142 + http_proxy: "{{ '' if run_in_installer|default(false) else 'http://localhost:3142' }}" notify: enable and restart containers - name: provide complete apt sources From 9e2a6a70e3e478971dcb1e2e7465ef0c81a367bc Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 16 Mar 2022 15:22:17 +0100 Subject: [PATCH 185/504] Fix warning about missing pseudo file systems. --- roles/educontainer/tasks/setup.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index e3d1517..37dfca0 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -38,13 +38,19 @@ path: /var/lib/machines/{{ contname }}00/etc/profile line: 'export LANG=C' +## Use 'chroot' here instead of 'systemd-nspawn -D …' to make it work +## with ansible-pull in the preseed debian installer: - name: upgrade container command: - cmd: > - chroot . sh -c '/usr/bin/apt-get update && - DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get full-upgrade --yes' + cmd: "{{ item }}" args: chdir: /var/lib/machines/{{ contname }}00 + loop: + - mount --bind /proc proc + - mount --bind /sys sys + - mount --bind /dev/pts dev/pts + - chroot . sh -c '/usr/bin/apt-get update && DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get full-upgrade --yes' + - umount proc sys dev/pts register: cmd_result changed_when: cmd_result.stdout is not search('0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.') From 3d3f0093ff0f299608212bab66b75d7f0c70feef Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Wed, 16 Mar 2022 17:31:37 +0100 Subject: [PATCH 186/504] Run 'setup' only on setup. --- roles/educontainer/tasks/main.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 0bd2fb4..5280173 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -54,12 +54,15 @@ ########### -- name: import setup.yml tasks - import_tasks: setup.yml - tags: - - never - - setup +- name: check if container template exists + ansible.builtin.stat: + path: "/var/lib/machines/{{ contname }}00" + register: cont + tags: + - always - name: import setup.yml tasks import_tasks: setup.yml - + when: cont.stat.isdir is not defined + tags: + - always From f9e8560f7b48a412ae29544300b5b601eb5d321a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 2 Apr 2022 10:05:27 +0200 Subject: [PATCH 187/504] Use systemd-resolved in the containers. If the host uses systemd-networkd and systemd-resolved too, the containers can be resolved from the host. --- roles/educontainer/tasks/setup.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index 37dfca0..3aa3b32 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -100,6 +100,7 @@ src: /lib/systemd/system/{{ item.src }} dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} state: link + follow: False force: yes loop: - { src: systemd-networkd.service, dest: dbus-org.freedesktop.network1.service } @@ -108,6 +109,18 @@ - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } notify: enable and restart containers +- name: enable systemd-resolved in containers + file: + src: /lib/systemd/system/{{ item.src }} + dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} + state: link + follow: False + force: yes + loop: + - { src: systemd-resolved.service, dest: dbus-org.freedesktop.resolve1.service } + - { src: systemd-resolved.service, dest: multi-user.target.wants/systemd-resolved.service } + notify: enable and restart containers + ######## - name: prepare local sysctl config file copy: From 37c767ff0c4fbc62a32222ea39ab982da5ffea72 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 2 Apr 2022 10:14:11 +0200 Subject: [PATCH 188/504] Rework systemd-networkd role. --- .../files/all-eth.network} | 2 +- .../handlers/main.yml | 14 ++++++++++ .../systemd-networkd-resolved/tasks/main.yml | 25 +++++++++++++++++ .../templates/20-static.network.j2 | 0 roles/systemd-networkd/handlers/main.yml | 15 ---------- roles/systemd-networkd/tasks/main.yml | 28 ------------------- 6 files changed, 40 insertions(+), 44 deletions(-) rename roles/{systemd-networkd/files/10-dhcp.network => systemd-networkd-resolved/files/all-eth.network} (75%) create mode 100644 roles/systemd-networkd-resolved/handlers/main.yml create mode 100644 roles/systemd-networkd-resolved/tasks/main.yml rename roles/{systemd-networkd => systemd-networkd-resolved}/templates/20-static.network.j2 (100%) delete mode 100644 roles/systemd-networkd/handlers/main.yml delete mode 100644 roles/systemd-networkd/tasks/main.yml diff --git a/roles/systemd-networkd/files/10-dhcp.network b/roles/systemd-networkd-resolved/files/all-eth.network similarity index 75% rename from roles/systemd-networkd/files/10-dhcp.network rename to roles/systemd-networkd-resolved/files/all-eth.network index aec1849..f2578d1 100644 --- a/roles/systemd-networkd/files/10-dhcp.network +++ b/roles/systemd-networkd-resolved/files/all-eth.network @@ -1,5 +1,5 @@ [Match] -Name=en* +Name=e* [Network] DHCP=yes diff --git a/roles/systemd-networkd-resolved/handlers/main.yml b/roles/systemd-networkd-resolved/handlers/main.yml new file mode 100644 index 0000000..6084965 --- /dev/null +++ b/roles/systemd-networkd-resolved/handlers/main.yml @@ -0,0 +1,14 @@ +- name: restart and enable systemd-networkd + systemd: + name: systemd-networkd + enabled: yes + state: restarted + daemon_reload: yes + listen: "start and enable systemd-networkd" + +- name: start and enable systemd-resolved + systemd: + name: systemd-resolved + enabled: yes + state: started + listen: "start and enable systemd-resolved" diff --git a/roles/systemd-networkd-resolved/tasks/main.yml b/roles/systemd-networkd-resolved/tasks/main.yml new file mode 100644 index 0000000..3033c67 --- /dev/null +++ b/roles/systemd-networkd-resolved/tasks/main.yml @@ -0,0 +1,25 @@ +- name: move /etc/network/interfaces away + command: + cmd: mv /etc/network/interfaces /etc/network/interfaces_orig + creates: /etc/network/interfaces_orig + +- name: switch to systemd-networkd + copy: + src: all-eth.network + dest: /etc/systemd/network/all-eth.network + notify: "start and enable systemd-networkd" + +#- name: install static configuration for networkd +# template: +# src: 20-static.network.j2 +# dest: /etc/systemd/network/20-static.network +# notify: "enable systemd-networkd" + +- name: enable local stub resolver + file: + src: /run/systemd/resolve/stub-resolv.conf + dest: /etc/resolv.conf + state: link + follow: False + force: yes + notify: "start and enable systemd-resolved" diff --git a/roles/systemd-networkd/templates/20-static.network.j2 b/roles/systemd-networkd-resolved/templates/20-static.network.j2 similarity index 100% rename from roles/systemd-networkd/templates/20-static.network.j2 rename to roles/systemd-networkd-resolved/templates/20-static.network.j2 diff --git a/roles/systemd-networkd/handlers/main.yml b/roles/systemd-networkd/handlers/main.yml deleted file mode 100644 index eaf56fa..0000000 --- a/roles/systemd-networkd/handlers/main.yml +++ /dev/null @@ -1,15 +0,0 @@ -- name: enable systemd-networkd - systemd: - name: systemd-networkd - enabled: yes - state: restarted - daemon_reload: yes - listen: "start and enable systemd-networkd" - -- name: use systemd-resolved - file: - src: /run/systemd/resolve/stub-resolv.conf - dest: /etc/resolv.conf - state: link - force: Yes - listen: "use systemd-resolved" diff --git a/roles/systemd-networkd/tasks/main.yml b/roles/systemd-networkd/tasks/main.yml deleted file mode 100644 index f863fa0..0000000 --- a/roles/systemd-networkd/tasks/main.yml +++ /dev/null @@ -1,28 +0,0 @@ -- name: check if /etc/network/interfaces is still there - stat: path=/etc/network/interfaces - register: interfaces - -- name: move /etc/network/interfaces away - command: mv /etc/network/interfaces /etc/network/interfaces_disabled - when: interfaces.stat.exists - -- name: install dynamic configuration for networkd - copy: - src: 10-dhcp.network - dest: /etc/systemd/network/10-dhcp.network - notify: "start and enable systemd-networkd" - -#- name: install static configuration for networkd -# template: -# src: 20-static.network.j2 -# dest: /etc/systemd/network/20-static.network -# notify: "enable systemd-networkd" - -- name: enable systemd-resolved - systemd: - name: systemd-resolved - enabled: yes - state: started - notify: "use systemd-resolved" - -- meta: flush_handlers From 4b4dad5bfee086d0011212dfcf5614819feb5dd9 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 2 Apr 2022 11:51:38 +0200 Subject: [PATCH 189/504] Make the containers resolvable from the host. --- edubox.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/edubox.yml b/edubox.yml index 919eb47..cd004bb 100644 --- a/edubox.yml +++ b/edubox.yml @@ -68,3 +68,4 @@ roles: - up2date-debian - educontainer + - systemd-networkd-resolved From b28542748276f0c11645e5287f1dcf743f915783 Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 00:26:46 +0300 Subject: [PATCH 190/504] Parameterize become_user To allow some flexibility in mixed environments. --- roles/prepare4clients/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 3cefa14..c3a2513 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -182,7 +182,7 @@ repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' dest: "{{ repo_dir }}" update: no - become_user: "ansible" + become_user: "{{ ansible_user }}" when: not run_in_installer|default(false)|bool - name: start git-repo From 53b54edd1879607dd379de2f85f12c7d254704d4 Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 00:28:01 +0300 Subject: [PATCH 191/504] Sync role names to the ones under roles/ Not sure why these were named differently but in any case couldn't get stuff working without this change. --- installbox.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/installbox.yml b/installbox.yml index 48e5d9f..6e1c4c6 100644 --- a/installbox.yml +++ b/installbox.yml @@ -38,7 +38,7 @@ roles: - up2date-debian - two-interface-firewalld - - dhcp-dns-dnsmasq - - tftp-netboot-installer + - dnsmasq + - netboot-installer - apt-cacher - prepare4clients From 1a9b3ba2e60703a664669063ae76317dc0944d4d Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 00:29:25 +0300 Subject: [PATCH 192/504] Parameterize most of the LAN config So that it adapts to e.g. 192.168.50/24 instead of 192.168.0/24 --- installbox.yml | 2 ++ roles/dns-dhcp-tftp/tasks/main.yml | 4 ++-- roles/dns-dhcp-tftp/templates/db.lan.j2 | 11 +++++++++++ roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 | 6 +++--- roles/dns-dhcp-tftp/templates/localzones.j2 | 6 +++--- 5 files changed, 21 insertions(+), 8 deletions(-) create mode 100644 roles/dns-dhcp-tftp/templates/db.lan.j2 diff --git a/installbox.yml b/installbox.yml index 6e1c4c6..37610d8 100644 --- a/installbox.yml +++ b/installbox.yml @@ -17,6 +17,8 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 + ipaddr_lan_threeoct: {{ ipaddr_lan.split('.')[0:3] | join('.')}} + ipaddr_lan_ptr: {{ ipaddr_lan | ansible.netcommon.ipaddr('revdns').split('.')[1:-1] | join('.') }} dhcp_range: 192.168.0.50,192.168.0.99,2h di_dist: "{{ ansible_distribution_release }}" diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dns-dhcp-tftp/tasks/main.yml index 1d4d741..26f11ec 100644 --- a/roles/dns-dhcp-tftp/tasks/main.yml +++ b/roles/dns-dhcp-tftp/tasks/main.yml @@ -42,7 +42,7 @@ dest: "/etc/bind/{{ item }}" loop: - db.intern - - db.192.168.0 + - db.lan - localzones notify: restart bind @@ -53,7 +53,7 @@ state: link loop: - db.intern - - db.192.168.0 + - db.lan notify: restart bind - name: enable local bind config diff --git a/roles/dns-dhcp-tftp/templates/db.lan.j2 b/roles/dns-dhcp-tftp/templates/db.lan.j2 new file mode 100644 index 0000000..3f942c1 --- /dev/null +++ b/roles/dns-dhcp-tftp/templates/db.lan.j2 @@ -0,0 +1,11 @@ +$TTL 500 +@ IN SOA {{ ansible_fqdn }}. root.{{ ansible_domain }}. ( + 1 ; Serial + 3600 ; Refresh + 1800 ; Retry + 720000 ; Expire + 6400 ) ; Negative Cache TTL +; +@ NS {{ ansible_fqdn }}. + MX 10 {{ ansible_fqdn }}. +{{ ipaddr_lan | ipaddr("address") | regex_replace("^.*\.(.+$)", "\\1") }} PTR {{ ansible_fqdn }}. diff --git a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 index b548beb..aa724b9 100644 --- a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 +++ b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 @@ -26,7 +26,7 @@ zone intern. { key rndc-key; } -zone 0.168.192.in-addr.arpa. { +zone "{{ ipaddr_lan_ptr }}" { primary 127.0.0.1; key rndc-key; } @@ -41,7 +41,7 @@ authoritative; #log-facility local7; ## The tftpd server IP address, for all clients. -next-server 192.168.0.10; +next-server {{ ipaddr_lan | ipaddr("address") }}; option arch code 93 = unsigned integer 16; if option arch = 00:07 { @@ -50,7 +50,7 @@ if option arch = 00:07 { filename "d-i/n-a/pxelinux.0"; } -subnet 192.168.0.0 netmask 255.255.255.0 { +subnet {{ ipaddr_lan | ipaddr("address") }} netmask {{ ipaddr_lan | ipaddr("netmask") }} { option routers {{ ipaddr_lan | ipaddr("address") }}; range {{ dhcp_start }} {{ dhcp_stop }}; } diff --git a/roles/dns-dhcp-tftp/templates/localzones.j2 b/roles/dns-dhcp-tftp/templates/localzones.j2 index b0d958c..180dbc0 100644 --- a/roles/dns-dhcp-tftp/templates/localzones.j2 +++ b/roles/dns-dhcp-tftp/templates/localzones.j2 @@ -1,10 +1,10 @@ include "/etc/bind/rndc.key"; -zone "0.168.192.in-addr.arpa" { +zone "{{ ipaddr_lan_ptr }}" { type master; notify no; - file "/etc/bind/db.192.168.0"; - journal "/var/lib/bind/db.192.168.0.jnl"; + file "/etc/bind/db.{{ ipaddr_lan_threeoct }}"; + journal "/var/lib/bind/db.{{ ipaddr_lan_threeoct }}.jnl"; allow-update { key rndc-key; }; }; From c56745215e38ad7b60802c04e8142df0abfd87bc Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 00:44:31 +0300 Subject: [PATCH 193/504] Quote fix --- installbox.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/installbox.yml b/installbox.yml index 37610d8..6ab32c3 100644 --- a/installbox.yml +++ b/installbox.yml @@ -17,8 +17,8 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - ipaddr_lan_threeoct: {{ ipaddr_lan.split('.')[0:3] | join('.')}} - ipaddr_lan_ptr: {{ ipaddr_lan | ansible.netcommon.ipaddr('revdns').split('.')[1:-1] | join('.') }} + ipaddr_lan_threeoct: "{{ ipaddr_lan.split('.')[0:3] | join('.')}}" + ipaddr_lan_ptr: "{{ ipaddr_lan | ansible.netcommon.ipaddr('revdns').split('.')[1:-1] | join('.') }}" dhcp_range: 192.168.0.50,192.168.0.99,2h di_dist: "{{ ansible_distribution_release }}" From 1a0b2614bcd807038004f481f3f22fc2b3a77fa4 Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 00:44:49 +0300 Subject: [PATCH 194/504] Create /etc/ansible if it doesn't exist --- roles/prepare4clients/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index c3a2513..f1fbc97 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -197,6 +197,7 @@ - name: add clients to inventory blockinfile: dest: /etc/ansible/hosts + create: yes block: | [kerberox-client] {{ in_inventory }} From bf265a8309b9f2e79b87b3fb9159b60d0026b757 Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 09:25:31 +0300 Subject: [PATCH 195/504] Tweaks --- installbox.yml | 5 +++-- roles/dns-dhcp-tftp/tasks/main.yml | 9 +++++++-- roles/dns-dhcp-tftp/templates/db.192.168.0.j2 | 11 ----------- roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 | 4 ++-- roles/dns-dhcp-tftp/templates/localzones.j2 | 2 +- 5 files changed, 13 insertions(+), 18 deletions(-) delete mode 100644 roles/dns-dhcp-tftp/templates/db.192.168.0.j2 diff --git a/installbox.yml b/installbox.yml index 6ab32c3..116b271 100644 --- a/installbox.yml +++ b/installbox.yml @@ -17,8 +17,9 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - ipaddr_lan_threeoct: "{{ ipaddr_lan.split('.')[0:3] | join('.')}}" - ipaddr_lan_ptr: "{{ ipaddr_lan | ansible.netcommon.ipaddr('revdns').split('.')[1:-1] | join('.') }}" + ipaddr_lan_threeoct: "{{ ipaddr_lan.split('.')[0:3] | join('.') }}" + ipaddr_lan_ptr: "{{ (ipaddr_lan | ipaddr('revdns')).split('.')[1:] | join('.') }}" + ipaddr_lan_ptr_threeoct: "{{ ipaddr_lan_ptr.split('.')[0:3] | join('.') }}" dhcp_range: 192.168.0.50,192.168.0.99,2h di_dist: "{{ ansible_distribution_release }}" diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dns-dhcp-tftp/tasks/main.yml index 26f11ec..98d4b00 100644 --- a/roles/dns-dhcp-tftp/tasks/main.yml +++ b/roles/dns-dhcp-tftp/tasks/main.yml @@ -42,10 +42,15 @@ dest: "/etc/bind/{{ item }}" loop: - db.intern - - db.lan - localzones notify: restart bind +- name: deploy config files for bind9 - special case where template destination filename is dynamic + template: + src: db.lan.j2 + dest: "/etc/bind/db.{{ ipaddr_lan_threeoct }}" + notify: restart bind + - name: link zone files to writeable directory for DDNS file: src: "/etc/bind/{{ item }}" @@ -53,7 +58,7 @@ state: link loop: - db.intern - - db.lan + - "db.{{ ipaddr_lan_threeoct }}" notify: restart bind - name: enable local bind config diff --git a/roles/dns-dhcp-tftp/templates/db.192.168.0.j2 b/roles/dns-dhcp-tftp/templates/db.192.168.0.j2 deleted file mode 100644 index 3f942c1..0000000 --- a/roles/dns-dhcp-tftp/templates/db.192.168.0.j2 +++ /dev/null @@ -1,11 +0,0 @@ -$TTL 500 -@ IN SOA {{ ansible_fqdn }}. root.{{ ansible_domain }}. ( - 1 ; Serial - 3600 ; Refresh - 1800 ; Retry - 720000 ; Expire - 6400 ) ; Negative Cache TTL -; -@ NS {{ ansible_fqdn }}. - MX 10 {{ ansible_fqdn }}. -{{ ipaddr_lan | ipaddr("address") | regex_replace("^.*\.(.+$)", "\\1") }} PTR {{ ansible_fqdn }}. diff --git a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 index aa724b9..cca662e 100644 --- a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 +++ b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 @@ -26,7 +26,7 @@ zone intern. { key rndc-key; } -zone "{{ ipaddr_lan_ptr }}" { +zone {{ ipaddr_lan_ptr }} { primary 127.0.0.1; key rndc-key; } @@ -50,7 +50,7 @@ if option arch = 00:07 { filename "d-i/n-a/pxelinux.0"; } -subnet {{ ipaddr_lan | ipaddr("address") }} netmask {{ ipaddr_lan | ipaddr("netmask") }} { +subnet {{ ipaddr_lan | ipaddr("network") }} netmask {{ ipaddr_lan | ipaddr("netmask") }} { option routers {{ ipaddr_lan | ipaddr("address") }}; range {{ dhcp_start }} {{ dhcp_stop }}; } diff --git a/roles/dns-dhcp-tftp/templates/localzones.j2 b/roles/dns-dhcp-tftp/templates/localzones.j2 index 180dbc0..7cd8cb9 100644 --- a/roles/dns-dhcp-tftp/templates/localzones.j2 +++ b/roles/dns-dhcp-tftp/templates/localzones.j2 @@ -1,6 +1,6 @@ include "/etc/bind/rndc.key"; -zone "{{ ipaddr_lan_ptr }}" { +zone "{{ ipaddr_lan_ptr[:-1] }}" { type master; notify no; file "/etc/bind/db.{{ ipaddr_lan_threeoct }}"; From ee15b0c27210c381ff7d0c17fa0f96c6a57fb43e Mon Sep 17 00:00:00 2001 From: Jukka Nousiainen Date: Sun, 25 Jul 2021 09:33:49 +0300 Subject: [PATCH 196/504] Change dns-dhcp-tftp variables to the right playbook --- installbox.yml | 3 --- sambox.yml | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/installbox.yml b/installbox.yml index 116b271..6e1c4c6 100644 --- a/installbox.yml +++ b/installbox.yml @@ -17,9 +17,6 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - ipaddr_lan_threeoct: "{{ ipaddr_lan.split('.')[0:3] | join('.') }}" - ipaddr_lan_ptr: "{{ (ipaddr_lan | ipaddr('revdns')).split('.')[1:] | join('.') }}" - ipaddr_lan_ptr_threeoct: "{{ ipaddr_lan_ptr.split('.')[0:3] | join('.') }}" dhcp_range: 192.168.0.50,192.168.0.99,2h di_dist: "{{ ansible_distribution_release }}" diff --git a/sambox.yml b/sambox.yml index 85560e1..a8efcc1 100644 --- a/sambox.yml +++ b/sambox.yml @@ -18,6 +18,9 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 + ipaddr_lan_threeoct: "{{ ipaddr_lan.split('.')[0:3] | join('.') }}" + ipaddr_lan_ptr: "{{ (ipaddr_lan | ipaddr('revdns')).split('.')[1:] | join('.') }}" + ipaddr_lan_ptr_threeoct: "{{ ipaddr_lan_ptr.split('.')[0:3] | join('.') }}" dhcp_start: 192.168.0.50 dhcp_stop: 192.168.0.150 in_inventory: 192.168.0.[50:150] From c7030c924566ed5ada6b983b3a5c0d7dca6c8b12 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 2 Apr 2022 18:19:45 +0200 Subject: [PATCH 197/504] Implement container 'restart' tag. --- edubox.yml | 1 + roles/educontainer/tasks/main.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/edubox.yml b/edubox.yml index cd004bb..8376eef 100644 --- a/edubox.yml +++ b/edubox.yml @@ -14,6 +14,7 @@ ## ## --tags=start start all containers ## --tags=stop stop all containers +## --tags=restart stop, then start all containers ## --tags=reset reset all containers to the initial image ## --tags=purge purge all containers ## --tags=setup purge all containers and setup again diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 5280173..76748af 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -20,6 +20,7 @@ - reset - purge - setup + - restart - name: purge all containers command: @@ -51,6 +52,7 @@ - never - start - reset + - restart ########### From 2cf34e8e558e31c92eec05c303e0ebbc8bfae45f Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 11 Jun 2022 12:42:02 +0200 Subject: [PATCH 198/504] Fix some ansible-lint complaints. --- README.kerberox | 4 +- cloudbox.yml | 14 ++--- edubox.yml | 8 +-- host_vars/blackbox.yml | 2 +- host_vars/bluebox.yml | 2 +- installbox.yml | 2 +- kerberox-client.yml | 8 +-- kerberox.yml | 10 ++-- kiosk.yml | 4 +- minimal-krb5.yml | 2 +- minimal.yml | 2 +- roles/apt-cacher/tasks/main.yml | 14 ++--- roles/backup/handlers/main.yml | 2 +- roles/backup/tasks/main.yml | 5 +- roles/ddns-update/handlers/main.yml | 4 +- roles/ddns-update/tasks/main.yml | 3 + roles/dns-dhcp-tftp/tasks/main.yml | 23 ++++---- roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 | 2 +- roles/dnsmasq/tasks/main.yml | 4 +- roles/educontainer/handlers/main.yml | 2 +- roles/educontainer/tasks/main.yml | 4 +- roles/educontainer/tasks/setup.yml | 45 +++++++++----- roles/gnome/tasks/main.yml | 18 ++++-- roles/kde/tasks/main.yml | 4 +- roles/kiosk/handlers/main.yml | 23 ++------ roles/kiosk/tasks/main.yml | 35 ++++++----- roles/krb5-kdc-ldap/meta/main.yml | 2 +- roles/krb5-kdc-ldap/tasks/main.yml | 24 +++++--- roles/lan-client/defaults/main.yml | 2 +- roles/lan-client/handlers/main.yml | 4 +- roles/lan-client/tasks/main.yml | 7 ++- roles/ldap/defaults/main.yml | 6 +- roles/ldap/handlers/main.cfg | 4 ++ roles/ldap/tasks/main.yml | 7 ++- roles/ldap/tasks/setup.yml | 26 ++++----- roles/ldap/templates/slapd-TLS.ldif | 4 +- roles/low-power/handlers/main.yml | 2 +- roles/low-power/tasks/main.yml | 4 +- roles/netboot-installer/tasks/main.yml | 8 ++- roles/nextcloud-upgrade/handlers/main.yml | 14 +++++ roles/nextcloud-upgrade/tasks/main.yml | 38 ++---------- roles/nextcloud/defaults/main.yml | 2 +- roles/nextcloud/handlers/main.yml | 2 +- roles/nextcloud/tasks/main.yml | 58 +++++++++++-------- roles/nfs-server/defaults/main.yml | 2 +- roles/nfs-server/tasks/main.yml | 14 +++-- roles/prepare4clients/handlers/main.yml | 4 +- roles/prepare4clients/tasks/main.yml | 30 ++++++---- roles/samba-ldap/handlers/main.yml | 1 - roles/samba-ldap/meta/main.yml | 2 +- roles/samba-ldap/tasks/main.yml | 20 +++---- roles/samba-ldap/templates/sssd.conf.j2 | 2 +- roles/smb-sshfs-client/handlers/main.yml | 3 +- roles/smb-sshfs-client/tasks/main.yml | 12 ++-- .../handlers/main.yml | 6 +- .../systemd-networkd-resolved/tasks/main.yml | 15 ++--- .../templates/20-static.network.j2 | 2 +- roles/transparent-squid/tasks/main.yml | 20 ++++--- roles/two-interface-firewalld/tasks/main.yml | 14 +++-- roles/two-interface-shorewall/tasks/main.yml | 15 ++--- roles/up2date-debian/tasks/main.yml | 14 ++--- roles/web-server/tasks/main.yml | 2 +- sambox-client.yml | 6 +- sambox.yml | 10 ++-- 64 files changed, 357 insertions(+), 297 deletions(-) create mode 100644 roles/ldap/handlers/main.cfg create mode 100644 roles/nextcloud-upgrade/handlers/main.yml diff --git a/README.kerberox b/README.kerberox index 9362321..1e969af 100644 --- a/README.kerberox +++ b/README.kerberox @@ -5,7 +5,7 @@ sudo cat /root/kadmin.pwd ## Then: - cd /home/ansible/debian-lan/ + cd /home/ansible/debian-lan/ ansible-playbook --ask-become-pass kerberox-client.yml -## Enter the 'BECOME' password and the kadmin password obtained above. +## Enter the 'BECOME' password and the kadmin password obtained above. diff --git a/cloudbox.yml b/cloudbox.yml index 81634fd..0a78efc 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -4,12 +4,12 @@ - name: apply configuration to the cloudbox hosts: cloudboxes remote_user: ansible - become: Yes + become: true vars: if_lan: "enp1s0" ipaddr: "192.168.2.50/24" gateway: "192.168.2.1" - DNS: "192.168.2.1" + dns: "192.168.2.1" ddns_domain: "something.ddnss.de" ddns_updkey: "138638.some.key.here.635620" ## 'nc_download' and 'nc_checksum' are only @@ -32,17 +32,16 @@ # - low-power - nextcloud - nextcloud-upgrade - - backup +# - backup - -## Hosts in the the 'only_nextcloud'-group are only upgraded: +## Hosts in the the 'only_nextcloud'-group are only upgraded: - name: upgrade nextcloud only hosts: only_nextcloud remote_user: ansible - become: Yes + become: true vars: - nc_dir: "/var/www/nextcloud" + nc_dir: "/var/www/nextcloud" nc_apps: - calendar - notes @@ -51,4 +50,3 @@ roles: - up2date-debian - nextcloud-upgrade - diff --git a/edubox.yml b/edubox.yml index 8376eef..06ca4fe 100644 --- a/edubox.yml +++ b/edubox.yml @@ -23,7 +23,7 @@ - name: apply configuration to the edubox hosts: all # eduboxes remote_user: ansible - become: yes + become: true vars: contname: cont ## User name for the user in the container: @@ -52,19 +52,19 @@ - name: install apt-cacher-ng apt: name: apt-cacher-ng - state: latest + state: latest # noqa package-latest - name: enable apt-cacher-ng lineinfile: path: /etc/apt/apt.conf.d/30proxy line: 'Acquire::http::Proxy "http://localhost:3142/";' - create: yes + create: true - name: enable and start systemd-networkd on the host systemd: name: systemd-networkd state: started - enabled: yes + enabled: true roles: - up2date-debian diff --git a/host_vars/blackbox.yml b/host_vars/blackbox.yml index 7e2e4aa..a1f3799 100644 --- a/host_vars/blackbox.yml +++ b/host_vars/blackbox.yml @@ -1,4 +1,4 @@ -allow_download: True +allow_download: true backup_dirs_extra: - /home backup_opts_extra: "" diff --git a/host_vars/bluebox.yml b/host_vars/bluebox.yml index 3fff54c..dacab7d 100644 --- a/host_vars/bluebox.yml +++ b/host_vars/bluebox.yml @@ -1 +1 @@ -allow_download: True +allow_download: true diff --git a/installbox.yml b/installbox.yml index 6e1c4c6..81ddb59 100644 --- a/installbox.yml +++ b/installbox.yml @@ -6,7 +6,7 @@ - name: apply configuration to the installbox hosts: all remote_user: ansible - become: yes + become: true vars: ## This interface provides the default route: diff --git a/kerberox-client.yml b/kerberox-client.yml index cd7b29f..695c3a1 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -4,7 +4,7 @@ - name: apply configuration to the machines hosts: all remote_user: ansible - become: yes + become: true vars: extra_pkgs: - webext-privacy-badger @@ -16,12 +16,12 @@ vars_prompt: - name: "kadmin_pwd" prompt: "Provide kadmin password to fetch kerberos keytab.\nLeave empty if done already" - private: yes + private: true roles: - up2date-debian - lan-client - kerberize ## Choose either gnome or KDE: - #- gnome - #- kde + # - gnome + # - kde diff --git a/kerberox.yml b/kerberox.yml index edb56d3..976db14 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -5,7 +5,7 @@ - name: apply configuration to the kerberox server hosts: all remote_user: ansible - become: yes + become: true vars: ## This interface provides the default route: @@ -34,7 +34,7 @@ In case you would like to prepare a test user 'foo' and have not done so yet, provide foo's password here. Leave empty to just continue - private: yes + private: true pre_tasks: @@ -50,7 +50,9 @@ - netboot-installer - dnsmasq - apt-cacher - - { role: krb5-kdc-ldap, when: not run_in_installer|default(false)|bool } - - { role: nfs-server, when: not run_in_installer|default(false)|bool } + - role: krb5-kdc-ldap + when: not run_in_installer|default(false)|bool + - role: nfs-server + when: not run_in_installer|default(false)|bool - prepare4clients - kerberize diff --git a/kiosk.yml b/kiosk.yml index b68bbb7..076e42d 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -4,7 +4,7 @@ - name: apply configuration to the machines hosts: all remote_user: ansible - become: yes + become: true vars: auto_user: debi wifi_ssid: "YOUR SSID HERE" @@ -18,5 +18,5 @@ - up2date-debian ## Choose either gnome or KDE: - gnome - #- kde + # - kde - kiosk diff --git a/minimal-krb5.yml b/minimal-krb5.yml index ebba3a2..a7644c8 100644 --- a/minimal-krb5.yml +++ b/minimal-krb5.yml @@ -4,7 +4,7 @@ - name: apply a minimal configuration with kerberos LAN integration hosts: all remote_user: ansible - become: yes + become: true roles: - up2date-debian - lan-client diff --git a/minimal.yml b/minimal.yml index c31c0c8..921b8db 100644 --- a/minimal.yml +++ b/minimal.yml @@ -4,6 +4,6 @@ - name: apply a minimal configuration to the machine hosts: all remote_user: ansible - become: yes + become: true roles: - up2date-debian diff --git a/roles/apt-cacher/tasks/main.yml b/roles/apt-cacher/tasks/main.yml index 7439eb4..01b745d 100644 --- a/roles/apt-cacher/tasks/main.yml +++ b/roles/apt-cacher/tasks/main.yml @@ -1,17 +1,17 @@ - name: install apt-cacher-ng package apt: name: apt-cacher-ng - state: latest + state: latest # noqa package-latest - name: enable apt-cacher-ng for localhost copy: src: apt.conf dest: /etc/apt/apt.conf - force: no + force: false + mode: 0644 notify: "start apt-cacher-ng" when: not run_in_installer|default(false)|bool ## do not enable apt-cacher during installation - - name: check if preseeded installer is available stat: path={{ tftp_root }}/d-i/{{ di_dist }}/preseed.cfg register: preseedcfg @@ -27,8 +27,8 @@ firewalld: zone: internal port: 3142/tcp - permanent: yes - immediate: yes + permanent: true + immediate: true state: enabled when: not run_in_installer|default(false)|bool @@ -36,5 +36,5 @@ command: "firewall-offline-cmd --zone=internal --add-port=3142/tcp" when: run_in_installer|default(false)|bool - -- meta: flush_handlers +- name: flush handler to make apt-cacher available + meta: flush_handlers diff --git a/roles/backup/handlers/main.yml b/roles/backup/handlers/main.yml index 43950ec..3a4f8f6 100644 --- a/roles/backup/handlers/main.yml +++ b/roles/backup/handlers/main.yml @@ -2,5 +2,5 @@ systemd: name: backup.timer state: started - enabled: True + enabled: true listen: "enable backup.timer" diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml index 5cbd241..f263d5c 100644 --- a/roles/backup/tasks/main.yml +++ b/roles/backup/tasks/main.yml @@ -1,7 +1,7 @@ - name: install borg apt: name: borgbackup - state: latest + state: latest # noqa package-latest - name: check if borg password is available stat: path="{{ borg_pwd_file }}" @@ -9,7 +9,7 @@ - name: dump borg password shell: echo -n "{{ borg_pwd }}" > "{{ borg_pwd_file }}" ; chmod 0600 "{{ borg_pwd_file }}" - no_log: True + no_log: true when: not borg.stat.exists - name: provide backup script @@ -22,6 +22,7 @@ copy: src: "{{ item }}" dest: "/etc/systemd/system/{{ item }}" + mode: 0644 with_items: - backup.service - backup.timer diff --git a/roles/ddns-update/handlers/main.yml b/roles/ddns-update/handlers/main.yml index a1700e2..1022036 100644 --- a/roles/ddns-update/handlers/main.yml +++ b/roles/ddns-update/handlers/main.yml @@ -2,6 +2,6 @@ systemd: name: ddns-update.timer state: restarted - daemon_reload: yes - enabled: yes + daemon_reload: true + enabled: true listen: "enable ddns-update timer" diff --git a/roles/ddns-update/tasks/main.yml b/roles/ddns-update/tasks/main.yml index 54e3412..a345036 100644 --- a/roles/ddns-update/tasks/main.yml +++ b/roles/ddns-update/tasks/main.yml @@ -5,6 +5,7 @@ template: src: ddns-update.conf.j2 dest: /etc/ddns-update/ddns-update.conf + mode: 0644 - name: install ddns-update script copy: @@ -16,9 +17,11 @@ copy: src: ddns-update.service dest: /etc/systemd/system/ddns-update.service + mode: 0644 - name: install ddns-update.timer copy: src: ddns-update.timer dest: /etc/systemd/system/ddns-update.timer + mode: 0644 notify: enable ddns-update timer diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dns-dhcp-tftp/tasks/main.yml index 98d4b00..623741f 100644 --- a/roles/dns-dhcp-tftp/tasks/main.yml +++ b/roles/dns-dhcp-tftp/tasks/main.yml @@ -12,7 +12,7 @@ - isc-dhcp-server - tftpd-hpa - bind9 - state: latest + state: latest # noqa package-latest ## FIXME: preseeding seems to be ignored - name: configure TFTP root directory @@ -22,7 +22,7 @@ replace: 'TFTP_DIRECTORY="/var/lib/tftpboot"' notify: restart tftpd-hpa -- name: serve dhcp on LAN interface +- name: serve dhcp on LAN interface replace: path: /etc/default/isc-dhcp-server regexp: '^INTERFACESv4=".*"$' @@ -33,13 +33,15 @@ template: src: dhcpd.conf.j2 dest: /etc/dhcp/dhcpd.conf - backup: yes + mode: 0644 + backup: true notify: restart isc-dhcp-server -- name: deploy config files for bind9 +- name: deploy config files for bind9 template: src: "{{ item }}.j2" dest: "/etc/bind/{{ item }}" + mode: 0644 loop: - db.intern - localzones @@ -49,6 +51,7 @@ template: src: db.lan.j2 dest: "/etc/bind/db.{{ ipaddr_lan_threeoct }}" + mode: 0644 notify: restart bind - name: link zone files to writeable directory for DDNS @@ -71,6 +74,7 @@ template: src: resolv.conf.j2 dest: /etc/resolv.conf + mode: 0644 notify: restart isc-dhcp-server ## stop dhclient from overwriting /etc/resolv.conf: @@ -80,7 +84,7 @@ block: | supersede domain-search "{{ ansible_domain }}"; supersede domain-name-servers 127.0.0.1; - insertbefore: "#send dhcp-client-identifier.*" + insertbefore: "#send dhcp-client-identifier.*" notify: restart dhcp-client - name: generate rndc key @@ -90,11 +94,10 @@ - name: copy rndc key copy: - src: /etc/bind/rndc.key + src: /etc/bind/rndc.key dest: /etc/dhcp/ - owner: root + owner: root group: root - mode: '0640' - remote_src: yes + mode: 0640 + remote_src: true notify: restart isc-dhcp-server - diff --git a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 index cca662e..9bb803c 100644 --- a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 +++ b/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 @@ -56,7 +56,7 @@ subnet {{ ipaddr_lan | ipaddr("network") }} netmask {{ ipaddr_lan | ipaddr("netm } -# No service will be given on this subnet, but declaring it helps the +# No service will be given on this subnet, but declaring it helps the # DHCP server to understand the network topology. #subnet 10.152.187.0 netmask 255.255.255.0 { diff --git a/roles/dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml index d5e7fc2..00f73a6 100644 --- a/roles/dnsmasq/tasks/main.yml +++ b/roles/dnsmasq/tasks/main.yml @@ -7,16 +7,18 @@ name: - dnsmasq - resolvconf - state: latest + state: latest # noqa package-latest - name: configure dnsmasq dhcp template: src: dnsmasq-dhcp.j2 dest: /etc/dnsmasq.d/dnsmasq-dhcp + mode: 0644 notify: "restart dnsmasq" - name: configure dnsmasq tftp template: src: dnsmasq-tftp-netboot-installer.j2 dest: /etc/dnsmasq.d/tftp-netboot-installer + mode: 0644 notify: "restart dnsmasq" diff --git a/roles/educontainer/handlers/main.yml b/roles/educontainer/handlers/main.yml index 44ccc8e..70b52ec 100644 --- a/roles/educontainer/handlers/main.yml +++ b/roles/educontainer/handlers/main.yml @@ -2,6 +2,6 @@ systemd: name: systemd-nspawn@{{ contname }}{{ "%02d" | format(item|int) }}.service state: restarted - enabled: yes + enabled: true loop: "{{ containers }}" listen: enable and restart containers diff --git a/roles/educontainer/tasks/main.yml b/roles/educontainer/tasks/main.yml index 76748af..d5dfc93 100644 --- a/roles/educontainer/tasks/main.yml +++ b/roles/educontainer/tasks/main.yml @@ -2,8 +2,8 @@ ## ## Port mapping to the host: ## -## container 0: ssh → host port 10000, HTTP → 10100 -## container 1: ssh → host port 10001, HTTP → 10101 +## container 0: ssh → host port 10000, HTTP → 10100 +## container 1: ssh → host port 10001, HTTP → 10101 ## ... ... ... ## ## User '{{ contuser }}' in the sudo group. Password is '{{ contpwd }}'. diff --git a/roles/educontainer/tasks/setup.yml b/roles/educontainer/tasks/setup.yml index 3aa3b32..4296a72 100644 --- a/roles/educontainer/tasks/setup.yml +++ b/roles/educontainer/tasks/setup.yml @@ -5,7 +5,7 @@ name: - systemd-container - debootstrap - state: latest + state: latest # noqa package-latest - name: prepare machine directory file: @@ -23,7 +23,7 @@ args: chdir: /var/lib/machines/ creates: /var/lib/machines/{{ contname }}00 - environment: + environment: http_proxy: "{{ '' if run_in_installer|default(false) else 'http://localhost:3142' }}" notify: enable and restart containers @@ -31,7 +31,8 @@ copy: src: /etc/apt/sources.list dest: /var/lib/machines/{{ contname }}00/etc/apt/sources.list - remote_src: yes + mode: 0644 + remote_src: true - name: configure locale lineinfile: @@ -57,7 +58,7 @@ - name: provide {{ contuser }} user account command: cmd: > - chroot . sh -c '/usr/sbin/useradd -m -s /bin/bash + chroot . sh -c '/usr/sbin/useradd -m -s /bin/bash -c "User {{ contuser }},,," -G sudo {{ contuser }}' args: chdir: /var/lib/machines/{{ contname }}00 @@ -89,6 +90,7 @@ file: path: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item }} state: directory + mode: 0755 loop: - multi-user.target.wants - sockets.target.wants @@ -100,13 +102,17 @@ src: /lib/systemd/system/{{ item.src }} dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} state: link - follow: False - force: yes + follow: false + force: true loop: - - { src: systemd-networkd.service, dest: dbus-org.freedesktop.network1.service } - - { src: systemd-networkd.service, dest: multi-user.target.wants/systemd-networkd.service } - - { src: systemd-networkd.socket, dest: sockets.target.wants/systemd-networkd.socket } - - { src: systemd-networkd-wait-online.service, dest: network-online.target.wants/systemd-networkd-wait-online.service } + - src: systemd-networkd.service + dest: dbus-org.freedesktop.network1.service + - src: systemd-networkd.service + dest: multi-user.target.wants/systemd-networkd.service + - src: systemd-networkd.socket + dest: sockets.target.wants/systemd-networkd.socket + - src: systemd-networkd-wait-online.service + dest: network-online.target.wants/systemd-networkd-wait-online.service notify: enable and restart containers - name: enable systemd-resolved in containers @@ -114,11 +120,13 @@ src: /lib/systemd/system/{{ item.src }} dest: /var/lib/machines/{{ contname }}00/etc/systemd/system/{{ item.dest }} state: link - follow: False - force: yes + follow: false + force: true loop: - - { src: systemd-resolved.service, dest: dbus-org.freedesktop.resolve1.service } - - { src: systemd-resolved.service, dest: multi-user.target.wants/systemd-resolved.service } + - src: systemd-resolved.service + dest: dbus-org.freedesktop.resolve1.service + - src: systemd-resolved.service + dest: multi-user.target.wants/systemd-resolved.service notify: enable and restart containers ######## @@ -126,7 +134,8 @@ copy: content: "# Avoid 'too many open files' error:" dest: /etc/sysctl.d/inotify.conf - force: no + mode: 0644 + force: false - name: fix too many open files error sysctl: @@ -146,11 +155,13 @@ file: path: /etc/systemd/nspawn state: directory + mode: 0755 - name: provide container configuration template: src: contcfg.nspawn.j2 - dest: /etc/systemd/nspawn/{{ contname}}{{ "%02d" | format(item|int) }}.nspawn + dest: /etc/systemd/nspawn/{{ contname }}{{ "%02d" | format(item|int) }}.nspawn + mode: 0644 loop: "{{ containers }}" notify: enable and restart containers @@ -158,6 +169,7 @@ template: src: hostname.j2 dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hostname + mode: 0644 loop: "{{ containers }}" notify: enable and restart containers @@ -165,5 +177,6 @@ template: src: hosts.j2 dest: /var/lib/machines/{{ contname }}{{ "%02d" | format(item|int) }}.hosts + mode: 0644 loop: "{{ containers }}" notify: enable and restart containers diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index 432229c..ab80bda 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -1,5 +1,5 @@ -#- name: gnome hibernate by default -# apt: name=gnome-shell-extension-suspend-button state=latest +# - name: gnome hibernate by default +# apt: name=gnome-shell-extension-suspend-button state=latest # noqa package-latest - name: gnome desktop apt: @@ -8,24 +8,32 @@ - cups - ssh-askpass-gnome - gnome-shell-extension-dashtodock - state: latest + state: latest # noqa package-latest - name: make sure /etc/dconf/profile/ exists - file: path=/etc/dconf/profile/ state=directory recurse=yes + file: + path: /etc/dconf/profile/ + state: directory + recurse: true - name: prepare for gnome customized defaults copy: src: user dest: /etc/dconf/profile/user + mode: 0644 notify: update dconf - name: make sure /etc/dconf/db/local.d/ exists - file: path=/etc/dconf/db/local.d/ state=directory recurse=yes + file: + path: /etc/dconf/db/local.d/ + state: directory + recurse: true - name: modify gnome defaults copy: src: defaults dest: /etc/dconf/db/local.d/defaults + mode: 0644 notify: update dconf ## Bug #698504 diff --git a/roles/kde/tasks/main.yml b/roles/kde/tasks/main.yml index 74f7e1f..5ce612c 100644 --- a/roles/kde/tasks/main.yml +++ b/roles/kde/tasks/main.yml @@ -4,9 +4,9 @@ - task-kde-desktop - sddm-theme-debian-breeze - cups - state: latest + state: latest # noqa package-latest + - ## Bug #698504 - name: allow print job management replace: diff --git a/roles/kiosk/handlers/main.yml b/roles/kiosk/handlers/main.yml index 7c9de36..cacbe56 100644 --- a/roles/kiosk/handlers/main.yml +++ b/roles/kiosk/handlers/main.yml @@ -5,26 +5,15 @@ - name: reload NetworkManager when: not run_in_installer|default(false)|bool systemd: - daemon_reload: yes + daemon_reload: true name: NetworkManager state: reloaded - enabled: yes + enabled: true listen: reload NetworkManager -# fails in installer with stretch, workaround below: -#- name: enable tmp.mount -# systemd: -# daemon_reload: yes -# name: tmp.mount -# enabled: yes - -- name: make sure local-fs.target.wants exists - file: path=/etc/systemd/system/local-fs.target.wants/ state=directory - listen: enable tmp.mount - - name: enable tmp.mount - file: - src: /etc/systemd/system/tmp.mount - dest: /etc/systemd/system/local-fs.target.wants/tmp.mount - state: link + systemd: + daemon_reload: true + name: tmp.mount + enabled: true listen: enable tmp.mount diff --git a/roles/kiosk/tasks/main.yml b/roles/kiosk/tasks/main.yml index 60ab55e..accf9b8 100644 --- a/roles/kiosk/tasks/main.yml +++ b/roles/kiosk/tasks/main.yml @@ -9,37 +9,40 @@ ## gdm3: - name: enable auto login in gdm3 - when: gdm3.stat.exists == true lineinfile: dest: /etc/gdm3/daemon.conf insertafter: '^#\s*AutomaticLoginEnable = true' line: 'AutomaticLoginEnable = true' + when: gdm3.stat.exists - name: auto login user in gdm3 - when: gdm3.stat.exists == true lineinfile: dest: /etc/gdm3/daemon.conf insertafter: '^#\s*AutomaticLogin = ' line: 'AutomaticLogin = {{ auto_user }}' + when: gdm3.stat.exists ## sddm/KDE: - name: enable auto login in sddm - when: sddm.stat.exists == true + when: sddm.stat.exists template: src: sddm.conf.j2 dest: /etc/sddm.conf + mode: 0644 - name: kde global defaults - when: sddm.stat.exists == true + when: sddm.stat.exists copy: src: kde5rc dest: /etc/kde5rc + mode: 0644 - name: modify kde screen lock - when: sddm.stat.exists == true + when: sddm.stat.exists copy: src: kscreenlockerrc dest: /etc/xdg/kscreenlockerrc + mode: 0644 ######## @@ -49,7 +52,7 @@ dest: /etc/default/grub regexp: '^(GRUB_CMDLINE_LINUX=)""' line: '\1"video=SVIDEO-1:d"' - backrefs: yes + backrefs: true notify: update grub - name: grub timeout @@ -57,7 +60,7 @@ dest: /etc/default/grub regexp: '^(GRUB_TIMEOUT=).*' line: '\g<1>1' - backrefs: yes + backrefs: true notify: update grub - name: keyboard compose key @@ -65,7 +68,7 @@ dest: /etc/default/keyboard regexp: '^(XKBOPTIONS=).*' line: '\1"compose:caps"' - backrefs: yes + backrefs: true - name: hibernate when lid is closed lineinfile: @@ -74,9 +77,11 @@ line: 'HandleLidSwitch=hibernate' - name: tmp on tmpfs - shell: cp /usr/share/systemd/tmp.mount /etc/systemd/system/ - args: - creates: /etc/systemd/system/tmp.mount + copy: + src: /usr/share/systemd/tmp.mount + dest: /etc/systemd/system/tmp.mount + mode: 0644 + remote_src: true notify: enable tmp.mount - name: mount tmpfs on /home/{{ auto_user }} @@ -92,19 +97,19 @@ name: "{{ auto_user }}" comment: "Autologin Debian User,,," shell: /bin/bash - createhome: no + createhome: false password: '*' - name: check if NetworkManager is installed stat: path=/etc/NetworkManager/system-connections - register: NetworkManager + register: networkmanager - name: add wifi config - when: NetworkManager.stat.exists == true template: src: wifi.j2 dest: /etc/NetworkManager/system-connections/{{ wifi_ssid }} owner: root group: root - mode: '0600' + mode: 0600 + when: networkmanager.stat.exists notify: reload NetworkManager diff --git a/roles/krb5-kdc-ldap/meta/main.yml b/roles/krb5-kdc-ldap/meta/main.yml index b19fb35..36ca9ba 100644 --- a/roles/krb5-kdc-ldap/meta/main.yml +++ b/roles/krb5-kdc-ldap/meta/main.yml @@ -1,3 +1,3 @@ --- -dependencies: +dependencies: # noqa meta-no-info - role: ldap diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml index 76646b9..50a3f39 100644 --- a/roles/krb5-kdc-ldap/tasks/main.yml +++ b/roles/krb5-kdc-ldap/tasks/main.yml @@ -1,7 +1,8 @@ ## Install and configure krb5-kdc-ldap (if not done yet), ## run most tasks only on krb5-kdc-ldap installation. --- -- fail: msg="The machine's domain must not be empty." +- name: check that domain name is available + fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 - name: check if krb5kdc is already there @@ -12,19 +13,26 @@ template: src: krb5.conf.j2 dest: /etc/krb5.conf + mode: 0644 - name: make sure krb5kdc exists - file: path=/etc/krb5kdc state=directory recurse=yes + file: + path: /etc/krb5kdc + state: directory + recurse: true + mode: 0755 - name: prepare kdc.conf template: src: kdc.conf.j2 dest: /etc/krb5kdc/kdc.conf + mode: 0644 - name: prepare kadm5.acl template: src: kadm5.acl.j2 dest: /etc/krb5kdc/kadm5.acl + mode: 0644 notify: "restart krb5-admin-server" - name: install krb5-kdc-ldap and krb5-admin-server @@ -32,7 +40,7 @@ name: - krb5-kdc-ldap - krb5-admin-server - state: latest + state: latest # noqa package-latest - name: prepare kerberos.openldap.ldif shell: gunzip -c /usr/share/doc/krb5-kdc-ldap/kerberos.openldap.ldif.gz > /etc/ldap/schema/kerberos.openldap.ldif @@ -126,12 +134,12 @@ - "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}" state: exact -- name: prepare password for kdc +- name: prepare password for kdc # noqa risky-shell-pipe shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps -c 256 | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists -- name: prepare password for kadmin +- name: prepare password for kadmin # noqa risky-shell-pipe shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | xxd -g0 -ps -c 256 | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists @@ -196,7 +204,7 @@ replace: path: /etc/hosts regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 kerberos' + replace: '\1 kerberos' when: not krb5kdc.stat.exists ######################## @@ -212,8 +220,8 @@ firewalld: zone: internal service: "{{ item }}" - permanent: yes - immediate: yes + permanent: true + immediate: true state: enabled with_items: - kerberos diff --git a/roles/lan-client/defaults/main.yml b/roles/lan-client/defaults/main.yml index 81690e1..29dadef 100644 --- a/roles/lan-client/defaults/main.yml +++ b/roles/lan-client/defaults/main.yml @@ -1,4 +1,4 @@ -lan_homes: /home/lan +lan_homes: /home/lan basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" ldap_server: ldap krb_server: kerberos diff --git a/roles/lan-client/handlers/main.yml b/roles/lan-client/handlers/main.yml index 66f15d5..ec063a1 100644 --- a/roles/lan-client/handlers/main.yml +++ b/roles/lan-client/handlers/main.yml @@ -4,12 +4,12 @@ - name: reload systemd systemd: - daemon_reload: yes + daemon_reload: true listen: "reload systemd" - name: restart rpc-gssd systemd: name: rpc-gssd - daemon_reload: yes + daemon_reload: true state: restarted notify: "restart rpc-gssd" diff --git a/roles/lan-client/tasks/main.yml b/roles/lan-client/tasks/main.yml index e394016..adaee16 100644 --- a/roles/lan-client/tasks/main.yml +++ b/roles/lan-client/tasks/main.yml @@ -1,5 +1,6 @@ --- -- fail: msg="The machine's domain must not be empty." +- name: check if domain name is available + fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 - name: preseed krb5-config realm @@ -31,7 +32,7 @@ - sssd-krb5 - sssd-ldap - nfs-common - state: latest + state: latest # noqa package-latest - name: add URI to ldap.conf lineinfile: @@ -48,7 +49,7 @@ - name: enable pam_umask lineinfile: dest: /etc/pam.d/common-session - line: "session optional pam_umask.so usergroups" + line: "session optional pam_umask.so usergroups" ## oddjob-mkhomedir works only with sec=sys for the NFSv4 share diff --git a/roles/ldap/defaults/main.yml b/roles/ldap/defaults/main.yml index e126f1e..32da1a2 100644 --- a/roles/ldap/defaults/main.yml +++ b/roles/ldap/defaults/main.yml @@ -1,9 +1,9 @@ ldap_admin_pwd: "{{ lookup('password', '/tmp/ldap_admin.pwd chars=ascii_letters,digits length=32') }}" ldap_admin_pwd_file: "/root/ldap-admin.pwd" basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" -TLSCertificateFile: "/etc/ssl/certs/ssl-cert-snakeoil.pem" -TLSCertificateKeyFile: "/etc/ssl/private/ssl-cert-snakeoil.key" -lan_homes: /home/lan +certpub: "/etc/ssl/certs/ssl-cert-snakeoil.pem" +certpriv: "/etc/ssl/private/ssl-cert-snakeoil.key" +lan_homes: /home/lan min_id: 10000 max_id: 20000 ldapuser_gid: 8000 diff --git a/roles/ldap/handlers/main.cfg b/roles/ldap/handlers/main.cfg new file mode 100644 index 0000000..93bbc44 --- /dev/null +++ b/roles/ldap/handlers/main.cfg @@ -0,0 +1,4 @@ +--- +- name: restart slapd + systemd: name=slapd state=restarted + listen: restart slapd diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 4d0c307..25bcf84 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -1,6 +1,7 @@ ## Install and configure slapd. --- -- fail: msg="The machine's domain must not be empty." +- name: check if domain name is available + fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 - name: check if slapd is already set up @@ -87,6 +88,6 @@ firewalld: zone: internal service: ldap - permanent: yes - immediate: yes + permanent: true + immediate: true state: enabled diff --git a/roles/ldap/tasks/setup.yml b/roles/ldap/tasks/setup.yml index d5ccfbe..9bbf5e9 100644 --- a/roles/ldap/tasks/setup.yml +++ b/roles/ldap/tasks/setup.yml @@ -3,7 +3,7 @@ - name: preseed ldap domain debconf: name: slapd - question: slapd/domain + question: slapd/domain value: "{{ ansible_domain }}" vtype: string @@ -24,7 +24,9 @@ no_log: true - name: dump admin password - shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}" + shell: + cmd: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}" + creates: "{{ ldap_admin_pwd_file }}" no_log: true - name: install packages for LDAP @@ -35,37 +37,35 @@ - ldapvi - python3-ldap - ssl-cert - state: latest + state: latest # noqa package-latest - name: add openldap to the ssl-cert group user: name: openldap groups: ssl-cert - append: yes - register: ssl_cert_group - -- name: restart slapd - systemd: name=slapd state=restarted - when: ssl_cert_group.changed + append: true + notify: restart slapd - name: make initial slapd configuration available copy: src: slapd-config.ldif dest: /etc/ldap/slapd.d/ + mode: 0644 - name: make slapd TLS configuration available template: src: slapd-TLS.ldif dest: /etc/ldap/slapd.d/ + mode: 0644 - name: activate ppolicy schema - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif # noqa no-changed-when - name: initialize slapd if it has just been installed - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif # noqa no-changed-when - name: configure LDAP TLS - command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif + command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif # noqa no-changed-when - name: add URI to ldap.conf lineinfile: @@ -83,7 +83,7 @@ replace: path: /etc/ldap/ldap.conf regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$" - replace: '#\1\nTLS_CACERT\t{{ TLSCertificateFile }}' + replace: '#\1\nTLS_CACERT\t{{ certpub }}' - name: enable pam-mkhomedir command: pam-auth-update --enable mkhomedir diff --git a/roles/ldap/templates/slapd-TLS.ldif b/roles/ldap/templates/slapd-TLS.ldif index e94216f..236841f 100644 --- a/roles/ldap/templates/slapd-TLS.ldif +++ b/roles/ldap/templates/slapd-TLS.ldif @@ -2,8 +2,8 @@ dn: cn=config changetype: modify add: olcTLSCertificateFile -olcTLSCertificateFile: {{ TLSCertificateFile }} +olcTLSCertificateFile: {{ certpub }} - add: olcTLSCertificateKeyFile -olcTLSCertificateKeyFile: {{ TLSCertificateKeyFile }} +olcTLSCertificateKeyFile: {{ certpriv }} - diff --git a/roles/low-power/handlers/main.yml b/roles/low-power/handlers/main.yml index 601c75f..c0c1c9a 100644 --- a/roles/low-power/handlers/main.yml +++ b/roles/low-power/handlers/main.yml @@ -1,5 +1,5 @@ - name: enable powertop timer systemd: name: powertop.timer - enabled: yes + enabled: true listen: "enable powertop timer" diff --git a/roles/low-power/tasks/main.yml b/roles/low-power/tasks/main.yml index 7a2edd8..a4fc825 100644 --- a/roles/low-power/tasks/main.yml +++ b/roles/low-power/tasks/main.yml @@ -1,5 +1,5 @@ - name: install some packages - apt: name={{ item }} state=latest + apt: name={{ item }} state=latest # noqa package-latest with_items: - powertop @@ -7,9 +7,11 @@ copy: src: powertop.service dest: /etc/systemd/system/powertop.service + mode: 0644 - name: install powertop.timer copy: src: powertop.timer dest: /etc/systemd/system/powertop.timer + mode: 0644 notify: enable powertop timer diff --git a/roles/netboot-installer/tasks/main.yml b/roles/netboot-installer/tasks/main.yml index e2e88bc..4902791 100644 --- a/roles/netboot-installer/tasks/main.yml +++ b/roles/netboot-installer/tasks/main.yml @@ -2,6 +2,7 @@ file: path: "{{ tftp_root }}/d-i/{{ di_dist }}" state: directory + mode: 0755 - name: install di-netboot-assistant and installer package apt: @@ -16,11 +17,12 @@ copy: src: /usr/share/doc/di-netboot-assistant/examples/preseed.cfg dest: "{{ tftp_root }}/d-i/{{ di_dist }}" - force: no - remote_src: yes + mode: 0644 + force: false + remote_src: true - name: make the hostname resolvable from the LAN replace: path: /etc/hosts regexp: '^(127\.0\.1\.1.*)$' - replace: '#\1\n{{ ipaddr_lan | ipaddr("address") }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}' + replace: '#\1\n{{ ipaddr_lan | ipaddr("address") }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}' diff --git a/roles/nextcloud-upgrade/handlers/main.yml b/roles/nextcloud-upgrade/handlers/main.yml new file mode 100644 index 0000000..dfe1270 --- /dev/null +++ b/roles/nextcloud-upgrade/handlers/main.yml @@ -0,0 +1,14 @@ +--- +## DB fixes (only on upgrade) +- name: add missing indices, columns and convert filecache + command: "{{ item }}" + args: + chdir: "{{ nc_dir }}" + warn: false + register: cmd_result + changed_when: cmd_result.stdout is search("updated successfully") + with_items: + - "sudo -u www-data php ./occ db:add-missing-indices" + - "sudo -u www-data php ./occ db:add-missing-columns" + - "sudo -u www-data php ./occ -n db:convert-filecache-bigint" + listen: update and fix data base diff --git a/roles/nextcloud-upgrade/tasks/main.yml b/roles/nextcloud-upgrade/tasks/main.yml index 497c9aa..7d6d0a5 100644 --- a/roles/nextcloud-upgrade/tasks/main.yml +++ b/roles/nextcloud-upgrade/tasks/main.yml @@ -1,18 +1,18 @@ --- - - name: check/run upgrade command: sudo -u www-data php updater.phar --no-interaction args: chdir: "{{ nc_dir }}/updater" - warn: False + warn: false register: upgrade_result changed_when: upgrade_result.stdout is not search('Nothing to do.') + notify: update and fix data base - name: update apps command: "sudo -u www-data php ./occ app:update --all" args: chdir: "{{ nc_dir }}" - warn: False + warn: false register: cmd_result changed_when: cmd_result.stdout | length > 0 @@ -20,36 +20,8 @@ command: "sudo -u www-data php ./occ app:install {{ item }}" args: chdir: "{{ nc_dir }}" - warn: False + warn: false with_items: "{{ nc_apps }}" register: cmd_result changed_when: cmd_result.stdout is not search('already installed') - failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 - -## DB fixes (only on upgrade) -- name: add missing indices - command: "sudo -u www-data php ./occ db:add-missing-indices" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is search('table updated successfully') - when: upgrade_result.changed | default(true) - -- name: add missing columns - command: "sudo -u www-data php ./occ db:add-missing-columns" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is search('table updated successfully') - when: upgrade_result.changed | default(true) - -- name: convert filecache to bigint - command: "sudo -u www-data php ./occ -n db:convert-filecache-bigint" - args: - chdir: "{{ nc_dir }}" - warn: False - register: cmd_result - changed_when: cmd_result.stdout is not search('tables already up to date') - when: upgrade_result.changed | default(true) + failed_when: cmd_result.stdout is not search('already installed') and cmd_result.rc != 0 diff --git a/roles/nextcloud/defaults/main.yml b/roles/nextcloud/defaults/main.yml index a4dfa67..be2e996 100644 --- a/roles/nextcloud/defaults/main.yml +++ b/roles/nextcloud/defaults/main.yml @@ -4,4 +4,4 @@ nc_admin_pwd_file: "/root/nc-admin.pwd" www_root: "/var/www" nc_dir: "{{ www_root }}/nextcloud" data_dir: "/var/nc-data" -allow_download: False +allow_download: false diff --git a/roles/nextcloud/handlers/main.yml b/roles/nextcloud/handlers/main.yml index f514172..2446778 100644 --- a/roles/nextcloud/handlers/main.yml +++ b/roles/nextcloud/handlers/main.yml @@ -14,5 +14,5 @@ systemd: name: nextcloudcron.timer state: started - enabled: True + enabled: true listen: "enable nextcloudcron.timer" diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 5506349..25c6163 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -5,8 +5,10 @@ register: nextcloud - name: check for nextcloud archive - local_action: stat path=nextcloud.tar.bz2 - become: No + stat: + path: nextcloud.tar.bz2 + become: false + delegate_to: localhost register: nc_archive when: not nextcloud.stat.exists @@ -45,7 +47,7 @@ - php-xml - php-zip - unzip - state: latest + state: latest # noqa package-latest - name: disable apache modules apache2_module: @@ -68,10 +70,10 @@ - http2 notify: "restart apache2" -- name: find php version +- name: find php version # noqa risky-shell-pipe shell: ls /etc/php/ | sort | tail -1 register: php_ver - changed_when: False + changed_when: false - name: enable php-fpm conf command: a2enconf php{{ php_ver.stdout }}-fpm @@ -85,10 +87,14 @@ regexp: "{{ item.regex }}" replace: "{{ item.replace }}" with_items: - - { regex: "^pm.max_children = .*$", replace: "pm.max_children = 10" } - - { regex: "^pm.start_servers = .*$", replace: "pm.start_servers = 4" } - - { regex: "^pm.min_spare_servers = .*$", replace: "pm.min_spare_servers = 2" } - - { regex: "^pm.max_spare_servers = .*$", replace: "pm.max_spare_servers = 6" } + - regex: "^pm.max_children = .*$" + replace: "pm.max_children = 10" + - regex: "^pm.start_servers = .*$" + replace: "pm.start_servers = 4" + - regex: "^pm.min_spare_servers = .*$" + replace: "pm.min_spare_servers = 2" + - regex: "^pm.max_spare_servers = .*$" + replace: "pm.max_spare_servers = 6" notify: "restart php-fpm" - name: increase php memory limit @@ -102,6 +108,7 @@ copy: src: nextcloud.conf dest: /etc/apache2/sites-available/nextcloud.conf + mode: 0644 notify: "restart apache2" - name: enable nextcloud site @@ -123,6 +130,7 @@ file: path: "{{ data_dir }}" state: directory + mode: 0770 owner: www-data group: www-data @@ -140,7 +148,7 @@ dest: "{{ www_root }}" owner: www-data group: www-data - remote_src: Yes + remote_src: true when: not nextcloud.stat.exists and run_in_installer|default(false)|bool - name: unpack provided nextcloud archive @@ -184,19 +192,19 @@ --data-dir "{{ data_dir }}" args: chdir: "{{ nc_dir }}" - no_log: True + no_log: true when: not nextcloud.stat.exists - name: dump nc-admin password shell: echo -n "{{ nc_admin_pwd }}" > "{{ nc_admin_pwd_file }}" ; chmod 0600 "{{ nc_admin_pwd_file }}" - no_log: True + no_log: true when: not nextcloud.stat.exists - name: enable APCu memcache command: sudo -u www-data php ./occ config:system:set memcache.local --value='\OC\Memcache\APCu' args: chdir: "{{ nc_dir }}" - warn: False + warn: false when: not nextcloud.stat.exists - name: enable acpu for nextcloud updates @@ -208,7 +216,7 @@ command: sudo -u www-data php ./occ config:system:set trusted_domains {{ item[0] }} --value='{{ item[1] }}' args: chdir: "{{ nc_dir }}" - warn: False + warn: false when: not nextcloud.stat.exists loop: - [1, '192.168.*.*'] @@ -220,6 +228,7 @@ copy: src: "{{ item }}" dest: "/etc/systemd/system/{{ item }}" + mode: 0644 with_items: - nextcloudcron.service - nextcloudcron.timer @@ -229,8 +238,8 @@ firewalld: interface: "{{ ansible_default_ipv4.interface }}" zone: public - permanent: Yes - immediate: Yes + permanent: true + immediate: true state: enabled when: not run_in_installer|default(false)|bool @@ -242,8 +251,8 @@ firewalld: zone: public service: https - permanent: Yes - immediate: Yes + permanent: true + immediate: true state: enabled when: not run_in_installer|default(false)|bool @@ -257,7 +266,7 @@ - name: install libapache2-mod-auth-gssapi apt: name: libapache2-mod-auth-gssapi - state: latest + state: latest # noqa package-latest when: "'kerberize' in role_names" notify: "restart apache2" @@ -267,8 +276,8 @@ dest: /etc/krb5.keytab.http group: www-data mode: "0640" - remote_src: yes - force: no + remote_src: true + force: false when: "'kerberize' in role_names" notify: "restart apache2" @@ -276,6 +285,7 @@ copy: src: krb5-nextcloud.conf dest: /etc/apache2/sites-available/krb5-nextcloud.conf + mode: 0644 when: "'kerberize' in role_names" notify: "restart apache2" @@ -290,8 +300,8 @@ firewalld: zone: internal service: https - permanent: Yes - immediate: Yes + permanent: true + immediate: true state: enabled when: not run_in_installer|default(false)|bool and 'kerberize' in role_names @@ -303,7 +313,7 @@ command: sudo -u www-data php ./occ config:system:set trusted_domains 2 --value='{{ ansible_hostname }}.{{ ansible_domain }}' args: chdir: "{{ nc_dir }}" - warn: False + warn: false when: not nextcloud.stat.exists and 'kerberize' in role_names diff --git a/roles/nfs-server/defaults/main.yml b/roles/nfs-server/defaults/main.yml index 456b8e5..4aea529 100644 --- a/roles/nfs-server/defaults/main.yml +++ b/roles/nfs-server/defaults/main.yml @@ -1,5 +1,5 @@ export_root: /srv/nfs4 -lan_homes: /home/lan +lan_homes: /home/lan basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" min_id: 10000 min_id_sssd: 5000 diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml index eaab5bb..65ad478 100644 --- a/roles/nfs-server/tasks/main.yml +++ b/roles/nfs-server/tasks/main.yml @@ -1,6 +1,7 @@ ## Install and configure nfs-server --- -- fail: msg="The machine's domain must not be empty." +- name: check if ansible domain is nonempty + fail: msg="The machine's domain must not be empty." when: ansible_domain | length == 0 - name: check if we are installing @@ -11,7 +12,7 @@ apt: name: - nfs-kernel-server - state: latest + state: latest # noqa package-latest # noqa package-latest - name: make sure the export paths exists file: path={{ export_root }}/home/ state=directory recurse=yes @@ -33,7 +34,7 @@ replace: path: /etc/hosts regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 nfs' + replace: '\1 nfs' when: not exports.stat.exists - name: check if there is a local kadmin @@ -55,7 +56,7 @@ - sssd-krb5 - sssd-ldap - sssd-tools ## sss_cache -U -G - state: latest + state: latest # noqa package-latest when: kadmin.stat.exists - name: provide identities from directory @@ -80,6 +81,7 @@ template: src: dhcp-send-domain.j2 dest: /etc/dnsmasq.d/dhcp-send-domain + mode: 0644 notify: "restart dnsmasq" when: dnsmasq.stat.exists @@ -87,6 +89,6 @@ firewalld: zone: internal service: nfs - permanent: yes - immediate: yes + permanent: true + immediate: true state: enabled diff --git a/roles/prepare4clients/handlers/main.yml b/roles/prepare4clients/handlers/main.yml index 3d30c45..dc6f9ad 100644 --- a/roles/prepare4clients/handlers/main.yml +++ b/roles/prepare4clients/handlers/main.yml @@ -1,7 +1,7 @@ - name: start git-repo systemd: - daemon_reload: yes + daemon_reload: true name: git-repo state: started - enabled: yes + enabled: true listen: start git-repo diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index f1fbc97..d5679e0 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -1,13 +1,13 @@ - name: make sure ansible is available apt: name: ansible - state: latest + state: latest # noqa package-latest - name: generate ssh key command: "su -l {{ ansible_user }} -c \"ssh-keygen -t rsa -f /home/{{ ansible_user }}/.ssh/id_rsa -P ''\"" args: creates: "/home/{{ ansible_user }}/.ssh/id_rsa" - warn: False + warn: false - name: slurp public key slurp: @@ -15,7 +15,8 @@ register: sshpubkey # The following seems to be necessary to get rid of a newline: -- set_fact: +- name: define variable + set_fact: sshpubkey: "{{ sshpubkey['content'] | b64decode | replace('\n', '') }}" - name: enable backports in preseed file @@ -87,12 +88,15 @@ block: | # Use a temporary package cache during installation, install etckeeper. menuentry 'Debian stable (amd64) + temporary package cache' { - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux mirror/http/proxy?=http://{{ ansible_hostname }}:3142/ pkgsel/include=etckeeper preseed/late_command="rm -fv /target/etc/apt/apt.conf" --- + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + mirror/http/proxy?=http://{{ ansible_hostname }}:3142/ pkgsel/include=etckeeper \ + preseed/late_command="rm -fv /target/etc/apt/apt.conf" --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } menuentry 'Debian {{ di_version }} (amd64) + preseed + kiosk.yml' { - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } @@ -128,7 +132,8 @@ insertbefore: EOF block: | menuentry 'Debian {{ di_version }} (amd64) + preseed + kerberox-client.yml' { - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kerberox-client.yml --- + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kerberox-client.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } marker: "# {mark} ANSIBLE MANAGED BLOCK kerberox-client" @@ -161,13 +166,16 @@ block: | menuentry 'Debian {{ di_version }} (amd64) + preseed + sambox-client.yml' { regexp --set=1:oct4 --set=2:oct5 --set=3:oct6 "\:([[:xdigit:]]+)\:([[:xdigit:]]+)\:([[:xdigit:]]+)\$" $net_default_mac - linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + auto=true priority=critical hostname=${oct4}${oct5}${oct6} url=tftp://{{ ansible_hostname }} \ + playbook=sambox-client.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } menuentry 'Debian daily (amd64) + preseed + sambox-client.yml' { regexp --set=1:oct4 --set=2:oct5 --set=3:oct6 "\:([[:xdigit:]]+)\:([[:xdigit:]]+)\:([[:xdigit:]]+)\$" $net_default_mac - linux /d-i/n-a/daily/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- + linux /d-i/n-a/daily/amd64/linux auto=true priority=critical hostname=${oct4}${oct5}${oct6} \ + url=tftp://{{ ansible_hostname }} playbook=sambox-client.yml --- initrd /d-i/n-a/daily/amd64/initrd.gz } marker: "# {mark} ANSIBLE MANAGED BLOCK sambox-client" @@ -181,7 +189,7 @@ git: repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' dest: "{{ repo_dir }}" - update: no + update: false become_user: "{{ ansible_user }}" when: not run_in_installer|default(false)|bool @@ -189,6 +197,7 @@ template: src: git-repo.j2 dest: "/etc/systemd/system/git-repo.service" + mode: 0644 notify: start git-repo when: not run_in_installer|default(false)|bool @@ -197,7 +206,8 @@ - name: add clients to inventory blockinfile: dest: /etc/ansible/hosts - create: yes + create: true + mode: 0644 block: | [kerberox-client] {{ in_inventory }} diff --git a/roles/samba-ldap/handlers/main.yml b/roles/samba-ldap/handlers/main.yml index 99844ab..aef70e4 100644 --- a/roles/samba-ldap/handlers/main.yml +++ b/roles/samba-ldap/handlers/main.yml @@ -5,4 +5,3 @@ - name: restart smbd service: name=smbd state=restarted enabled=yes listen: "restart smbd" - diff --git a/roles/samba-ldap/meta/main.yml b/roles/samba-ldap/meta/main.yml index b19fb35..36ca9ba 100644 --- a/roles/samba-ldap/meta/main.yml +++ b/roles/samba-ldap/meta/main.yml @@ -1,3 +1,3 @@ --- -dependencies: +dependencies: # noqa meta-no-info - role: ldap diff --git a/roles/samba-ldap/tasks/main.yml b/roles/samba-ldap/tasks/main.yml index cf0e871..e272ee2 100644 --- a/roles/samba-ldap/tasks/main.yml +++ b/roles/samba-ldap/tasks/main.yml @@ -9,8 +9,7 @@ name: - samba - sssd-ldap - state: latest - + state: latest # noqa package-latest - name: provide identities from LDAP template: @@ -19,8 +18,8 @@ mode: 0600 notify: restart sssd -- meta: flush_handlers - +- name: flush all handlers + meta: flush_handlers - name: prepare samba schema command: cp /usr/share/doc/samba/examples/LDAP/samba.ldif /etc/ldap/schema/ @@ -87,8 +86,8 @@ - name: slurp admin password for samba setup slurp: src: "{{ ldap_admin_pwd_file }}" - register: ldap_admin_pwd - no_log: true + register: ldap_admin_pwd + no_log: true when: not samba_ldap.stat.exists - name: make samba admin password available to smbd @@ -97,9 +96,10 @@ notify: restart smbd when: not samba_ldap.stat.exists -- meta: flush_handlers +- name: flush all handlers + meta: flush_handlers -- name: add samba attributes to dummy user foo +- name: add samba attributes to dummy user foo command: cmd: smbpasswd -s -a foo stdin: "{{ foo_pwd }}\n{{ foo_pwd }}" @@ -111,8 +111,8 @@ firewalld: zone: internal service: "{{ item }}" - permanent: yes - immediate: yes + permanent: true + immediate: true state: enabled with_items: - samba diff --git a/roles/samba-ldap/templates/sssd.conf.j2 b/roles/samba-ldap/templates/sssd.conf.j2 index c5c4187..6e6ac14 100644 --- a/roles/samba-ldap/templates/sssd.conf.j2 +++ b/roles/samba-ldap/templates/sssd.conf.j2 @@ -19,5 +19,5 @@ cache_credentials = true min_id = {{ min_id_sssd }} max_id = {{ max_id_sssd }} -## remove this after providing propper certificates: +## remove this after providing propper certificates: ldap_tls_reqcert = allow diff --git a/roles/smb-sshfs-client/handlers/main.yml b/roles/smb-sshfs-client/handlers/main.yml index 3c18dd6..d54b258 100644 --- a/roles/smb-sshfs-client/handlers/main.yml +++ b/roles/smb-sshfs-client/handlers/main.yml @@ -4,6 +4,5 @@ - name: reload systemd systemd: - daemon_reload: yes + daemon_reload: true listen: "reload systemd" - diff --git a/roles/smb-sshfs-client/tasks/main.yml b/roles/smb-sshfs-client/tasks/main.yml index 0aaedde..4dcf1e1 100644 --- a/roles/smb-sshfs-client/tasks/main.yml +++ b/roles/smb-sshfs-client/tasks/main.yml @@ -3,10 +3,10 @@ apt: name: - sssd-ldap - - libpam-mount + - libpam-mount - cifs-utils - - sshfs - state: latest + - sshfs + state: latest # noqa package-latest - name: add URI to ldap.conf lineinfile: @@ -23,7 +23,7 @@ - name: enable pam_umask lineinfile: dest: /etc/pam.d/common-session - line: "session optional pam_umask.so usergroups" + line: "session optional pam_umask.so usergroups" - name: provide identities from directory template: @@ -65,4 +65,6 @@ ## gnome-keyring fails with sshfs: - name: disable gnome-keyring-daemon - command: dpkg-divert --divert /usr/bin/gnome-keyring-daemon.distrib --rename /usr/bin/gnome-keyring-daemon + command: + cmd: dpkg-divert --divert /usr/bin/gnome-keyring-daemon.distrib --rename /usr/bin/gnome-keyring-daemon + creates: /usr/bin/gnome-keyring-daemon.distrib diff --git a/roles/systemd-networkd-resolved/handlers/main.yml b/roles/systemd-networkd-resolved/handlers/main.yml index 6084965..457c60b 100644 --- a/roles/systemd-networkd-resolved/handlers/main.yml +++ b/roles/systemd-networkd-resolved/handlers/main.yml @@ -1,14 +1,14 @@ - name: restart and enable systemd-networkd systemd: name: systemd-networkd - enabled: yes + enabled: true state: restarted - daemon_reload: yes + daemon_reload: true listen: "start and enable systemd-networkd" - name: start and enable systemd-resolved systemd: name: systemd-resolved - enabled: yes + enabled: true state: started listen: "start and enable systemd-resolved" diff --git a/roles/systemd-networkd-resolved/tasks/main.yml b/roles/systemd-networkd-resolved/tasks/main.yml index 3033c67..2918d11 100644 --- a/roles/systemd-networkd-resolved/tasks/main.yml +++ b/roles/systemd-networkd-resolved/tasks/main.yml @@ -7,19 +7,20 @@ copy: src: all-eth.network dest: /etc/systemd/network/all-eth.network + mode: 0644 notify: "start and enable systemd-networkd" -#- name: install static configuration for networkd -# template: -# src: 20-static.network.j2 -# dest: /etc/systemd/network/20-static.network -# notify: "enable systemd-networkd" +# - name: install static configuration for networkd +# template: +# src: 20-static.network.j2 +# dest: /etc/systemd/network/20-static.network +# notify: "enable systemd-networkd" - name: enable local stub resolver file: src: /run/systemd/resolve/stub-resolv.conf dest: /etc/resolv.conf state: link - follow: False - force: yes + follow: false + force: true notify: "start and enable systemd-resolved" diff --git a/roles/systemd-networkd-resolved/templates/20-static.network.j2 b/roles/systemd-networkd-resolved/templates/20-static.network.j2 index 04195a9..fbdc83b 100644 --- a/roles/systemd-networkd-resolved/templates/20-static.network.j2 +++ b/roles/systemd-networkd-resolved/templates/20-static.network.j2 @@ -4,4 +4,4 @@ Name={{ if_lan }} [Network] Address={{ ipaddr }} Gateway={{ gateway }} -DNS={{ DNS }} +DNS={{ dns }} diff --git a/roles/transparent-squid/tasks/main.yml b/roles/transparent-squid/tasks/main.yml index d5df254..63f1199 100644 --- a/roles/transparent-squid/tasks/main.yml +++ b/roles/transparent-squid/tasks/main.yml @@ -1,7 +1,7 @@ - name: install squid package apt: name: squid - state: latest + state: latest # noqa package-latest - name: configure squid extra lines lineinfile: @@ -9,11 +9,16 @@ line: "{{ item.line }}" insertafter: "{{ item.insertafter }}" with_items: - - { line: "http_access allow localnet", insertafter: "#http_access allow localnet" } - - { line: "http_port 3129 intercept", insertafter: "http_port 3128" } - - { line: "maximum_object_size_in_memory 10240 KB", insertafter: "# maximum_object_size_in_memory" } - - { line: "maximum_object_size 512 MB", insertafter: "# maximum_object_size" } - - { line: "cache_dir aufs /var/spool/squid 20000 16 256", insertafter: "#cache_dir ufs /var/spool/squid" } + - line: "http_access allow localnet" + insertafter: "#http_access allow localnet" + - line: "http_port 3129 intercept" + insertafter: "http_port 3128" + - line: "maximum_object_size_in_memory 10240 KB" + insertafter: "# maximum_object_size_in_memory" + - line: "maximum_object_size 512 MB" + insertafter: "# maximum_object_size" + - line: "cache_dir aufs /var/spool/squid 20000 16 256" + insertafter: "#cache_dir ufs /var/spool/squid" notify: "restart squid" - name: configure squid store IDs @@ -29,6 +34,7 @@ copy: src: store_id_regex.conf dest: /etc/squid/store_id_regex.conf + mode: 0644 notify: "restart squid" - name: configure squid as package cache @@ -53,5 +59,5 @@ - name: redirect www traffic in shorewall lineinfile: dest: /etc/shorewall/rules - line: "REDIRECT loc 3129 tcp www" + line: "REDIRECT loc 3129 tcp www" notify: "restart shorewall" diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/two-interface-firewalld/tasks/main.yml index a5e9850..c21b90c 100644 --- a/roles/two-interface-firewalld/tasks/main.yml +++ b/roles/two-interface-firewalld/tasks/main.yml @@ -2,13 +2,15 @@ template: src: interfaces-static.j2 dest: /etc/network/interfaces.d/static + mode: 0644 notify: "bring up LAN interface" - name: install firewalld package - apt: name=firewalld state=latest + apt: name=firewalld state=latest # noqa package-latest notify: "start firewalld" -- meta: flush_handlers +- name: flush all handlers + meta: flush_handlers ## Do not run the following in the installer: @@ -17,7 +19,7 @@ firewalld: zone: public interface: "{{ if_wan }}" - permanent: yes + permanent: true state: enabled immediate: true when: not run_in_installer|default(false)|bool @@ -26,7 +28,7 @@ firewalld: zone: public masquerade: 'yes' - permanent: yes + permanent: true state: enabled immediate: true when: not run_in_installer|default(false)|bool @@ -35,7 +37,7 @@ firewalld: zone: internal interface: "{{ if_lan }}" - permanent: yes + permanent: true state: enabled immediate: true when: not run_in_installer|default(false)|bool @@ -44,7 +46,7 @@ firewalld: zone: internal service: "{{ item }}" - permanent: yes + permanent: true state: enabled immediate: true with_items: diff --git a/roles/two-interface-shorewall/tasks/main.yml b/roles/two-interface-shorewall/tasks/main.yml index e92f99c..0974a2e 100644 --- a/roles/two-interface-shorewall/tasks/main.yml +++ b/roles/two-interface-shorewall/tasks/main.yml @@ -2,10 +2,11 @@ template: src: interfaces-static.j2 dest: /etc/network/interfaces.d/static + mode: 0644 notify: restart networking - name: install shorewall packages - apt: name=shorewall state=latest + apt: name=shorewall state=latest # noqa package-latest - name: copy shorewall configuration command: cp {{ item }} /etc/shorewall/ @@ -24,7 +25,7 @@ - name: find files in /etc/shorewall/ find: paths: /etc/shorewall/ - use_regex: yes + use_regex: true pattern: '.+[^~]$' contains: '.*(eth0|eth1).*' register: find_result @@ -35,7 +36,7 @@ dest: "{{ item.path }}" regexp: 'eth0' replace: "{{ if_wan }}" - backup: yes + backup: true with_items: "{{ find_result.files }}" notify: restart shorewall @@ -44,7 +45,7 @@ dest: "{{ item.path }}" regexp: 'eth1' replace: "{{ if_lan }}" - backup: yes + backup: true with_items: "{{ find_result.files }}" notify: restart shorewall @@ -53,7 +54,7 @@ dest: /etc/shorewall/shorewall.conf regexp: 'IP_FORWARDING=Keep' replace: 'IP_FORWARDING=Yes' - backup: yes + backup: true notify: restart shorewall - name: configure shorewall policy @@ -61,7 +62,7 @@ dest: /etc/shorewall/policy regexp: 'loc(\s+)net(\s+)ACCEPT' replace: 'loc\1all\2ACCEPT\n$FW\1all\2ACCEPT' - backup: yes + backup: true notify: restart shorewall - name: configure shorewall rules @@ -69,5 +70,5 @@ dest: /etc/shorewall/rules regexp: '(SSH\(ACCEPT\)\s+)loc(\s+\$FW)' replace: '\1all\2' - backup: yes + backup: true notify: restart shorewall diff --git a/roles/up2date-debian/tasks/main.yml b/roles/up2date-debian/tasks/main.yml index cd11949..d28bc9e 100644 --- a/roles/up2date-debian/tasks/main.yml +++ b/roles/up2date-debian/tasks/main.yml @@ -2,36 +2,36 @@ - name: update apt package lists apt: - update_cache: yes + update_cache: true cache_valid_time: 86400 - name: upgrade packages apt: upgrade: dist - autoremove: yes - autoclean: yes + autoremove: true + autoclean: true - name: install etckeeper apt: name: etckeeper - state: latest + state: latest # noqa package-latest - name: install extra packages from stable apt: name: "{{ extra_pkgs }}" - state: latest + state: latest # noqa package-latest when: extra_pkgs|length - name: add {{ ansible_distribution_release }}-backports apt_repository: repo: deb http://deb.debian.org/debian/ {{ ansible_distribution_release }}-backports main state: present - update_cache: yes + update_cache: true when: extra_pkgs_bpo|length - name: install extra packages from backports apt: name: "{{ extra_pkgs_bpo }}" - state: latest + state: latest # noqa package-latest default_release: "{{ ansible_distribution_release }}-backports" when: extra_pkgs_bpo|length diff --git a/roles/web-server/tasks/main.yml b/roles/web-server/tasks/main.yml index c0d073c..f6b46a8 100644 --- a/roles/web-server/tasks/main.yml +++ b/roles/web-server/tasks/main.yml @@ -1,5 +1,5 @@ - name: install some packages - apt: name={{ item }} state=latest + apt: name={{ item }} state=latest # noqa package-latest with_items: - unattended-upgrades - screen diff --git a/sambox-client.yml b/sambox-client.yml index 8b63293..305f81c 100644 --- a/sambox-client.yml +++ b/sambox-client.yml @@ -4,7 +4,7 @@ - name: apply configuration to the machines hosts: all remote_user: ansible - become: yes + become: true vars: extra_pkgs: - webext-privacy-badger @@ -16,5 +16,5 @@ - up2date-debian - smb-sshfs-client ## Choose either gnome or KDE: - #- gnome - #- kde + # - gnome + # - kde diff --git a/sambox.yml b/sambox.yml index a8efcc1..465a5d8 100644 --- a/sambox.yml +++ b/sambox.yml @@ -1,13 +1,13 @@ --- ## This playbook deploys the sambox server. Add 'hostname=XXX' and 'domain=YYY' ## to the installer boot parameters to set hostname and domain. -## +## - name: apply configuration to the sambox server hosts: all remote_user: ansible - become: yes + become: true vars: ## This interface provides the default route: @@ -22,11 +22,11 @@ ipaddr_lan_ptr: "{{ (ipaddr_lan | ipaddr('revdns')).split('.')[1:] | join('.') }}" ipaddr_lan_ptr_threeoct: "{{ ipaddr_lan_ptr.split('.')[0:3] | join('.') }}" dhcp_start: 192.168.0.50 - dhcp_stop: 192.168.0.150 + dhcp_stop: 192.168.0.150 in_inventory: 192.168.0.[50:150] di_dist: "{{ ansible_distribution_release }}" - di_version: 10 #"{{ ansible_distribution_major_version }}" + di_version: 10 # "{{ ansible_distribution_major_version }}" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" ansible_user: ansible @@ -40,7 +40,7 @@ In case you would like to prepare a test user 'foo' and have not done so yet, provide foo's password here. Leave empty to just continue - private: yes + private: true pre_tasks: From 4d791a65f119e4a3ac1001a15bcab9d43898f337 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jun 2022 13:51:56 +0200 Subject: [PATCH 199/504] Fix installbox. --- installbox.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/installbox.yml b/installbox.yml index 81ddb59..a87f8b7 100644 --- a/installbox.yml +++ b/installbox.yml @@ -17,7 +17,9 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - dhcp_range: 192.168.0.50,192.168.0.99,2h + dhcp_start: 192.168.0.50 + dhcp_stop: 192.168.0.150 + in_inventory: 192.168.0.[50:150] di_dist: "{{ ansible_distribution_release }}" di_version: "{{ ansible_distribution_major_version }}" From 1db0b6ec318b2d66f6bbb198069ea99b183bad67 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jun 2022 14:27:44 +0200 Subject: [PATCH 200/504] Rename some roles to make ansible-lint happy. --- cloudbox.yml | 12 ++++++------ edubox.yml | 4 ++-- installbox.yml | 8 ++++---- kerberox-client.yml | 4 ++-- kerberox.yml | 12 ++++++------ kiosk.yml | 2 +- roles/{apt-cacher => aptcacher}/files/apt.conf | 0 roles/{apt-cacher => aptcacher}/handlers/main.yml | 0 roles/{apt-cacher => aptcacher}/tasks/main.yml | 0 roles/{ddns-update => ddnsupdate}/files/ddns-update | 0 .../files/ddns-update.service | 0 .../files/ddns-update.timer | 0 roles/{ddns-update => ddnsupdate}/handlers/main.yml | 0 roles/{ddns-update => ddnsupdate}/tasks/main.yml | 0 .../templates/ddns-update.conf.j2 | 0 .../{dns-dhcp-tftp => dnsdhcptftp}/defaults/main.yml | 0 .../{dns-dhcp-tftp => dnsdhcptftp}/handlers/main.yml | 0 roles/{dns-dhcp-tftp => dnsdhcptftp}/tasks/main.yml | 0 .../templates/db.intern.j2 | 0 .../templates/db.lan.j2 | 0 .../templates/dhcpd.conf.j2 | 0 .../templates/localzones.j2 | 0 .../templates/resolv.conf.j2 | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 .../templates/interfaces-static.j2 | 0 .../{krb5-kdc-ldap => krb5kdcldap}/defaults/main.yml | 0 .../{krb5-kdc-ldap => krb5kdcldap}/handlers/main.yml | 0 roles/{krb5-kdc-ldap => krb5kdcldap}/meta/main.yml | 0 roles/{krb5-kdc-ldap => krb5kdcldap}/tasks/main.yml | 0 .../templates/kadm5.acl.j2 | 0 .../templates/kdc.conf.j2 | 0 .../templates/krb5.conf.j2 | 0 roles/{lan-client => lanclient}/defaults/main.yml | 0 roles/{lan-client => lanclient}/handlers/main.yml | 0 roles/{lan-client => lanclient}/tasks/main.yml | 0 .../{lan-client => lanclient}/templates/sssd.conf.j2 | 0 roles/{low-power => lowpower}/files/powertop.service | 0 roles/{low-power => lowpower}/files/powertop.timer | 0 roles/{low-power => lowpower}/handlers/main.yml | 0 roles/{low-power => lowpower}/tasks/main.yml | 0 .../defaults/main.yml | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 .../files/all-eth.network | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 .../templates/20-static.network.j2 | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 roles/{nfs-server => nfsserver}/defaults/main.yml | 0 roles/{nfs-server => nfsserver}/handlers/main.yml | 0 roles/{nfs-server => nfsserver}/tasks/main.yml | 0 .../templates/dhcp-send-domain.j2 | 0 .../{nfs-server => nfsserver}/templates/sssd.conf.j2 | 0 roles/{samba-ldap => sambaldap}/defaults/main.yml | 0 roles/{samba-ldap => sambaldap}/handlers/main.yml | 0 roles/{samba-ldap => sambaldap}/meta/main.yml | 0 roles/{samba-ldap => sambaldap}/tasks/main.yml | 0 .../{samba-ldap => sambaldap}/templates/sssd.conf.j2 | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 .../templates/interfaces-static.j2 | 0 .../defaults/main.yml | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 .../templates/sssd.conf.j2 | 0 .../files/store_id_regex.conf | 0 .../handlers/main.yml | 0 .../tasks/main.yml | 0 .../defaults/main.yml | 0 .../tasks/main.yml | 0 roles/{web-server => webserver}/tasks/main.yml | 0 sambox-client.yml | 4 ++-- sambox.yml | 12 ++++++------ 75 files changed, 29 insertions(+), 29 deletions(-) rename roles/{apt-cacher => aptcacher}/files/apt.conf (100%) rename roles/{apt-cacher => aptcacher}/handlers/main.yml (100%) rename roles/{apt-cacher => aptcacher}/tasks/main.yml (100%) rename roles/{ddns-update => ddnsupdate}/files/ddns-update (100%) rename roles/{ddns-update => ddnsupdate}/files/ddns-update.service (100%) rename roles/{ddns-update => ddnsupdate}/files/ddns-update.timer (100%) rename roles/{ddns-update => ddnsupdate}/handlers/main.yml (100%) rename roles/{ddns-update => ddnsupdate}/tasks/main.yml (100%) rename roles/{ddns-update => ddnsupdate}/templates/ddns-update.conf.j2 (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/defaults/main.yml (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/handlers/main.yml (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/tasks/main.yml (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/templates/db.intern.j2 (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/templates/db.lan.j2 (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/templates/dhcpd.conf.j2 (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/templates/localzones.j2 (100%) rename roles/{dns-dhcp-tftp => dnsdhcptftp}/templates/resolv.conf.j2 (100%) rename roles/{two-interface-firewalld => firewalld2if}/handlers/main.yml (100%) rename roles/{two-interface-firewalld => firewalld2if}/tasks/main.yml (100%) rename roles/{two-interface-firewalld => firewalld2if}/templates/interfaces-static.j2 (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/defaults/main.yml (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/handlers/main.yml (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/meta/main.yml (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/tasks/main.yml (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/templates/kadm5.acl.j2 (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/templates/kdc.conf.j2 (100%) rename roles/{krb5-kdc-ldap => krb5kdcldap}/templates/krb5.conf.j2 (100%) rename roles/{lan-client => lanclient}/defaults/main.yml (100%) rename roles/{lan-client => lanclient}/handlers/main.yml (100%) rename roles/{lan-client => lanclient}/tasks/main.yml (100%) rename roles/{lan-client => lanclient}/templates/sssd.conf.j2 (100%) rename roles/{low-power => lowpower}/files/powertop.service (100%) rename roles/{low-power => lowpower}/files/powertop.timer (100%) rename roles/{low-power => lowpower}/handlers/main.yml (100%) rename roles/{low-power => lowpower}/tasks/main.yml (100%) rename roles/{netboot-installer => netbootinstaller}/defaults/main.yml (100%) rename roles/{netboot-installer => netbootinstaller}/handlers/main.yml (100%) rename roles/{netboot-installer => netbootinstaller}/tasks/main.yml (100%) rename roles/{systemd-networkd-resolved => networkdresolved}/files/all-eth.network (100%) rename roles/{systemd-networkd-resolved => networkdresolved}/handlers/main.yml (100%) rename roles/{systemd-networkd-resolved => networkdresolved}/tasks/main.yml (100%) rename roles/{systemd-networkd-resolved => networkdresolved}/templates/20-static.network.j2 (100%) rename roles/{nextcloud-upgrade => nextcloudupgrade}/handlers/main.yml (100%) rename roles/{nextcloud-upgrade => nextcloudupgrade}/tasks/main.yml (100%) rename roles/{nfs-server => nfsserver}/defaults/main.yml (100%) rename roles/{nfs-server => nfsserver}/handlers/main.yml (100%) rename roles/{nfs-server => nfsserver}/tasks/main.yml (100%) rename roles/{nfs-server => nfsserver}/templates/dhcp-send-domain.j2 (100%) rename roles/{nfs-server => nfsserver}/templates/sssd.conf.j2 (100%) rename roles/{samba-ldap => sambaldap}/defaults/main.yml (100%) rename roles/{samba-ldap => sambaldap}/handlers/main.yml (100%) rename roles/{samba-ldap => sambaldap}/meta/main.yml (100%) rename roles/{samba-ldap => sambaldap}/tasks/main.yml (100%) rename roles/{samba-ldap => sambaldap}/templates/sssd.conf.j2 (100%) rename roles/{two-interface-shorewall => shorewall2if}/handlers/main.yml (100%) rename roles/{two-interface-shorewall => shorewall2if}/tasks/main.yml (100%) rename roles/{two-interface-shorewall => shorewall2if}/templates/interfaces-static.j2 (100%) rename roles/{smb-sshfs-client => smbsshfsclient}/defaults/main.yml (100%) rename roles/{smb-sshfs-client => smbsshfsclient}/handlers/main.yml (100%) rename roles/{smb-sshfs-client => smbsshfsclient}/tasks/main.yml (100%) rename roles/{smb-sshfs-client => smbsshfsclient}/templates/sssd.conf.j2 (100%) rename roles/{transparent-squid => transparentsquid}/files/store_id_regex.conf (100%) rename roles/{transparent-squid => transparentsquid}/handlers/main.yml (100%) rename roles/{transparent-squid => transparentsquid}/tasks/main.yml (100%) rename roles/{up2date-debian => up2date_debian}/defaults/main.yml (100%) rename roles/{up2date-debian => up2date_debian}/tasks/main.yml (100%) rename roles/{web-server => webserver}/tasks/main.yml (100%) diff --git a/cloudbox.yml b/cloudbox.yml index 0a78efc..de52ea5 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -27,11 +27,11 @@ ansible_python_interpreter: "/usr/bin/python3" roles: - - up2date-debian -# - ddns-update -# - low-power + - up2date_debian +# - ddnsupdate +# - lowpower - nextcloud - - nextcloud-upgrade + - nextcloudupgrade # - backup ## Hosts in the the 'only_nextcloud'-group are only upgraded: @@ -48,5 +48,5 @@ ansible_python_interpreter: "/usr/bin/python3" roles: - - up2date-debian - - nextcloud-upgrade + - up2date_debian + - nextcloudupgrade diff --git a/edubox.yml b/edubox.yml index 06ca4fe..5bcea15 100644 --- a/edubox.yml +++ b/edubox.yml @@ -67,6 +67,6 @@ enabled: true roles: - - up2date-debian + - up2date_debian - educontainer - - systemd-networkd-resolved + - networkdresolved diff --git a/installbox.yml b/installbox.yml index a87f8b7..e4155f2 100644 --- a/installbox.yml +++ b/installbox.yml @@ -38,9 +38,9 @@ roles: - - up2date-debian - - two-interface-firewalld + - up2date_debian + - firewalld2if - dnsmasq - - netboot-installer - - apt-cacher + - netbootinstaller + - aptcacher - prepare4clients diff --git a/kerberox-client.yml b/kerberox-client.yml index 695c3a1..567676e 100644 --- a/kerberox-client.yml +++ b/kerberox-client.yml @@ -19,8 +19,8 @@ private: true roles: - - up2date-debian - - lan-client + - up2date_debian + - lanclient - kerberize ## Choose either gnome or KDE: # - gnome diff --git a/kerberox.yml b/kerberox.yml index 976db14..e2194b0 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -45,14 +45,14 @@ roles: - - up2date-debian - - two-interface-firewalld - - netboot-installer + - up2date_debian + - firewalld2if + - netbootinstaller - dnsmasq - - apt-cacher - - role: krb5-kdc-ldap + - aptcacher + - role: krb5kdcldap when: not run_in_installer|default(false)|bool - - role: nfs-server + - role: nfsserver when: not run_in_installer|default(false)|bool - prepare4clients - kerberize diff --git a/kiosk.yml b/kiosk.yml index 076e42d..4e2126f 100644 --- a/kiosk.yml +++ b/kiosk.yml @@ -15,7 +15,7 @@ extra_pkgs_bpo: [] # [ libreoffice ] roles: - - up2date-debian + - up2date_debian ## Choose either gnome or KDE: - gnome # - kde diff --git a/roles/apt-cacher/files/apt.conf b/roles/aptcacher/files/apt.conf similarity index 100% rename from roles/apt-cacher/files/apt.conf rename to roles/aptcacher/files/apt.conf diff --git a/roles/apt-cacher/handlers/main.yml b/roles/aptcacher/handlers/main.yml similarity index 100% rename from roles/apt-cacher/handlers/main.yml rename to roles/aptcacher/handlers/main.yml diff --git a/roles/apt-cacher/tasks/main.yml b/roles/aptcacher/tasks/main.yml similarity index 100% rename from roles/apt-cacher/tasks/main.yml rename to roles/aptcacher/tasks/main.yml diff --git a/roles/ddns-update/files/ddns-update b/roles/ddnsupdate/files/ddns-update similarity index 100% rename from roles/ddns-update/files/ddns-update rename to roles/ddnsupdate/files/ddns-update diff --git a/roles/ddns-update/files/ddns-update.service b/roles/ddnsupdate/files/ddns-update.service similarity index 100% rename from roles/ddns-update/files/ddns-update.service rename to roles/ddnsupdate/files/ddns-update.service diff --git a/roles/ddns-update/files/ddns-update.timer b/roles/ddnsupdate/files/ddns-update.timer similarity index 100% rename from roles/ddns-update/files/ddns-update.timer rename to roles/ddnsupdate/files/ddns-update.timer diff --git a/roles/ddns-update/handlers/main.yml b/roles/ddnsupdate/handlers/main.yml similarity index 100% rename from roles/ddns-update/handlers/main.yml rename to roles/ddnsupdate/handlers/main.yml diff --git a/roles/ddns-update/tasks/main.yml b/roles/ddnsupdate/tasks/main.yml similarity index 100% rename from roles/ddns-update/tasks/main.yml rename to roles/ddnsupdate/tasks/main.yml diff --git a/roles/ddns-update/templates/ddns-update.conf.j2 b/roles/ddnsupdate/templates/ddns-update.conf.j2 similarity index 100% rename from roles/ddns-update/templates/ddns-update.conf.j2 rename to roles/ddnsupdate/templates/ddns-update.conf.j2 diff --git a/roles/dns-dhcp-tftp/defaults/main.yml b/roles/dnsdhcptftp/defaults/main.yml similarity index 100% rename from roles/dns-dhcp-tftp/defaults/main.yml rename to roles/dnsdhcptftp/defaults/main.yml diff --git a/roles/dns-dhcp-tftp/handlers/main.yml b/roles/dnsdhcptftp/handlers/main.yml similarity index 100% rename from roles/dns-dhcp-tftp/handlers/main.yml rename to roles/dnsdhcptftp/handlers/main.yml diff --git a/roles/dns-dhcp-tftp/tasks/main.yml b/roles/dnsdhcptftp/tasks/main.yml similarity index 100% rename from roles/dns-dhcp-tftp/tasks/main.yml rename to roles/dnsdhcptftp/tasks/main.yml diff --git a/roles/dns-dhcp-tftp/templates/db.intern.j2 b/roles/dnsdhcptftp/templates/db.intern.j2 similarity index 100% rename from roles/dns-dhcp-tftp/templates/db.intern.j2 rename to roles/dnsdhcptftp/templates/db.intern.j2 diff --git a/roles/dns-dhcp-tftp/templates/db.lan.j2 b/roles/dnsdhcptftp/templates/db.lan.j2 similarity index 100% rename from roles/dns-dhcp-tftp/templates/db.lan.j2 rename to roles/dnsdhcptftp/templates/db.lan.j2 diff --git a/roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 b/roles/dnsdhcptftp/templates/dhcpd.conf.j2 similarity index 100% rename from roles/dns-dhcp-tftp/templates/dhcpd.conf.j2 rename to roles/dnsdhcptftp/templates/dhcpd.conf.j2 diff --git a/roles/dns-dhcp-tftp/templates/localzones.j2 b/roles/dnsdhcptftp/templates/localzones.j2 similarity index 100% rename from roles/dns-dhcp-tftp/templates/localzones.j2 rename to roles/dnsdhcptftp/templates/localzones.j2 diff --git a/roles/dns-dhcp-tftp/templates/resolv.conf.j2 b/roles/dnsdhcptftp/templates/resolv.conf.j2 similarity index 100% rename from roles/dns-dhcp-tftp/templates/resolv.conf.j2 rename to roles/dnsdhcptftp/templates/resolv.conf.j2 diff --git a/roles/two-interface-firewalld/handlers/main.yml b/roles/firewalld2if/handlers/main.yml similarity index 100% rename from roles/two-interface-firewalld/handlers/main.yml rename to roles/firewalld2if/handlers/main.yml diff --git a/roles/two-interface-firewalld/tasks/main.yml b/roles/firewalld2if/tasks/main.yml similarity index 100% rename from roles/two-interface-firewalld/tasks/main.yml rename to roles/firewalld2if/tasks/main.yml diff --git a/roles/two-interface-firewalld/templates/interfaces-static.j2 b/roles/firewalld2if/templates/interfaces-static.j2 similarity index 100% rename from roles/two-interface-firewalld/templates/interfaces-static.j2 rename to roles/firewalld2if/templates/interfaces-static.j2 diff --git a/roles/krb5-kdc-ldap/defaults/main.yml b/roles/krb5kdcldap/defaults/main.yml similarity index 100% rename from roles/krb5-kdc-ldap/defaults/main.yml rename to roles/krb5kdcldap/defaults/main.yml diff --git a/roles/krb5-kdc-ldap/handlers/main.yml b/roles/krb5kdcldap/handlers/main.yml similarity index 100% rename from roles/krb5-kdc-ldap/handlers/main.yml rename to roles/krb5kdcldap/handlers/main.yml diff --git a/roles/krb5-kdc-ldap/meta/main.yml b/roles/krb5kdcldap/meta/main.yml similarity index 100% rename from roles/krb5-kdc-ldap/meta/main.yml rename to roles/krb5kdcldap/meta/main.yml diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5kdcldap/tasks/main.yml similarity index 100% rename from roles/krb5-kdc-ldap/tasks/main.yml rename to roles/krb5kdcldap/tasks/main.yml diff --git a/roles/krb5-kdc-ldap/templates/kadm5.acl.j2 b/roles/krb5kdcldap/templates/kadm5.acl.j2 similarity index 100% rename from roles/krb5-kdc-ldap/templates/kadm5.acl.j2 rename to roles/krb5kdcldap/templates/kadm5.acl.j2 diff --git a/roles/krb5-kdc-ldap/templates/kdc.conf.j2 b/roles/krb5kdcldap/templates/kdc.conf.j2 similarity index 100% rename from roles/krb5-kdc-ldap/templates/kdc.conf.j2 rename to roles/krb5kdcldap/templates/kdc.conf.j2 diff --git a/roles/krb5-kdc-ldap/templates/krb5.conf.j2 b/roles/krb5kdcldap/templates/krb5.conf.j2 similarity index 100% rename from roles/krb5-kdc-ldap/templates/krb5.conf.j2 rename to roles/krb5kdcldap/templates/krb5.conf.j2 diff --git a/roles/lan-client/defaults/main.yml b/roles/lanclient/defaults/main.yml similarity index 100% rename from roles/lan-client/defaults/main.yml rename to roles/lanclient/defaults/main.yml diff --git a/roles/lan-client/handlers/main.yml b/roles/lanclient/handlers/main.yml similarity index 100% rename from roles/lan-client/handlers/main.yml rename to roles/lanclient/handlers/main.yml diff --git a/roles/lan-client/tasks/main.yml b/roles/lanclient/tasks/main.yml similarity index 100% rename from roles/lan-client/tasks/main.yml rename to roles/lanclient/tasks/main.yml diff --git a/roles/lan-client/templates/sssd.conf.j2 b/roles/lanclient/templates/sssd.conf.j2 similarity index 100% rename from roles/lan-client/templates/sssd.conf.j2 rename to roles/lanclient/templates/sssd.conf.j2 diff --git a/roles/low-power/files/powertop.service b/roles/lowpower/files/powertop.service similarity index 100% rename from roles/low-power/files/powertop.service rename to roles/lowpower/files/powertop.service diff --git a/roles/low-power/files/powertop.timer b/roles/lowpower/files/powertop.timer similarity index 100% rename from roles/low-power/files/powertop.timer rename to roles/lowpower/files/powertop.timer diff --git a/roles/low-power/handlers/main.yml b/roles/lowpower/handlers/main.yml similarity index 100% rename from roles/low-power/handlers/main.yml rename to roles/lowpower/handlers/main.yml diff --git a/roles/low-power/tasks/main.yml b/roles/lowpower/tasks/main.yml similarity index 100% rename from roles/low-power/tasks/main.yml rename to roles/lowpower/tasks/main.yml diff --git a/roles/netboot-installer/defaults/main.yml b/roles/netbootinstaller/defaults/main.yml similarity index 100% rename from roles/netboot-installer/defaults/main.yml rename to roles/netbootinstaller/defaults/main.yml diff --git a/roles/netboot-installer/handlers/main.yml b/roles/netbootinstaller/handlers/main.yml similarity index 100% rename from roles/netboot-installer/handlers/main.yml rename to roles/netbootinstaller/handlers/main.yml diff --git a/roles/netboot-installer/tasks/main.yml b/roles/netbootinstaller/tasks/main.yml similarity index 100% rename from roles/netboot-installer/tasks/main.yml rename to roles/netbootinstaller/tasks/main.yml diff --git a/roles/systemd-networkd-resolved/files/all-eth.network b/roles/networkdresolved/files/all-eth.network similarity index 100% rename from roles/systemd-networkd-resolved/files/all-eth.network rename to roles/networkdresolved/files/all-eth.network diff --git a/roles/systemd-networkd-resolved/handlers/main.yml b/roles/networkdresolved/handlers/main.yml similarity index 100% rename from roles/systemd-networkd-resolved/handlers/main.yml rename to roles/networkdresolved/handlers/main.yml diff --git a/roles/systemd-networkd-resolved/tasks/main.yml b/roles/networkdresolved/tasks/main.yml similarity index 100% rename from roles/systemd-networkd-resolved/tasks/main.yml rename to roles/networkdresolved/tasks/main.yml diff --git a/roles/systemd-networkd-resolved/templates/20-static.network.j2 b/roles/networkdresolved/templates/20-static.network.j2 similarity index 100% rename from roles/systemd-networkd-resolved/templates/20-static.network.j2 rename to roles/networkdresolved/templates/20-static.network.j2 diff --git a/roles/nextcloud-upgrade/handlers/main.yml b/roles/nextcloudupgrade/handlers/main.yml similarity index 100% rename from roles/nextcloud-upgrade/handlers/main.yml rename to roles/nextcloudupgrade/handlers/main.yml diff --git a/roles/nextcloud-upgrade/tasks/main.yml b/roles/nextcloudupgrade/tasks/main.yml similarity index 100% rename from roles/nextcloud-upgrade/tasks/main.yml rename to roles/nextcloudupgrade/tasks/main.yml diff --git a/roles/nfs-server/defaults/main.yml b/roles/nfsserver/defaults/main.yml similarity index 100% rename from roles/nfs-server/defaults/main.yml rename to roles/nfsserver/defaults/main.yml diff --git a/roles/nfs-server/handlers/main.yml b/roles/nfsserver/handlers/main.yml similarity index 100% rename from roles/nfs-server/handlers/main.yml rename to roles/nfsserver/handlers/main.yml diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfsserver/tasks/main.yml similarity index 100% rename from roles/nfs-server/tasks/main.yml rename to roles/nfsserver/tasks/main.yml diff --git a/roles/nfs-server/templates/dhcp-send-domain.j2 b/roles/nfsserver/templates/dhcp-send-domain.j2 similarity index 100% rename from roles/nfs-server/templates/dhcp-send-domain.j2 rename to roles/nfsserver/templates/dhcp-send-domain.j2 diff --git a/roles/nfs-server/templates/sssd.conf.j2 b/roles/nfsserver/templates/sssd.conf.j2 similarity index 100% rename from roles/nfs-server/templates/sssd.conf.j2 rename to roles/nfsserver/templates/sssd.conf.j2 diff --git a/roles/samba-ldap/defaults/main.yml b/roles/sambaldap/defaults/main.yml similarity index 100% rename from roles/samba-ldap/defaults/main.yml rename to roles/sambaldap/defaults/main.yml diff --git a/roles/samba-ldap/handlers/main.yml b/roles/sambaldap/handlers/main.yml similarity index 100% rename from roles/samba-ldap/handlers/main.yml rename to roles/sambaldap/handlers/main.yml diff --git a/roles/samba-ldap/meta/main.yml b/roles/sambaldap/meta/main.yml similarity index 100% rename from roles/samba-ldap/meta/main.yml rename to roles/sambaldap/meta/main.yml diff --git a/roles/samba-ldap/tasks/main.yml b/roles/sambaldap/tasks/main.yml similarity index 100% rename from roles/samba-ldap/tasks/main.yml rename to roles/sambaldap/tasks/main.yml diff --git a/roles/samba-ldap/templates/sssd.conf.j2 b/roles/sambaldap/templates/sssd.conf.j2 similarity index 100% rename from roles/samba-ldap/templates/sssd.conf.j2 rename to roles/sambaldap/templates/sssd.conf.j2 diff --git a/roles/two-interface-shorewall/handlers/main.yml b/roles/shorewall2if/handlers/main.yml similarity index 100% rename from roles/two-interface-shorewall/handlers/main.yml rename to roles/shorewall2if/handlers/main.yml diff --git a/roles/two-interface-shorewall/tasks/main.yml b/roles/shorewall2if/tasks/main.yml similarity index 100% rename from roles/two-interface-shorewall/tasks/main.yml rename to roles/shorewall2if/tasks/main.yml diff --git a/roles/two-interface-shorewall/templates/interfaces-static.j2 b/roles/shorewall2if/templates/interfaces-static.j2 similarity index 100% rename from roles/two-interface-shorewall/templates/interfaces-static.j2 rename to roles/shorewall2if/templates/interfaces-static.j2 diff --git a/roles/smb-sshfs-client/defaults/main.yml b/roles/smbsshfsclient/defaults/main.yml similarity index 100% rename from roles/smb-sshfs-client/defaults/main.yml rename to roles/smbsshfsclient/defaults/main.yml diff --git a/roles/smb-sshfs-client/handlers/main.yml b/roles/smbsshfsclient/handlers/main.yml similarity index 100% rename from roles/smb-sshfs-client/handlers/main.yml rename to roles/smbsshfsclient/handlers/main.yml diff --git a/roles/smb-sshfs-client/tasks/main.yml b/roles/smbsshfsclient/tasks/main.yml similarity index 100% rename from roles/smb-sshfs-client/tasks/main.yml rename to roles/smbsshfsclient/tasks/main.yml diff --git a/roles/smb-sshfs-client/templates/sssd.conf.j2 b/roles/smbsshfsclient/templates/sssd.conf.j2 similarity index 100% rename from roles/smb-sshfs-client/templates/sssd.conf.j2 rename to roles/smbsshfsclient/templates/sssd.conf.j2 diff --git a/roles/transparent-squid/files/store_id_regex.conf b/roles/transparentsquid/files/store_id_regex.conf similarity index 100% rename from roles/transparent-squid/files/store_id_regex.conf rename to roles/transparentsquid/files/store_id_regex.conf diff --git a/roles/transparent-squid/handlers/main.yml b/roles/transparentsquid/handlers/main.yml similarity index 100% rename from roles/transparent-squid/handlers/main.yml rename to roles/transparentsquid/handlers/main.yml diff --git a/roles/transparent-squid/tasks/main.yml b/roles/transparentsquid/tasks/main.yml similarity index 100% rename from roles/transparent-squid/tasks/main.yml rename to roles/transparentsquid/tasks/main.yml diff --git a/roles/up2date-debian/defaults/main.yml b/roles/up2date_debian/defaults/main.yml similarity index 100% rename from roles/up2date-debian/defaults/main.yml rename to roles/up2date_debian/defaults/main.yml diff --git a/roles/up2date-debian/tasks/main.yml b/roles/up2date_debian/tasks/main.yml similarity index 100% rename from roles/up2date-debian/tasks/main.yml rename to roles/up2date_debian/tasks/main.yml diff --git a/roles/web-server/tasks/main.yml b/roles/webserver/tasks/main.yml similarity index 100% rename from roles/web-server/tasks/main.yml rename to roles/webserver/tasks/main.yml diff --git a/sambox-client.yml b/sambox-client.yml index 305f81c..5588c82 100644 --- a/sambox-client.yml +++ b/sambox-client.yml @@ -13,8 +13,8 @@ ansible_python_interpreter: "/usr/bin/python3" roles: - - up2date-debian - - smb-sshfs-client + - up2date_debian + - smbsshfsclient ## Choose either gnome or KDE: # - gnome # - kde diff --git a/sambox.yml b/sambox.yml index 465a5d8..9954225 100644 --- a/sambox.yml +++ b/sambox.yml @@ -51,10 +51,10 @@ roles: - - up2date-debian - - two-interface-firewalld - - netboot-installer - - dns-dhcp-tftp - - apt-cacher - - samba-ldap + - up2date_debian + - firewalld2if + - netbootinstaller + - dnsdhcptftp + - aptcacher + - sambaldap - prepare4clients From 8eb7c935027b74d77e542c87e6ac7696ee0d586c Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jun 2022 15:10:39 +0200 Subject: [PATCH 201/504] More ansible-lint cleanup. --- roles/prepare4clients/tasks/main.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index d5679e0..643e98c 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -101,7 +101,8 @@ } #menuentry 'Debian daily (amd64) + preseed + kiosk.yml' { - # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical \ + # url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- # initrd /d-i/n-a/daily/amd64/initrd.gz #} marker: "# {mark} ANSIBLE MANAGED BLOCK kiosk" @@ -185,7 +186,7 @@ ###################### -- name: provide git repo if not available already +- name: provide git repo if not available already # noqa git-latest git: repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' dest: "{{ repo_dir }}" From f550f530c66b82298a809d82fc97391bb55d12b7 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jun 2022 17:26:29 +0200 Subject: [PATCH 202/504] Fix cloudbox. --- cloudbox.yml | 5 +++-- roles/nextcloud/tasks/main.yml | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/cloudbox.yml b/cloudbox.yml index de52ea5..f67342f 100644 --- a/cloudbox.yml +++ b/cloudbox.yml @@ -2,7 +2,8 @@ # This playbook deploys the cloudbox on a minimal installation. - name: apply configuration to the cloudbox - hosts: cloudboxes + # hosts: cloudboxes ## 'all' is needed to make ansible-pull work + hosts: all remote_user: ansible become: true vars: @@ -15,7 +16,7 @@ ## 'nc_download' and 'nc_checksum' are only ## used for ansible-pull during installation: nc_download: "https://download.nextcloud.com/server/releases/latest.tar.bz2" - nc_checksum: "sha256:770faf34b8f0d81273623daed4d64ec7919c38dfeb07328b613058addbed19c0" + nc_checksum: "sha256:d32a8f6c4722a45cb67de7018163cfafcfa22a871fbac0f623c3875fa4304e5a" nc_apps: - calendar - notes diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 25c6163..565682e 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -160,7 +160,7 @@ when: not nextcloud.stat.exists and not run_in_installer|default(false)|bool - name: start mariadb during installation - command: /etc/init.d/mysql start + command: /etc/init.d/mariadb start when: run_in_installer|default(false)|bool - name: create database with name 'nextcloud' From f3d2d5ca9b958612101618d34d7440d46c57711a Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jun 2022 17:35:36 +0200 Subject: [PATCH 203/504] Add 'cloudbox' to installbox examples. --- roles/dnsmasq/templates/dnsmasq-dhcp.j2 | 2 +- roles/prepare4clients/tasks/main.yml | 25 +++++++++++++++++++------ 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/roles/dnsmasq/templates/dnsmasq-dhcp.j2 b/roles/dnsmasq/templates/dnsmasq-dhcp.j2 index 29f73dd..77201cf 100644 --- a/roles/dnsmasq/templates/dnsmasq-dhcp.j2 +++ b/roles/dnsmasq/templates/dnsmasq-dhcp.j2 @@ -1,3 +1,3 @@ interface={{ if_lan }} dhcp-range={{ dhcp_start }},{{ dhcp_stop }},2h -dhcp-generate-names +# dhcp-generate-names ## better use grub to generate names diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 643e98c..3bc1ffc 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -57,7 +57,7 @@ -i localhost, --url=git://{{ ansible_hostname }}/.git $playbook marker: "# {mark} ANSIBLE MANAGED BLOCK preseed/late_command" -- name: add kiosk auto pxe boot entry to di-netboot-assistant +- name: add pxe boot entries to di-netboot-assistant blockinfile: dest: /etc/di-netboot-assistant/pxelinux.HEAD insertbefore: EOF @@ -69,10 +69,15 @@ kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz mirror/http/proxy?=http://{{ ansible_hostname }}:3142/ pkgsel/include=etckeeper preseed/late_command="rm -fv /target/etc/apt/apt.conf" --- - LABEL autoinstall + LABEL kiosk MENU LABEL Debian {{ di_version }} (amd64) + preseed + kiosk.yml kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux - append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz hostname=kiosk auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + + LABEL cloudbox + MENU LABEL Debian {{ di_version }} (amd64) + preseed + cloudbox.yml + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz hostname=cloudbox auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=cloudbox.yml --- #LABEL daily #MENU LABEL Debian daily (amd64) + preseed + kiosk.yml @@ -81,7 +86,7 @@ marker: "# {mark} ANSIBLE MANAGED BLOCK kiosk" notify: "rebuild di-netboot-assistant menu" -- name: add kiosk auto efi boot entry to di-netboot-assistant +- name: add efi boot entries to di-netboot-assistant blockinfile: dest: /etc/di-netboot-assistant/grub.cfg.HEAD insertbefore: EOF @@ -96,7 +101,15 @@ menuentry 'Debian {{ di_version }} (amd64) + preseed + kiosk.yml' { linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ - auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + hostname=kiosk auto=true priority=critical \ + url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz + } + + menuentry 'Debian {{ di_version }} (amd64) + preseed + cloudbox.yml' { + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + hostname=cloudbox auto=true priority=critical \ + url=tftp://{{ ansible_hostname }} playbook=cloudbox.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } @@ -185,7 +198,6 @@ ###################### - - name: provide git repo if not available already # noqa git-latest git: repo: 'https://salsa.debian.org/andi/debian-lan-ansible.git' @@ -212,3 +224,4 @@ block: | [kerberox-client] {{ in_inventory }} + when: krb5kdc.stat.exists or samba.stat.exists From 49d81c705d34ecb7119efe2da1b96f0aa70c4432 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 12 Jun 2022 21:02:54 +0200 Subject: [PATCH 204/504] Fix kerberox. --- README.kerberox | 9 ++- kerberox.yml | 10 ++- roles/krb5kdcldap/tasks/main.yml | 103 +++++++++++++++------------ roles/ldap/handlers/main.cfg | 4 -- roles/ldap/tasks/setup.yml | 4 +- roles/prepare4clients/tasks/main.yml | 8 ++- roles/sambaldap/tasks/main.yml | 4 +- 7 files changed, 80 insertions(+), 62 deletions(-) delete mode 100644 roles/ldap/handlers/main.cfg diff --git a/README.kerberox b/README.kerberox index 1e969af..fd84d98 100644 --- a/README.kerberox +++ b/README.kerberox @@ -1,11 +1,14 @@ ## After installation of the clients, prepare and copy all machine ## credentials to the machines in the following way: +## Log into the Kerberos KDC (kerberox). + ## Find the kadmin password to be used soon: - sudo cat /root/kadmin.pwd + sudo cat /root/kadmin.pwd ## Then: - cd /home/ansible/debian-lan/ - ansible-playbook --ask-become-pass kerberox-client.yml + cd /home/ansible/debian-lan/ + ansible-playbook --ask-become-pass kerberox-client.yml \ + --ssh-common-args='-o StrictHostKeyChecking=no' ## Enter the 'BECOME' password and the kadmin password obtained above. diff --git a/kerberox.yml b/kerberox.yml index e2194b0..084ec74 100644 --- a/kerberox.yml +++ b/kerberox.yml @@ -16,8 +16,12 @@ ## LAN IP address range: ipaddr_lan: 192.168.0.10/24 - dhcp_range: 192.168.0.50,192.168.0.99,2h - in_inventory: 192.168.0.[50:99] + ipaddr_lan_threeoct: "{{ ipaddr_lan.split('.')[0:3] | join('.') }}" + ipaddr_lan_ptr: "{{ (ipaddr_lan | ipaddr('revdns')).split('.')[1:] | join('.') }}" + ipaddr_lan_ptr_threeoct: "{{ ipaddr_lan_ptr.split('.')[0:3] | join('.') }}" + dhcp_start: 192.168.0.50 + dhcp_stop: 192.168.0.150 + in_inventory: 192.168.0.[50:150] di_dist: "{{ ansible_distribution_release }}" di_version: "{{ ansible_distribution_major_version }}" @@ -47,8 +51,8 @@ roles: - up2date_debian - firewalld2if - - netbootinstaller - dnsmasq + - netbootinstaller - aptcacher - role: krb5kdcldap when: not run_in_installer|default(false)|bool diff --git a/roles/krb5kdcldap/tasks/main.yml b/roles/krb5kdcldap/tasks/main.yml index 50a3f39..16b7850 100644 --- a/roles/krb5kdcldap/tasks/main.yml +++ b/roles/krb5kdcldap/tasks/main.yml @@ -19,7 +19,6 @@ file: path: /etc/krb5kdc state: directory - recurse: true mode: 0755 - name: prepare kdc.conf @@ -81,71 +80,83 @@ bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - name: modify ACLs to account for KDC - ldap_attr: + ldap_attrs: dn: "olcDatabase={1}mdb,cn=config" - name: olcAccess - values: - - >- - to attrs=userPassword - by self write - by anonymous auth - by * none - - >- - to attrs=shadowLastChange - by self write - by * read - - >- - to dn.subtree="cn=kerberos,{{ basedn }}" - by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read - by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write - by * none - - >- - to attrs=krbPrincipalName,krbLastPwdChange,krbPrincipalKey,krbExtraData - by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read - by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write - by self read - by * auth - - >- - to * - by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write - by * read + attributes: + olcAccess: + - >- + to attrs=userPassword + by self write + by anonymous auth + by * none + - >- + to attrs=shadowLastChange + by self write + by * read + - >- + to dn.subtree="cn=kerberos,{{ basedn }}" + by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by * none + - >- + to attrs=krbPrincipalName,krbLastPwdChange,krbPrincipalKey,krbExtraData + by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by self read + by * auth + - >- + to * + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by * read + ordered: true state: exact when: not krb5kdc.stat.exists - name: add KDC indexes to LDAP - ldap_attr: + ldap_attrs: dn: "olcDatabase={1}mdb,cn=config" - name: olcDbIndex - values: - - objectClass eq - - cn,uid eq - - uidNumber,gidNumber eq - - member,memberUid eq - - krbPrincipalName pres,sub,eq + attributes: + olcDbIndex: + - objectClass eq + - cn,uid eq + - uidNumber,gidNumber eq + - member,memberUid eq + - krbPrincipalName pres,sub,eq state: exact when: not krb5kdc.stat.exists - name: add AuthzRegexp to map access via kerberos/GSSAPI - ldap_attr: + ldap_attrs: dn: "cn=config" - name: olcAuthzRegexp - values: - - "{0}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=people,{{ basedn }}" - - "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}" + attributes: + olcAuthzRegexp: + - "{0}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=people,{{ basedn }}" + - "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}" state: exact - name: prepare password for kdc # noqa risky-shell-pipe - shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps -c 256 | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile + shell: + >- + echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | + xxd -g0 -ps -c 256 | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile ; + chmod 0600 /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists - name: prepare password for kadmin # noqa risky-shell-pipe - shell: echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | xxd -g0 -ps -c 256 | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile + shell: + >- + echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | + xxd -g0 -ps -c 256 | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile ; + chmod 0600 /etc/krb5kdc/service.keyfile no_log: true when: not krb5kdc.stat.exists - name: dump kdc master password - shell: echo -n "{{ kdc_master_pwd }}" > "{{ kdc_master_pwd_file }}" ; chmod 0600 "{{ kdc_master_pwd_file }}" + shell: + >- + echo -n "{{ kdc_master_pwd }}" > "{{ kdc_master_pwd_file }}" ; + chmod 0600 "{{ kdc_master_pwd_file }}" no_log: true when: not krb5kdc.stat.exists @@ -200,11 +211,11 @@ mode: '0640' notify: restart slapd -- name: "make 'kerberos' an alias hostname resolvable from the LAN" +- name: "make 'kerberos' and 'ldap' alias hostnames resolvable from the LAN" replace: path: /etc/hosts regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 kerberos' + replace: '\1 kerberos ldap' when: not krb5kdc.stat.exists ######################## diff --git a/roles/ldap/handlers/main.cfg b/roles/ldap/handlers/main.cfg deleted file mode 100644 index 93bbc44..0000000 --- a/roles/ldap/handlers/main.cfg +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: restart slapd - systemd: name=slapd state=restarted - listen: restart slapd diff --git a/roles/ldap/tasks/setup.yml b/roles/ldap/tasks/setup.yml index 9bbf5e9..c0e207b 100644 --- a/roles/ldap/tasks/setup.yml +++ b/roles/ldap/tasks/setup.yml @@ -44,7 +44,9 @@ name: openldap groups: ssl-cert append: true - notify: restart slapd + +- name: restart slapd with access to ssl-cert + systemd: name=slapd state=restarted - name: make initial slapd configuration available copy: diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index 3bc1ffc..b127b28 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -83,7 +83,7 @@ #MENU LABEL Debian daily (amd64) + preseed + kiosk.yml #kernel ::/d-i/n-a/daily/amd64/linux #append initrd=::/d-i/n-a/daily/amd64/initrd.gz auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- - marker: "# {mark} ANSIBLE MANAGED BLOCK kiosk" + marker: "# {mark} ANSIBLE MANAGED BLOCK default" notify: "rebuild di-netboot-assistant menu" - name: add efi boot entries to di-netboot-assistant @@ -118,7 +118,7 @@ # url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- # initrd /d-i/n-a/daily/amd64/initrd.gz #} - marker: "# {mark} ANSIBLE MANAGED BLOCK kiosk" + marker: "# {mark} ANSIBLE MANAGED BLOCK default" notify: "rebuild di-netboot-assistant menu" ######## kerberox-client ####### @@ -146,7 +146,9 @@ insertbefore: EOF block: | menuentry 'Debian {{ di_version }} (amd64) + preseed + kerberox-client.yml' { + regexp --set=1:oct4 --set=2:oct5 --set=3:oct6 "\:([[:xdigit:]]+)\:([[:xdigit:]]+)\:([[:xdigit:]]+)\$" $net_default_mac linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + hostname=${oct4}${oct5}${oct6} domain={{ ansible_domain }} \ auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=kerberox-client.yml --- initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } @@ -222,6 +224,6 @@ create: true mode: 0644 block: | - [kerberox-client] + [kerberoxclient] {{ in_inventory }} when: krb5kdc.stat.exists or samba.stat.exists diff --git a/roles/sambaldap/tasks/main.yml b/roles/sambaldap/tasks/main.yml index e272ee2..b67b891 100644 --- a/roles/sambaldap/tasks/main.yml +++ b/roles/sambaldap/tasks/main.yml @@ -31,7 +31,7 @@ when: not samba_ldap.stat.exists - name: add indexes to LDAP - ldap_attr: + ldap_attrs: dn: "olcDatabase={1}mdb,cn=config" name: olcDbIndex values: @@ -43,7 +43,7 @@ state: present - name: modify ACLs to account for Samba - ldap_attr: + ldap_attrs: dn: "olcDatabase={1}mdb,cn=config" name: olcAccess values: From 4a6c5ea10da609300f9d97bbf76f9f3112349fa0 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 08:25:56 +0200 Subject: [PATCH 205/504] Add 'edubox' to installbox examples. --- roles/prepare4clients/tasks/main.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/roles/prepare4clients/tasks/main.yml b/roles/prepare4clients/tasks/main.yml index b127b28..bf89fc1 100644 --- a/roles/prepare4clients/tasks/main.yml +++ b/roles/prepare4clients/tasks/main.yml @@ -79,6 +79,11 @@ kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz hostname=cloudbox auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=cloudbox.yml --- + LABEL edubox + MENU LABEL Debian {{ di_version }} (amd64) + preseed + edubox.yml + kernel ::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux + append initrd=::/d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz hostname=edubox auto=true priority=critical url=tftp://{{ ansible_hostname }} playbook=edubox.yml --- + #LABEL daily #MENU LABEL Debian daily (amd64) + preseed + kiosk.yml #kernel ::/d-i/n-a/daily/amd64/linux @@ -113,6 +118,13 @@ initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz } + menuentry 'Debian {{ di_version }} (amd64) + preseed + edubox.yml' { + linux /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/linux \ + hostname=edubox auto=true priority=critical \ + url=tftp://{{ ansible_hostname }} playbook=edubox.yml --- + initrd /d-i/n-pkg/images/{{ di_version }}/amd64/text/debian-installer/amd64/initrd.gz + } + #menuentry 'Debian daily (amd64) + preseed + kiosk.yml' { # linux /d-i/n-a/daily/amd64/linux auto=true priority=critical \ # url=tftp://{{ ansible_hostname }} playbook=kiosk.yml --- From bc383ec232df65ccc28621a8fa6e066689caf54e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 10:25:07 +0200 Subject: [PATCH 206/504] Add gdm3 configuration. --- roles/gnome/tasks/main.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/roles/gnome/tasks/main.yml b/roles/gnome/tasks/main.yml index ab80bda..2ab9029 100644 --- a/roles/gnome/tasks/main.yml +++ b/roles/gnome/tasks/main.yml @@ -36,6 +36,19 @@ mode: 0644 notify: update dconf +- name: configure gdm3 + replace: + dest: /etc/gdm3/greeter.dconf-defaults + regexp: "{{ item.rex }}" + replace: "{{ item.rep }}" + loop: + - rex: "# disable-user-list=.*" + rep: "disable-user-list=true" + - rex: "# sleep-inactive-ac-timeout=.*" + rep: "sleep-inactive-ac-timeout=600" + - rex: "# sleep-inactive-ac-type=.*" + rep: "sleep-inactive-ac-type='interactive'\npower-button-action='interactive'" + ## Bug #698504 - name: allow print job management replace: From 429ca35a75c4072a1fc72e86468367178b5d73b2 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 19:27:52 +0200 Subject: [PATCH 207/504] Add 'edubox', reordering. --- README | 50 +++++++++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 19 deletions(-) diff --git a/README b/README index 00e8c24..37fff9c 100644 --- a/README +++ b/README @@ -19,11 +19,6 @@ offers ansible playbooks and instructions for the following machines: • kerberox-client: the client for the kerberized LAN - • kiosk: school's computer, hackerspace, … - - auto login user - - reasonable defaults - - temporary home directory on tmpfs, reset at boot - • cloudbox: nextcloud server in the basement - setup of a home cloud server - dynamic DNS name @@ -31,6 +26,13 @@ offers ansible playbooks and instructions for the following machines: - backup with borg - … + • kiosk: school's computer, hackerspace, … + - auto login user + - reasonable defaults + - temporary home directory on tmpfs, reset at boot + + • edubox: deploy a set of containers for teaching (edubox.yml) + Contributions like patches, suggestions, pull requests and/or further profiles are highly appreciated! @@ -76,20 +78,6 @@ installation. To do the latter, cd into 'debian-lan' and run: The kerberox-clients are automatically installed using the included TFTP netboot installer within the LAN. -Kiosk -~~~~~ - • Debian installation: - - user 'ansible' in sudo group - - • customize kiosk.yml: - - WiFi parameters - - package selection: extra_pkgs and extra_pkgs_bpo for backports - - desktop environment - - • run ansible: - ssh-copy-id ansible@1.2.3.4 - ansible-playbook kiosk.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, - Cloudbox ~~~~~~~~ • Debian installation: @@ -106,3 +94,27 @@ Cloudbox • use 'nc-admin' with password in '/root/nc-admin.pwd' to log into nextcloud. +Kiosk +~~~~~ + • Debian installation: + - user 'ansible' in sudo group + + • customize kiosk.yml: + - WiFi parameters + - package selection: extra_pkgs and extra_pkgs_bpo for backports + - desktop environment + + • run ansible: + ssh-copy-id ansible@1.2.3.4 + ansible-playbook kiosk.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, + +Edubox +~~~~~~ + • Debian installation: + - user 'ansible' in sudo group + + • customize edubox.yml + + • run ansible: + ssh-copy-id ansible@1.2.3.4 + ansible-playbook edubox.yml -v --become --ask-become-pass -u ansible -i 1.2.3.4, From bfee555f1e1866ae4f6365a35636bb3b3aba928e Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 19:30:56 +0200 Subject: [PATCH 208/504] Add 'ldap' alias in ldap role. --- roles/krb5kdcldap/tasks/main.yml | 4 ++-- roles/ldap/tasks/main.yml | 16 +++++++--------- roles/ldap/tasks/setup.yml | 6 ++++++ 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/roles/krb5kdcldap/tasks/main.yml b/roles/krb5kdcldap/tasks/main.yml index 16b7850..bee6ec7 100644 --- a/roles/krb5kdcldap/tasks/main.yml +++ b/roles/krb5kdcldap/tasks/main.yml @@ -211,11 +211,11 @@ mode: '0640' notify: restart slapd -- name: "make 'kerberos' and 'ldap' alias hostnames resolvable from the LAN" +- name: "make 'kerberos' an alias hostname" replace: path: /etc/hosts regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 kerberos ldap' + replace: '\1 kerberos' when: not krb5kdc.stat.exists ######################## diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml index 25bcf84..6acabec 100644 --- a/roles/ldap/tasks/main.yml +++ b/roles/ldap/tasks/main.yml @@ -53,6 +53,13 @@ dest: /usr/local/sbin/debian-lan mode: 0744 +- name: allow ldap service in firewalld + firewalld: + zone: internal + service: ldap + permanent: true + immediate: true + state: enabled - name: add dummy user foo ldap_entry: @@ -82,12 +89,3 @@ bind_dn: "cn=admin,{{ basedn }}" bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" when: foo_pwd is defined and foo_pwd | length > 0 - - -- name: allow ldap service in firewalld - firewalld: - zone: internal - service: ldap - permanent: true - immediate: true - state: enabled diff --git a/roles/ldap/tasks/setup.yml b/roles/ldap/tasks/setup.yml index c0e207b..013ebf8 100644 --- a/roles/ldap/tasks/setup.yml +++ b/roles/ldap/tasks/setup.yml @@ -87,6 +87,12 @@ regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$" replace: '#\1\nTLS_CACERT\t{{ certpub }}' +- name: "make 'ldap' an alias hostname" + replace: + path: /etc/hosts + regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" + replace: '\1 ldap' + - name: enable pam-mkhomedir command: pam-auth-update --enable mkhomedir when: foo_pwd is defined and foo_pwd | length > 0 From b0e34434b16341a7d4bf17d00ce5805203d3f826 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 19:53:53 +0200 Subject: [PATCH 209/504] Split 'normal' and 'setup' tasks. --- roles/krb5kdcldap/tasks/main.yml | 228 ++---------------------------- roles/krb5kdcldap/tasks/setup.yml | 197 ++++++++++++++++++++++++++ 2 files changed, 208 insertions(+), 217 deletions(-) create mode 100644 roles/krb5kdcldap/tasks/setup.yml diff --git a/roles/krb5kdcldap/tasks/main.yml b/roles/krb5kdcldap/tasks/main.yml index bee6ec7..fc3cce1 100644 --- a/roles/krb5kdcldap/tasks/main.yml +++ b/roles/krb5kdcldap/tasks/main.yml @@ -1,5 +1,4 @@ -## Install and configure krb5-kdc-ldap (if not done yet), -## run most tasks only on krb5-kdc-ldap installation. +## Install and configure krb5-kdc-ldap. --- - name: check that domain name is available fail: msg="The machine's domain must not be empty." @@ -9,223 +8,11 @@ stat: path=/usr/sbin/krb5kdc register: krb5kdc -- name: prepare krb5.conf - template: - src: krb5.conf.j2 - dest: /etc/krb5.conf - mode: 0644 - -- name: make sure krb5kdc exists - file: - path: /etc/krb5kdc - state: directory - mode: 0755 - -- name: prepare kdc.conf - template: - src: kdc.conf.j2 - dest: /etc/krb5kdc/kdc.conf - mode: 0644 - -- name: prepare kadm5.acl - template: - src: kadm5.acl.j2 - dest: /etc/krb5kdc/kadm5.acl - mode: 0644 - notify: "restart krb5-admin-server" - -- name: install krb5-kdc-ldap and krb5-admin-server - apt: - name: - - krb5-kdc-ldap - - krb5-admin-server - state: latest # noqa package-latest - -- name: prepare kerberos.openldap.ldif - shell: gunzip -c /usr/share/doc/krb5-kdc-ldap/kerberos.openldap.ldif.gz > /etc/ldap/schema/kerberos.openldap.ldif - args: - creates: /etc/ldap/schema/kerberos.openldap.ldif - -- name: activate kerberos.openldap.ldif schema - command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/kerberos.openldap.ldif +- name: install and configure krb5-kdc-ldap + include_tasks: setup.yml when: not krb5kdc.stat.exists -- name: make sure we have a kerberos container - ldap_entry: - dn: "cn=kerberos,{{ basedn }}" - objectClass: krbContainer - bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - -- name: make sure we have a kdc object - ldap_entry: - dn: "cn=kdc,cn=kerberos,{{ basedn }}" - objectClass: - - organizationalRole - - simpleSecurityObject - attributes: - userPassword: "{{ kdc_service_pwd }}" - bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - -- name: make sure we have a kadmin object - ldap_entry: - dn: "cn=kadmin,cn=kerberos,{{ basedn }}" - objectClass: - - organizationalRole - - simpleSecurityObject - attributes: - userPassword: "{{ kadmin_service_pwd }}" - bind_dn: "cn=admin,{{ basedn }}" - bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - -- name: modify ACLs to account for KDC - ldap_attrs: - dn: "olcDatabase={1}mdb,cn=config" - attributes: - olcAccess: - - >- - to attrs=userPassword - by self write - by anonymous auth - by * none - - >- - to attrs=shadowLastChange - by self write - by * read - - >- - to dn.subtree="cn=kerberos,{{ basedn }}" - by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read - by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write - by * none - - >- - to attrs=krbPrincipalName,krbLastPwdChange,krbPrincipalKey,krbExtraData - by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read - by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write - by self read - by * auth - - >- - to * - by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write - by * read - ordered: true - state: exact - when: not krb5kdc.stat.exists - -- name: add KDC indexes to LDAP - ldap_attrs: - dn: "olcDatabase={1}mdb,cn=config" - attributes: - olcDbIndex: - - objectClass eq - - cn,uid eq - - uidNumber,gidNumber eq - - member,memberUid eq - - krbPrincipalName pres,sub,eq - state: exact - when: not krb5kdc.stat.exists - -- name: add AuthzRegexp to map access via kerberos/GSSAPI - ldap_attrs: - dn: "cn=config" - attributes: - olcAuthzRegexp: - - "{0}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=people,{{ basedn }}" - - "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}" - state: exact - -- name: prepare password for kdc # noqa risky-shell-pipe - shell: - >- - echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | - xxd -g0 -ps -c 256 | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile ; - chmod 0600 /etc/krb5kdc/service.keyfile - no_log: true - when: not krb5kdc.stat.exists - -- name: prepare password for kadmin # noqa risky-shell-pipe - shell: - >- - echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | - xxd -g0 -ps -c 256 | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile ; - chmod 0600 /etc/krb5kdc/service.keyfile - no_log: true - when: not krb5kdc.stat.exists - -- name: dump kdc master password - shell: - >- - echo -n "{{ kdc_master_pwd }}" > "{{ kdc_master_pwd_file }}" ; - chmod 0600 "{{ kdc_master_pwd_file }}" - no_log: true - when: not krb5kdc.stat.exists - -- name: initialize KDC - command: - >- - kdb5_ldap_util - -D cn=admin,"{{ basedn }}" - -w "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" - -H ldapi:/// - create -s -subtrees "{{ basedn }}" - -P "{{ kdc_master_pwd }}" - -r "{{ ansible_domain | upper }}" - no_log: true - notify: "restart krb5-kdc" - when: not krb5kdc.stat.exists - -- name: add root/admin as kadmin - command: kadmin.local -q 'addprinc -pw "{{ kadmin_pwd }}" root/admin' - when: not krb5kdc.stat.exists - -- name: dump kadmin password - shell: echo -n "{{ kadmin_pwd }}" > "{{ kadmin_pwd_file }}" ; chmod 0600 "{{ kadmin_pwd_file }}" - no_log: true - when: not krb5kdc.stat.exists - -- name: add default policy to silence warning when using kadmin - command: kadmin.local -q "add_policy default" - when: not krb5kdc.stat.exists - -- name: create machine principals - command: kadmin.local -q 'addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' - with_items: - - host - - ldap - - HTTP - when: not krb5kdc.stat.exists - -- name: add principal to the default keytab - command: kadmin.local -q 'ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' - with_items: - - host - - ldap - - HTTP - when: not krb5kdc.stat.exists - -- name: allow slapd to read the keytab - file: - path: /etc/krb5.keytab - owner: root - group: openldap - mode: '0640' - notify: restart slapd - -- name: "make 'kerberos' an alias hostname" - replace: - path: /etc/hosts - regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" - replace: '\1 kerberos' - when: not krb5kdc.stat.exists - -######################## - -- name: kerberize dummy user foo - command: kadmin.local -q 'add_principal -pw "{{ foo_pwd }}" -x dn="uid=foo,ou=people,{{ basedn }}" foo' - register: kerberize_result - changed_when: kerberize_result.stderr is not search('already exists while creating') - no_log: true - when: foo_pwd is defined and foo_pwd | length > 0 +###################################################### - name: allow services in firewalld firewalld: @@ -238,3 +25,10 @@ - kerberos - kadmin - kpasswd + +- name: kerberize dummy user foo + command: kadmin.local -q 'add_principal -pw "{{ foo_pwd }}" -x dn="uid=foo,ou=people,{{ basedn }}" foo' + register: kerberize_result + changed_when: kerberize_result.stderr is not search('already exists while creating') + no_log: true + when: foo_pwd is defined and foo_pwd | length > 0 diff --git a/roles/krb5kdcldap/tasks/setup.yml b/roles/krb5kdcldap/tasks/setup.yml new file mode 100644 index 0000000..158240a --- /dev/null +++ b/roles/krb5kdcldap/tasks/setup.yml @@ -0,0 +1,197 @@ +## Install and configure krb5-kdc-ldap. +--- +- name: prepare krb5.conf + template: + src: krb5.conf.j2 + dest: /etc/krb5.conf + mode: 0644 + +- name: make sure krb5kdc exists + file: + path: /etc/krb5kdc + state: directory + mode: 0755 + +- name: prepare kdc.conf + template: + src: kdc.conf.j2 + dest: /etc/krb5kdc/kdc.conf + mode: 0644 + +- name: prepare kadm5.acl + template: + src: kadm5.acl.j2 + dest: /etc/krb5kdc/kadm5.acl + mode: 0644 + notify: "restart krb5-admin-server" + +- name: install krb5-kdc-ldap and krb5-admin-server + apt: + name: + - krb5-kdc-ldap + - krb5-admin-server + state: latest # noqa package-latest + +- name: prepare kerberos.openldap.ldif + shell: gunzip -c /usr/share/doc/krb5-kdc-ldap/kerberos.openldap.ldif.gz > /etc/ldap/schema/kerberos.openldap.ldif + args: + creates: /etc/ldap/schema/kerberos.openldap.ldif + +- name: activate kerberos.openldap.ldif schema # noqa no-changed-when + command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/kerberos.openldap.ldif + +- name: make sure we have a kerberos container + ldap_entry: + dn: "cn=kerberos,{{ basedn }}" + objectClass: krbContainer + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + +- name: make sure we have a kdc object + ldap_entry: + dn: "cn=kdc,cn=kerberos,{{ basedn }}" + objectClass: + - organizationalRole + - simpleSecurityObject + attributes: + userPassword: "{{ kdc_service_pwd }}" + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + +- name: make sure we have a kadmin object + ldap_entry: + dn: "cn=kadmin,cn=kerberos,{{ basedn }}" + objectClass: + - organizationalRole + - simpleSecurityObject + attributes: + userPassword: "{{ kadmin_service_pwd }}" + bind_dn: "cn=admin,{{ basedn }}" + bind_pw: "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + +- name: modify ACLs to account for KDC + ldap_attrs: + dn: "olcDatabase={1}mdb,cn=config" + attributes: + olcAccess: + - >- + to attrs=userPassword + by self write + by anonymous auth + by * none + - >- + to attrs=shadowLastChange + by self write + by * read + - >- + to dn.subtree="cn=kerberos,{{ basedn }}" + by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by * none + - >- + to attrs=krbPrincipalName,krbLastPwdChange,krbPrincipalKey,krbExtraData + by dn.exact="cn=kdc,cn=kerberos,{{ basedn }}" read + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by self read + by * auth + - >- + to * + by dn.exact="cn=kadmin,cn=kerberos,{{ basedn }}" write + by * read + ordered: true + state: exact + +- name: add KDC indexes to LDAP + ldap_attrs: + dn: "olcDatabase={1}mdb,cn=config" + attributes: + olcDbIndex: + - objectClass eq + - cn,uid eq + - uidNumber,gidNumber eq + - member,memberUid eq + - krbPrincipalName pres,sub,eq + state: exact + +- name: add AuthzRegexp to map access via kerberos/GSSAPI + ldap_attrs: + dn: "cn=config" + attributes: + olcAuthzRegexp: + - "{0}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=people,{{ basedn }}" + - "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}" + state: exact + +- name: prepare password for kdc # noqa risky-shell-pipe no-changed-when + shell: + >- + echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | + xxd -g0 -ps -c 256 | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile ; + chmod 0600 /etc/krb5kdc/service.keyfile + no_log: true + +- name: prepare password for kadmin # noqa risky-shell-pipe no-changed-when + shell: + >- + echo "cn=kadmin,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kadmin_service_pwd }} | + xxd -g0 -ps -c 256 | sed 's/0a$//')" >> /etc/krb5kdc/service.keyfile ; + chmod 0600 /etc/krb5kdc/service.keyfile + no_log: true + +- name: dump kdc master password # noqa no-changed-when + shell: + >- + echo -n "{{ kdc_master_pwd }}" > "{{ kdc_master_pwd_file }}" ; + chmod 0600 "{{ kdc_master_pwd_file }}" + no_log: true + +- name: initialize KDC # noqa no-changed-when + command: + >- + kdb5_ldap_util + -D cn=admin,"{{ basedn }}" + -w "{{ ldap_admin_pwd['content'] | b64decode | replace('\n', '') }}" + -H ldapi:/// + create -s -subtrees "{{ basedn }}" + -P "{{ kdc_master_pwd }}" + -r "{{ ansible_domain | upper }}" + no_log: true + notify: "restart krb5-kdc" + +- name: add root/admin as kadmin # noqa no-changed-when + command: kadmin.local -q 'addprinc -pw "{{ kadmin_pwd }}" root/admin' + +- name: dump kadmin password # noqa no-changed-when + shell: echo -n "{{ kadmin_pwd }}" > "{{ kadmin_pwd_file }}" ; chmod 0600 "{{ kadmin_pwd_file }}" + no_log: true + +- name: add default policy to silence warning when using kadmin # noqa no-changed-when + command: kadmin.local -q "add_policy default" + +- name: create machine principals # noqa no-changed-when + command: kadmin.local -q 'addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' + with_items: + - host + - ldap + - HTTP + +- name: add principal to the default keytab # noqa no-changed-when + command: kadmin.local -q 'ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}' + with_items: + - host + - ldap + - HTTP + +- name: allow slapd to read the keytab + file: + path: /etc/krb5.keytab + owner: root + group: openldap + mode: '0640' + notify: restart slapd + +- name: "make 'kerberos' an alias hostname" + replace: + path: /etc/hosts + regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$" + replace: '\1 kerberos' From a5e143b9001f1c7fb66ec4e2c27e09c0aa4c6e79 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 22:59:38 +0200 Subject: [PATCH 210/504] Fix bind configuration. --- roles/dnsdhcptftp/tasks/main.yml | 21 ++++++++----------- .../templates/{db.intern.j2 => db.RR.j2} | 0 .../templates/{db.lan.j2 => db.RRinv.j2} | 0 roles/dnsdhcptftp/templates/dhcpd.conf.j2 | 2 +- roles/dnsdhcptftp/templates/localzones.j2 | 6 +++--- roles/firewalld2if/tasks/main.yml | 2 +- 6 files changed, 14 insertions(+), 17 deletions(-) rename roles/dnsdhcptftp/templates/{db.intern.j2 => db.RR.j2} (100%) rename roles/dnsdhcptftp/templates/{db.lan.j2 => db.RRinv.j2} (100%) diff --git a/roles/dnsdhcptftp/tasks/main.yml b/roles/dnsdhcptftp/tasks/main.yml index 623741f..8eb02e3 100644 --- a/roles/dnsdhcptftp/tasks/main.yml +++ b/roles/dnsdhcptftp/tasks/main.yml @@ -39,19 +39,16 @@ - name: deploy config files for bind9 template: - src: "{{ item }}.j2" - dest: "/etc/bind/{{ item }}" + src: "{{ item.src }}.j2" + dest: "/etc/bind/{{ item.dest }}" mode: 0644 loop: - - db.intern - - localzones - notify: restart bind - -- name: deploy config files for bind9 - special case where template destination filename is dynamic - template: - src: db.lan.j2 - dest: "/etc/bind/db.{{ ipaddr_lan_threeoct }}" - mode: 0644 + - src: db.RR + dest: "db.{{ ansible_domain }}" + - src: db.RRinv + dest: "db.{{ ipaddr_lan_threeoct }}" + - src: localzones + dest: localzones notify: restart bind - name: link zone files to writeable directory for DDNS @@ -60,7 +57,7 @@ dest: "/var/lib/bind/{{ item }}" state: link loop: - - db.intern + - "db.{{ ansible_domain }}" - "db.{{ ipaddr_lan_threeoct }}" notify: restart bind diff --git a/roles/dnsdhcptftp/templates/db.intern.j2 b/roles/dnsdhcptftp/templates/db.RR.j2 similarity index 100% rename from roles/dnsdhcptftp/templates/db.intern.j2 rename to roles/dnsdhcptftp/templates/db.RR.j2 diff --git a/roles/dnsdhcptftp/templates/db.lan.j2 b/roles/dnsdhcptftp/templates/db.RRinv.j2 similarity index 100% rename from roles/dnsdhcptftp/templates/db.lan.j2 rename to roles/dnsdhcptftp/templates/db.RRinv.j2 diff --git a/roles/dnsdhcptftp/templates/dhcpd.conf.j2 b/roles/dnsdhcptftp/templates/dhcpd.conf.j2 index 9bb803c..1096ab3 100644 --- a/roles/dnsdhcptftp/templates/dhcpd.conf.j2 +++ b/roles/dnsdhcptftp/templates/dhcpd.conf.j2 @@ -21,7 +21,7 @@ ddns-update-style standard; include "/etc/dhcp/rndc.key"; -zone intern. { +zone {{ ansible_domain }}. { primary 127.0.0.1; key rndc-key; } diff --git a/roles/dnsdhcptftp/templates/localzones.j2 b/roles/dnsdhcptftp/templates/localzones.j2 index 7cd8cb9..e71d0a7 100644 --- a/roles/dnsdhcptftp/templates/localzones.j2 +++ b/roles/dnsdhcptftp/templates/localzones.j2 @@ -8,10 +8,10 @@ zone "{{ ipaddr_lan_ptr[:-1] }}" { allow-update { key rndc-key; }; }; -zone "intern" { +zone "{{ ansible_domain }}" { type master; notify no; - file "/etc/bind/db.intern"; - journal "/var/lib/bind/db.intern.jnl"; + file "/etc/bind/db.{{ ansible_domain }}"; + journal "/var/lib/bind/db.{{ ansible_domain }}.jnl"; allow-update { key rndc-key; }; }; diff --git a/roles/firewalld2if/tasks/main.yml b/roles/firewalld2if/tasks/main.yml index c21b90c..3147677 100644 --- a/roles/firewalld2if/tasks/main.yml +++ b/roles/firewalld2if/tasks/main.yml @@ -33,7 +33,7 @@ immediate: true when: not run_in_installer|default(false)|bool -- name: add LAN interface to zone intern +- name: add LAN interface to internal zone firewalld: zone: internal interface: "{{ if_lan }}" From ec66744db4dafd423a205bfc95f545af75255bc8 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Mon, 13 Jun 2022 23:02:29 +0200 Subject: [PATCH 211/504] Fix sambox. --- roles/sambaldap/defaults/main.yml | 2 +- roles/sambaldap/tasks/main.yml | 64 +++++++++++++++++-------------- sambox.yml | 6 +-- 3 files changed, 37 insertions(+), 35 deletions(-) diff --git a/roles/sambaldap/defaults/main.yml b/roles/sambaldap/defaults/main.yml index 37ab18a..575579c 100644 --- a/roles/sambaldap/defaults/main.yml +++ b/roles/sambaldap/defaults/main.yml @@ -1,4 +1,4 @@ basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" -ldap_server: sambox +ldap_server: ldap min_id_sssd: 5000 max_id_sssd: 20000 diff --git a/roles/sambaldap/tasks/main.yml b/roles/sambaldap/tasks/main.yml index b67b891..ce96c14 100644 --- a/roles/sambaldap/tasks/main.yml +++ b/roles/sambaldap/tasks/main.yml @@ -18,9 +18,6 @@ mode: 0600 notify: restart sssd -- name: flush all handlers - meta: flush_handlers - - name: prepare samba schema command: cp /usr/share/doc/samba/examples/LDAP/samba.ldif /etc/ldap/schema/ args: @@ -33,39 +30,40 @@ - name: add indexes to LDAP ldap_attrs: dn: "olcDatabase={1}mdb,cn=config" - name: olcDbIndex - values: - - sambaSID eq - - sambaPrimaryGroupSID eq - - sambaGroupType eq - - sambaSIDList eq - - sambaDomainName eq + attributes: + olcDbIndex: + - sambaSID eq + - sambaPrimaryGroupSID eq + - sambaGroupType eq + - sambaSIDList eq + - sambaDomainName eq state: present - name: modify ACLs to account for Samba ldap_attrs: dn: "olcDatabase={1}mdb,cn=config" - name: olcAccess - values: - - >- - to attrs=userPassword - by self write - by anonymous auth - by * none - - >- - to attrs=shadowLastChange - by self write - by * read - - >- - to attrs=sambaNTPassword - by dn.exact=cn=admin,{{ basedn }} write - by self write - by * none - - >- - to * by * read + attributes: + olcAccess: + - >- + to attrs=userPassword + by self write + by anonymous auth + by * none + - >- + to attrs=shadowLastChange + by self write + by * read + - >- + to attrs=sambaNTPassword + by dn.exact=cn=admin,{{ basedn }} write + by self write + by * none + - >- + to * by * read + ordered: true state: exact -- name: customize smb.conf +- name: configure smb ldap backend blockinfile: dest: /etc/samba/smb.conf insertafter: '^\s*server role =' @@ -82,6 +80,14 @@ ldap passwd sync = yes notify: restart smbd +- name: make smb homes writable + replace: + path: /etc/samba/smb.conf + regexp: '^(\s*read only =) yes$' + replace: '\1 no' + after: '\[homes\]' + before: '\[.+\]' + notify: restart smbd - name: slurp admin password for samba setup slurp: diff --git a/sambox.yml b/sambox.yml index 9954225..6bf8c04 100644 --- a/sambox.yml +++ b/sambox.yml @@ -3,7 +3,6 @@ ## to the installer boot parameters to set hostname and domain. ## - - name: apply configuration to the sambox server hosts: all remote_user: ansible @@ -26,14 +25,13 @@ in_inventory: 192.168.0.[50:150] di_dist: "{{ ansible_distribution_release }}" - di_version: 10 # "{{ ansible_distribution_major_version }}" + di_version: "{{ ansible_distribution_major_version }}" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" ansible_user: ansible repo_dir: "/home/{{ ansible_user }}/debian-lan" ansible_python_interpreter: "/usr/bin/python3" ## needed for firewalld module - vars_prompt: - name: "foo_pwd" prompt: @@ -42,14 +40,12 @@ just continue private: true - pre_tasks: - name: validate if interfaces are available fail: msg: "Interfaces {{ ansible_interfaces }} found. WAN: '{{ if_wan }}', LAN: '{{ if_lan }}'. Two NICs needed." when: (if_lan not in ansible_interfaces) or (if_wan not in ansible_interfaces) or (if_lan == if_wan) - roles: - up2date_debian - firewalld2if From 06973c015b0e2d064e1de2f2b07cd0a1c6f9d659 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Tue, 14 Jun 2022 10:41:21 +0200 Subject: [PATCH 212/504] Fix sambox-client. --- README | 9 ++++++--- roles/smbsshfsclient/defaults/main.yml | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/README b/README index 37fff9c..9760129 100644 --- a/README +++ b/README @@ -19,6 +19,9 @@ offers ansible playbooks and instructions for the following machines: • kerberox-client: the client for the kerberized LAN + • sambox and -client: comparable to the kerberox setup, but + home directories are shared via sshfs or the smb protocol. + • cloudbox: nextcloud server in the basement - setup of a home cloud server - dynamic DNS name @@ -31,7 +34,7 @@ offers ansible playbooks and instructions for the following machines: - reasonable defaults - temporary home directory on tmpfs, reset at boot - • edubox: deploy a set of containers for teaching (edubox.yml) + • edubox: deploy a set of containers for training/teaching Contributions like patches, suggestions, pull requests and/or further profiles are highly appreciated! @@ -56,8 +59,8 @@ Installbox • the installbox can be used to install all other profiles -Kerberox -~~~~~~~~ +Kerberox, Sambox +~~~~~~~~~~~~~~~~ • standard Debian installation: - user 'ansible' in sudo group - WAN interface configured and connected diff --git a/roles/smbsshfsclient/defaults/main.yml b/roles/smbsshfsclient/defaults/main.yml index 19fe2da..d2c6c70 100644 --- a/roles/smbsshfsclient/defaults/main.yml +++ b/roles/smbsshfsclient/defaults/main.yml @@ -1,4 +1,4 @@ -basedn: "{{ 'dc=' + ( ansible_dns['domain'] | default('intern') | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" +basedn: "{{ 'dc=' + ( ansible_domain | replace('^.','') | replace('.$','') | replace('.',',dc=')) }}" ldap_server: ldap home_server: homes min_id_sssd: 5000 From d7d767fea96c7389cd41f4dd3c197651fda7a150 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 18 Jun 2022 09:35:59 +0200 Subject: [PATCH 213/504] Improvements sambox-client. --- roles/netbootinstaller/tasks/main.yml | 2 ++ roles/sambaldap/tasks/main.yml | 9 +++++++++ roles/smbsshfsclient/tasks/main.yml | 11 +++++++++-- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/roles/netbootinstaller/tasks/main.yml b/roles/netbootinstaller/tasks/main.yml index 4902791..1296b0b 100644 --- a/roles/netbootinstaller/tasks/main.yml +++ b/roles/netbootinstaller/tasks/main.yml @@ -9,6 +9,7 @@ name: - di-netboot-assistant - "{{ di_pkg }}" + state: latest # noqa package-latest notify: - bind mount images - rebuild di-netboot-assistant menu @@ -26,3 +27,4 @@ path: /etc/hosts regexp: '^(127\.0\.1\.1.*)$' replace: '#\1\n{{ ipaddr_lan | ipaddr("address") }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}' + when: ipaddr_lan is defined diff --git a/roles/sambaldap/tasks/main.yml b/roles/sambaldap/tasks/main.yml index ce96c14..3176861 100644 --- a/roles/sambaldap/tasks/main.yml +++ b/roles/sambaldap/tasks/main.yml @@ -89,6 +89,15 @@ before: '\[.+\]' notify: restart smbd +- name: make smb homes writable + replace: + path: /etc/samba/smb.conf + regexp: '^(\s*create mask =) 0700' + replace: '\1 0600' + after: '\[homes\]' + before: '\[.+\]' + notify: restart smbd + - name: slurp admin password for samba setup slurp: src: "{{ ldap_admin_pwd_file }}" diff --git a/roles/smbsshfsclient/tasks/main.yml b/roles/smbsshfsclient/tasks/main.yml index 4dcf1e1..922c34d 100644 --- a/roles/smbsshfsclient/tasks/main.yml +++ b/roles/smbsshfsclient/tasks/main.yml @@ -6,6 +6,7 @@ - libpam-mount - cifs-utils - sshfs + - hxtools state: latest # noqa package-latest - name: add URI to ldap.conf @@ -32,7 +33,7 @@ mode: 0600 notify: restart sssd -- name: configure pam_mount +- name: configure pam_mount # interesting options: posix,mfsymlinks,nomapposix,noperm blockinfile: dest: /etc/security/pam_mount.conf.xml block: | @@ -41,7 +42,7 @@ server="{{ home_server }}" path="%(USER)" mountpoint="/home/lan/%(USER)" - options="dir_mode=0750,file_mode=0640" + options="idsfromsid,modefromsid,mfsymlinks" >rootansibleDebian-gdm rootansibleDebian-gdm insertafter: "" +- name: make sure umount is not blocked + replace: + path: /etc/security/pam_mount.conf.xml + regexp: '' + - name: make sure .ssh exists file: path: /root/.ssh From de2a473cde4b428de0d5f8e4936bdedf75a13de7 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 25 Jun 2022 10:15:19 +0200 Subject: [PATCH 214/504] Implement livebox. --- livebox.yml | 67 ++++++++++++++++++ roles/aptcacher/tasks/main.yml | 8 ++- roles/debianlive/handlers/main.yml | 10 +++ roles/debianlive/tasks/main.yml | 106 +++++++++++++++++++++++++++++ roles/sambaldap/tasks/main.yml | 2 +- 5 files changed, 190 insertions(+), 3 deletions(-) create mode 100644 livebox.yml create mode 100644 roles/debianlive/handlers/main.yml create mode 100644 roles/debianlive/tasks/main.yml diff --git a/livebox.yml b/livebox.yml new file mode 100644 index 0000000..4f229fd --- /dev/null +++ b/livebox.yml @@ -0,0 +1,67 @@ +## This playbook deploys the LiveBox. +## +## The LiveBox provides Debian Live and Installer images on top +## of an already existing network with minimal modifications to +## existing infrastructure. It does not provide DHCP; the idea +## is to chainload the LiveBox' menu (iPXE or Grub) from PXE +## infrastructure already in place. +## +## To chainload the LiveBox in iPXE use: +## > item livebox Chainload Menu from LiveBox +## > … +## > :livebox chain tftp://livebox.lan/d-i/n-a/menu.ipxe +## +## To chainload the LiveBox in Grub use: +## > menuentry 'Chainload Menu from LiveBox' { +## > configfile (tftp,livebox.lan)/d-i/n-a/grub/grub.cfg +## > } +--- +- name: apply configuration to the livebox + hosts: all + remote_user: ansible + become: true + + vars: + extra_pkgs: + - lighttpd + - nfs-kernel-server + extra_pkgs_bpo: + - atftpd + - di-netboot-assistant + + live_images: + - iso: 'debian-live-11.3.0-amd64-gnome+nonfree.iso' + name: 'gnome' + - iso: 'debian-live-11.3.0-amd64-kde+nonfree.iso' + name: 'kde' + - iso: 'debian-live-11.3.0-amd64-standard+nonfree.iso' + name: 'standard-cli' + live_url: 'https://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/11.3.0-live+nonfree/amd64/iso-hybrid/' + di_dist: "{{ ansible_distribution_release }}" + di_version: "{{ ansible_distribution_major_version }}" + di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" + boot_params: + - boot=live + - netboot=nfs + - components + - locales=de_DE.UTF-8 + - keyboard-layouts=de + - quiet + - splash +# - noroot + + ansible_python_interpreter: "/usr/bin/python3" + + pre_tasks: + - name: preseed atftpd + debconf: + name: atftpd + question: atftpd/basedir + value: /var/lib/tftpboot + vtype: string + + roles: + - up2date_debian + - netbootinstaller + - aptcacher + - debianlive diff --git a/roles/aptcacher/tasks/main.yml b/roles/aptcacher/tasks/main.yml index 01b745d..64f56ed 100644 --- a/roles/aptcacher/tasks/main.yml +++ b/roles/aptcacher/tasks/main.yml @@ -23,6 +23,10 @@ replace: 'd-i mirror/http/proxy string http://{{ ansible_hostname }}:3142/' when: preseedcfg.stat.exists +- name: test if firewalld is available + stat: path=/usr/sbin/firewalld + register: firewalld + - name: allow apt-cacher-ng service in firewalld firewalld: zone: internal @@ -30,11 +34,11 @@ permanent: true immediate: true state: enabled - when: not run_in_installer|default(false)|bool + when: not run_in_installer|default(false)|bool and firewalld.stat.exists - name: allow apt-cacher-ng service in firewalld, offline command: "firewall-offline-cmd --zone=internal --add-port=3142/tcp" - when: run_in_installer|default(false)|bool + when: run_in_installer|default(false)|bool and firewalld.stat.exists - name: flush handler to make apt-cacher available meta: flush_handlers diff --git a/roles/debianlive/handlers/main.yml b/roles/debianlive/handlers/main.yml new file mode 100644 index 0000000..affc752 --- /dev/null +++ b/roles/debianlive/handlers/main.yml @@ -0,0 +1,10 @@ +--- +- name: rebuild di-netboot assistant menu + command: + cmd: di-netboot-assistant rebuild-menu + listen: rebuild di-netboot menu + +- name: export nfs + command: + cmd: exportfs -ra + listen: export nfs diff --git a/roles/debianlive/tasks/main.yml b/roles/debianlive/tasks/main.yml new file mode 100644 index 0000000..23dcd11 --- /dev/null +++ b/roles/debianlive/tasks/main.yml @@ -0,0 +1,106 @@ +--- +- name: download debian-live images + get_url: + url: "{{ live_url }}{{ item.iso }}" + dest: "/var/cache/di-netboot-assistant/{{ item.iso }}" + checksum: "sha256:{{ live_url }}/SHA256SUMS" + loop: + "{{ live_images }}" + +- name: prepare live image directory + file: + path: "/var/lib/tftpboot/d-i/n-live/{{ item.name }}" + state: directory + mode: 0755 + loop: + "{{ live_images }}" + +- name: loop mount iso images + mount: + path: "/var/lib/tftpboot/d-i/n-live/{{ item.name }}" + src: "/var/cache/di-netboot-assistant/{{ item.iso }}" + fstype: iso9660 + opts: loop,ro,nofail + state: mounted + loop: + "{{ live_images }}" + notify: rebuild di-netboot menu + +- name: prepare http downloads + file: + src: "/var/lib/tftpboot/d-i/" + dest: "/var/www/html/d-i" + state: link + +- name: export live image squashfs + lineinfile: + path: /etc/exports + line: "/var/lib/tftpboot/d-i/n-live/ *(ro,crossmnt,no_subtree_check)" + notify: export nfs + +- name: configure ipxe boot menu address + replace: + path: /etc/di-netboot-assistant/ipxemenu.HEAD + regexp: '^(set 210:string tftp://\${next-server}/)$' + replace: '#\1\nset 210:string http://{{ ansible_default_ipv4.address }}/' + notify: rebuild di-netboot menu + +- name: configure grub boot menu addresses + lineinfile: + path: /etc/di-netboot-assistant/grub.cfg.HEAD + line: "{{ item }}" + loop: + - "set root=(http,{{ ansible_default_ipv4.address }})" + - "set pxe_default_server={{ ansible_default_ipv4.address }}" + notify: rebuild di-netboot menu + +- name: prepare debian live nfs boot entry title + lineinfile: + path: /etc/di-netboot-assistant/ipxemenu.HEAD + insertafter: '^menu iPXE Boot Menu' + line: "item {{ item.name }} Debian GNU/Linux {{ item.name }} NFS" + loop: + "{{ live_images }}" + notify: rebuild di-netboot menu + +- name: find kernel version + shell: + cmd: >- + basename /var/lib/tftpboot/d-i/n-live/{{ item.name }}/live/vmlinuz* + | sed "s/vmlinuz-//" + register: images + changed_when: false + loop: + "{{ live_images }}" + +- name: prepare debian live boot loader ipxe + blockinfile: + path: /etc/di-netboot-assistant/ipxemenu.HEAD + marker: "# {mark} ANSIBLE MANAGED BLOCK {{ item.item.name }}" + block: | + :{{ item.item.name }} + echo Booting Debian GNU/Linux {{ item.item.name }} + kernel ${210:string}d-i/n-live/{{ item.item.name }}/live/vmlinuz-{{ item.stdout }} \ + initrd=initrd.img-5.10.0-13-amd64 {{ boot_params|join(' ') }} \ + nfsroot={{ ansible_default_ipv4.address }}:/var/lib/tftpboot/d-i/n-live/{{ item.item.name }}/ + initrd ${210:string}d-i/n-live/{{ item.item.name }}/live/initrd.img-{{ item.stdout }} + boot + loop: + "{{ images.results }}" + notify: rebuild di-netboot menu + +- name: prepare debian live boot loader grub + blockinfile: + path: /etc/di-netboot-assistant/grub.cfg.HEAD + insertbefore: "^menuentry 'Boot from local disk..'" + marker: "# {mark} ANSIBLE MANAGED BLOCK {{ item.item.name }}" + block: | + menuentry 'Debian GNU/Linux Live {{ item.item.name }}' { + linux (http,{{ ansible_default_ipv4.address }})/d-i/n-live/{{ item.item.name }}/live/vmlinuz-{{ item.stdout }} \ + {{ boot_params|join(' ') }} \ + nfsroot={{ ansible_default_ipv4.address }}:/var/lib/tftpboot/d-i/n-live/{{ item.item.name }}/ + initrd (http,{{ ansible_default_ipv4.address }})/d-i/n-live/{{ item.item.name }}/live/initrd.img-{{ item.stdout }} + } + loop: + "{{ images.results }}" + notify: rebuild di-netboot menu diff --git a/roles/sambaldap/tasks/main.yml b/roles/sambaldap/tasks/main.yml index 3176861..846bf69 100644 --- a/roles/sambaldap/tasks/main.yml +++ b/roles/sambaldap/tasks/main.yml @@ -89,7 +89,7 @@ before: '\[.+\]' notify: restart smbd -- name: make smb homes writable +- name: modify samba default create mask replace: path: /etc/samba/smb.conf regexp: '^(\s*create mask =) 0700' From 64385851281791405185a559bc0f58da2ccd69ea Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sat, 25 Jun 2022 10:11:57 +0200 Subject: [PATCH 215/504] Experimental IPv6 installbox. --- installbox6.yml | 36 +++++++++++++++++ roles/dhcp6radvdatftp/handlers/main.yml | 20 ++++++++++ roles/dhcp6radvdatftp/tasks/main.yml | 39 +++++++++++++++++++ .../templates/kea-dhcp6.conf.j2 | 20 ++++++++++ roles/dhcp6radvdatftp/templates/radvd.conf.j2 | 10 +++++ 5 files changed, 125 insertions(+) create mode 100644 installbox6.yml create mode 100644 roles/dhcp6radvdatftp/handlers/main.yml create mode 100644 roles/dhcp6radvdatftp/tasks/main.yml create mode 100644 roles/dhcp6radvdatftp/templates/kea-dhcp6.conf.j2 create mode 100644 roles/dhcp6radvdatftp/templates/radvd.conf.j2 diff --git a/installbox6.yml b/installbox6.yml new file mode 100644 index 0000000..dc66943 --- /dev/null +++ b/installbox6.yml @@ -0,0 +1,36 @@ +--- +## This playbook deploys the installbox6. Add 'hostname=XXX' and +## 'domain=YYY' to the installer boot parameters to set hostname and +## domain. + +## FIXME: works only on bookworm (kea-dhcp6, atftpd) + +- name: apply configuration to the installbox6 + hosts: all + remote_user: ansible + become: true + + vars: + ## This interface provides the default route: + if_lan: "{{ ansible_default_ipv4.interface }}" + prefix: '2001:db8:b001::/64' + + ## Find the IPv6 address: FIXME: not needed anymore? + ipv6_lan: "{{ prefix | ipaddr('address') | slaac(ansible_default_ipv4.macaddress) }}" + + di_dist: "{{ ansible_distribution_release }}" + di_version: 11 # "{{ ansible_distribution_major_version }}" + di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" + + extra_pkgs: [binutils] # FIXME: missing dependency in di-netboot-assistant + + ansible_user: ansible + repo_dir: "/home/{{ ansible_user }}/debian-lan" + ansible_python_interpreter: "/usr/bin/python3" ## needed for firewalld module + + roles: + - up2date_debian + - dhcp6radvdatftpd + - netbootinstaller + - aptcacher + - prepare4clients diff --git a/roles/dhcp6radvdatftp/handlers/main.yml b/roles/dhcp6radvdatftp/handlers/main.yml new file mode 100644 index 0000000..897fb0d --- /dev/null +++ b/roles/dhcp6radvdatftp/handlers/main.yml @@ -0,0 +1,20 @@ +--- +- name: restart radvd + systemd: + name: radvd.service + state: restarted + enabled: true + listen: restart radvd + +- name: restart kea-dhcp6-server + systemd: + name: kea-dhcp6-server.service + state: restarted + enabled: true + listen: restart kea-dhcp6-server + +- name: restart network interfaces + systemd: + name: networking + state: restarted + listen: reconfigure network diff --git a/roles/dhcp6radvdatftp/tasks/main.yml b/roles/dhcp6radvdatftp/tasks/main.yml new file mode 100644 index 0000000..17ecd17 --- /dev/null +++ b/roles/dhcp6radvdatftp/tasks/main.yml @@ -0,0 +1,39 @@ +## DHCPv6, RAs and TFTP +--- +- name: preseed aftpd + debconf: + name: atftpd + question: atftpd/basedir + value: /var/lib/tftpboot + vtype: string + +- name: install di-netboot-assistant and installer package + apt: + name: + - kea-dhcp6-server + - radvd + - atftpd + state: latest # noqa package-latest + +- name: configure radvd + template: + src: radvd.conf.j2 + dest: /etc/radvd.conf + mode: 0644 + notify: restart radvd + +- name: configure kea-dhcp-server + template: + src: kea-dhcp6.conf.j2 + dest: /etc/kea/kea-dhcp6.conf + mode: 0644 + notify: restart kea-dhcp6-server + +- name: set IPv6 address on interface + blockinfile: + path: /etc/network/interfaces + block: | + allow-hotplug {{ if_lan }} + iface {{ if_lan }} inet6 static + address 2001:db8:b001::1/64 + notify: reconfigure network diff --git a/roles/dhcp6radvdatftp/templates/kea-dhcp6.conf.j2 b/roles/dhcp6radvdatftp/templates/kea-dhcp6.conf.j2 new file mode 100644 index 0000000..305bde1 --- /dev/null +++ b/roles/dhcp6radvdatftp/templates/kea-dhcp6.conf.j2 @@ -0,0 +1,20 @@ +{ + "Dhcp6": { + "interfaces-config": { + "interfaces": [ "{{ if_lan }}" ] + }, + "option-data": [ + { + "name": "bootfile-url", + "data": "tftp://[2001:db8:b001::1]/d-i/n-a/grubx64.efi" + } + ], + "subnet6": [ + { + "subnet": "2001:db8:b001::/64", + "pools": [ { "pool": "2001:db8:b001::2 - 2001:db8:b001::ffff" } ], + "interface": "enp1s0" + } + ] + } +} diff --git a/roles/dhcp6radvdatftp/templates/radvd.conf.j2 b/roles/dhcp6radvdatftp/templates/radvd.conf.j2 new file mode 100644 index 0000000..2d52dc2 --- /dev/null +++ b/roles/dhcp6radvdatftp/templates/radvd.conf.j2 @@ -0,0 +1,10 @@ +interface {{ if_lan }} +{ + AdvSendAdvert on; + AdvManagedFlag on; + AdvOtherConfigFlag on; + + prefix {{ prefix }} + { + }; +}; From 829b8b4d3bba42ebe0a83f60ca80087a2dea0244 Mon Sep 17 00:00:00 2001 From: "Andreas B. Mundt" Date: Sun, 26 Jun 2022 09:03:26 +0200 Subject: [PATCH 216/504] Implement livebox gnome-edu image build. --- livebox.yml | 8 + roles/debianlive/tasks/main.yml | 13 +- roles/edulive/defaults/main.yml | 1 + roles/edulive/files/gnome-edu/README | 2 + roles/edulive/files/gnome-edu/auto/build | 5 + roles/edulive/files/gnome-edu/auto/clean | 10 ++ roles/edulive/files/gnome-edu/auto/config | 18 +++ .../hooks/0001-plymouth-theme.hook.chroot | 8 + .../live/0010-disable-kexec-tools.hook.chroot | 1 + .../0050-disable-sysvinit-tmpfs.hook.chroot | 1 + .../hooks/live/0500-desktop.hook.chroot | 15 ++ .../hooks/live/0600-wireshark.hook.chroot | 5 + .../0020-create-mtab-symlink.hook.chroot | 1 + .../normal/0030-enable-cryptsetup.hook.chroot | 1 + .../0040-create-locales-files.hook.chroot | 1 + ...0-remove-adjtime-configuration.hook.chroot | 1 + .../0110-remove-backup-files.hook.chroot | 1 + .../0120-remove-dbus-machine-id.hook.chroot | 1 + .../0130-remove-gnome-icon-cache.hook.chroot | 1 + .../normal/0140-remove-log-files.hook.chroot | 1 + ...150-remove-mdadm-configuration.hook.chroot | 1 + ...emove-openssh-server-host-keys.hook.chroot | 1 + .../normal/0170-remove-python-py.hook.chroot | 1 + ...0180-remove-systemd-machine-id.hook.chroot | 1 + .../0190-remove-temporary-files.hook.chroot | 1 + .../0195-remove-ssl-cert-snakeoil.hook.chroot | 1 + ...emove-udev-persistent-cd-rules.hook.chroot | 1 + ...move-udev-persistent-net-rules.hook.chroot | 1 + .../0400-update-apt-file-cache.hook.chroot | 1 + .../0410-update-apt-xapian-index.hook.chroot | 1 + .../0420-update-glx-alternative.hook.chroot | 1 + .../0430-update-mlocate-database.hook.chroot | 1 + ...0440-update-nvidia-alternative.hook.chroot | 1 + .../0500-reproducible-glibc.hook.chroot | 1 + .../etc/dconf/db/gdm.d/00-login-screen | 8 + .../etc/dconf/db/local.d/defaults | 34 ++++ .../includes.chroot/etc/dconf/profile/gdm | 3 + .../includes.chroot/etc/dconf/profile/user | 2 + .../etc/libvirt/qemu/netboot.xml | 151 ++++++++++++++++++ .../qemu/networks/autostart/default.xml | 1 + .../qemu/networks/autostart/intern.xml | 1 + .../etc/libvirt/qemu/networks/intern.xml | 14 ++ .../includes.chroot/etc/sysctl.d/sysctl.conf | 3 + .../lib/live/config/0001-VM-MAC | 11 ++ .../config/package-lists/desktop.list.chroot | 11 ++ .../package-lists/live-systems.list.chroot | 2 + .../config/package-lists/live.list.chroot | 3 + .../package-lists/localization.list.chroot | 2 + .../config/package-lists/school.list.chroot | 100 ++++++++++++ .../config/package-lists/standard.list.chroot | 4 + .../config/preseed/wireshark.cfg.chroot | 1 + roles/edulive/handlers/main.yml | 5 + roles/edulive/tasks/main.yml | 66 ++++++++ roles/edulive/templates/livebuilder.sh | 27 ++++ roles/edulive/templates/main.yml | 54 +++++++ 55 files changed, 608 insertions(+), 4 deletions(-) create mode 100644 roles/edulive/defaults/main.yml create mode 100644 roles/edulive/files/gnome-edu/README create mode 100755 roles/edulive/files/gnome-edu/auto/build create mode 100755 roles/edulive/files/gnome-edu/auto/clean create mode 100755 roles/edulive/files/gnome-edu/auto/config create mode 100755 roles/edulive/files/gnome-edu/config/hooks/0001-plymouth-theme.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/live/0010-disable-kexec-tools.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/live/0050-disable-sysvinit-tmpfs.hook.chroot create mode 100755 roles/edulive/files/gnome-edu/config/hooks/live/0500-desktop.hook.chroot create mode 100755 roles/edulive/files/gnome-edu/config/hooks/live/0600-wireshark.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0020-create-mtab-symlink.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0030-enable-cryptsetup.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0040-create-locales-files.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0100-remove-adjtime-configuration.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0110-remove-backup-files.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0120-remove-dbus-machine-id.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0130-remove-gnome-icon-cache.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0140-remove-log-files.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0150-remove-mdadm-configuration.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0160-remove-openssh-server-host-keys.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0170-remove-python-py.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0180-remove-systemd-machine-id.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0190-remove-temporary-files.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0195-remove-ssl-cert-snakeoil.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0200-remove-udev-persistent-cd-rules.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0300-remove-udev-persistent-net-rules.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0400-update-apt-file-cache.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0410-update-apt-xapian-index.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0420-update-glx-alternative.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0430-update-mlocate-database.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0440-update-nvidia-alternative.hook.chroot create mode 120000 roles/edulive/files/gnome-edu/config/hooks/normal/0500-reproducible-glibc.hook.chroot create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/gdm.d/00-login-screen create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/local.d/defaults create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/gdm create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/user create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/netboot.xml create mode 120000 roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/networks/autostart/default.xml create mode 120000 roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/networks/autostart/intern.xml create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/networks/intern.xml create mode 100644 roles/edulive/files/gnome-edu/config/includes.chroot/etc/sysctl.d/sysctl.conf create mode 100755 roles/edulive/files/gnome-edu/config/includes.chroot/lib/live/config/0001-VM-MAC create mode 100644 roles/edulive/files/gnome-edu/config/package-lists/desktop.list.chroot create mode 100644 roles/edulive/files/gnome-edu/config/package-lists/live-systems.list.chroot create mode 100644 roles/edulive/files/gnome-edu/config/package-lists/live.list.chroot create mode 100644 roles/edulive/files/gnome-edu/config/package-lists/localization.list.chroot create mode 100644 roles/edulive/files/gnome-edu/config/package-lists/school.list.chroot create mode 100644 roles/edulive/files/gnome-edu/config/package-lists/standard.list.chroot create mode 100644 roles/edulive/files/gnome-edu/config/preseed/wireshark.cfg.chroot create mode 100644 roles/edulive/handlers/main.yml create mode 100644 roles/edulive/tasks/main.yml create mode 100644 roles/edulive/templates/livebuilder.sh create mode 100644 roles/edulive/templates/main.yml diff --git a/livebox.yml b/livebox.yml index 4f229fd..771607b 100644 --- a/livebox.yml +++ b/livebox.yml @@ -15,6 +15,7 @@ ## > menuentry 'Chainload Menu from LiveBox' { ## > configfile (tftp,livebox.lan)/d-i/n-a/grub/grub.cfg ## > } +## --- - name: apply configuration to the livebox hosts: all @@ -37,6 +38,12 @@ - iso: 'debian-live-11.3.0-amd64-standard+nonfree.iso' name: 'standard-cli' live_url: 'https://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/11.3.0-live+nonfree/amd64/iso-hybrid/' + + # The edulive role generates customized Debian-Live images. + # Make sure you have sufficient disk space available (~30GiB?). + build_images: + - gnome-edu + di_dist: "{{ ansible_distribution_release }}" di_version: "{{ ansible_distribution_major_version }}" di_pkg: "debian-installer-{{ di_version }}-netboot-amd64" @@ -65,3 +72,4 @@ - netbootinstaller - aptcacher - debianlive + - edulive diff --git a/roles/debianlive/tasks/main.yml b/roles/debianlive/tasks/main.yml index 23dcd11..bdbdff8 100644 --- a/roles/debianlive/tasks/main.yml +++ b/roles/debianlive/tasks/main.yml @@ -38,11 +38,16 @@ line: "/var/lib/tftpboot/d-i/n-live/ *(ro,crossmnt,no_subtree_check)" notify: export nfs -- name: configure ipxe boot menu address +- name: configure ipxe boot menu address and headline replace: path: /etc/di-netboot-assistant/ipxemenu.HEAD - regexp: '^(set 210:string tftp://\${next-server}/)$' - replace: '#\1\nset 210:string http://{{ ansible_default_ipv4.address }}/' + regexp: "{{ item.reg }}" + replace: "{{ item.rep }}" + loop: + - reg: '^(set 210:string tftp://\${next-server}/)$' + rep: '#\1\nset 210:string http://{{ ansible_default_ipv4.address }}/' + - reg: '^#(item --gap -- -- Customized Boot Entries.*)$' + rep: '\1' notify: rebuild di-netboot menu - name: configure grub boot menu addresses @@ -57,7 +62,7 @@ - name: prepare debian live nfs boot entry title lineinfile: path: /etc/di-netboot-assistant/ipxemenu.HEAD - insertafter: '^menu iPXE Boot Menu' + insertafter: '-- Customized Boot Entries --' line: "item {{ item.name }} Debian GNU/Linux {{ item.name }} NFS" loop: "{{ live_images }}" diff --git a/roles/edulive/defaults/main.yml b/roles/edulive/defaults/main.yml new file mode 100644 index 0000000..5834054 --- /dev/null +++ b/roles/edulive/defaults/main.yml @@ -0,0 +1 @@ +build_dir: /opt/live-build/ diff --git a/roles/edulive/files/gnome-edu/README b/roles/edulive/files/gnome-edu/README new file mode 100644 index 0000000..83e60e3 --- /dev/null +++ b/roles/edulive/files/gnome-edu/README @@ -0,0 +1,2 @@ +This config space is based on: + https://salsa.debian.org/live-team/live-images/-/tree/debian/images/gnome-desktop \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/auto/build b/roles/edulive/files/gnome-edu/auto/build new file mode 100755 index 0000000..f8d8346 --- /dev/null +++ b/roles/edulive/files/gnome-edu/auto/build @@ -0,0 +1,5 @@ +#!/bin/sh + +set -e + +lb build noauto "${@}" 2>&1 | tee build.log diff --git a/roles/edulive/files/gnome-edu/auto/clean b/roles/edulive/files/gnome-edu/auto/clean new file mode 100755 index 0000000..4b8ccaa --- /dev/null +++ b/roles/edulive/files/gnome-edu/auto/clean @@ -0,0 +1,10 @@ +#!/bin/sh + +set -e + +lb clean noauto "${@}" + +rm -f config/binary config/bootstrap config/chroot config/common config/source +rm -f config/control + +rm -f build.log diff --git a/roles/edulive/files/gnome-edu/auto/config b/roles/edulive/files/gnome-edu/auto/config new file mode 100755 index 0000000..96e38d3 --- /dev/null +++ b/roles/edulive/files/gnome-edu/auto/config @@ -0,0 +1,18 @@ +#!/bin/sh + +set -e + +lb config noauto \ + --clean \ + --cache false \ + --net-tarball false \ + --ignore-system-defaults \ + --distribution bullseye \ + --binary-images netboot \ + --mode debian \ + --backports true \ + --linux-packages linux-image \ + --archive-areas "main contrib non-free" \ + --mirror-bootstrap http://localhost:3142/deb.debian.org/debian/ \ + --mirror-chroot-security http://localhost:3142/security.debian.org/debian-security/ \ +"${@}" diff --git a/roles/edulive/files/gnome-edu/config/hooks/0001-plymouth-theme.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/0001-plymouth-theme.hook.chroot new file mode 100755 index 0000000..16095e0 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/0001-plymouth-theme.hook.chroot @@ -0,0 +1,8 @@ +#!/bin/sh + +set -e + +if [ -e /usr/sbin/plymouth-set-default-theme ] && [ -e /usr/share/plymouth/themes/lines ] +then + plymouth-set-default-theme lines +fi diff --git a/roles/edulive/files/gnome-edu/config/hooks/live/0010-disable-kexec-tools.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/live/0010-disable-kexec-tools.hook.chroot new file mode 120000 index 0000000..996f766 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/live/0010-disable-kexec-tools.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/live/0010-disable-kexec-tools.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/live/0050-disable-sysvinit-tmpfs.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/live/0050-disable-sysvinit-tmpfs.hook.chroot new file mode 120000 index 0000000..5ddf090 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/live/0050-disable-sysvinit-tmpfs.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/live/0050-disable-sysvinit-tmpfs.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/live/0500-desktop.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/live/0500-desktop.hook.chroot new file mode 100755 index 0000000..a051368 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/live/0500-desktop.hook.chroot @@ -0,0 +1,15 @@ +#!/bin/sh + +set -e + +echo 'pref("browser.startup.homepage", "https://www.startpage.com");' >> /etc/firefox-esr/firefox-esr.js +echo 'pref("network.proxy.type", 4);' >> /etc/firefox-esr/firefox-esr.js + +dconf update + +#sed -i "s/^/#/" /etc/xdg/user-dirs.defaults + +sed -i "s/^#WaylandEnable=false$/WaylandEnable=false/" /etc/gdm3/daemon.conf + +## workaround https://bugzilla.gnome.org/show_bug.cgi?id=730587 +#dpkg-divert --divert /usr/bin/gnome-keyring-daemon.bak --rename /usr/bin/gnome-keyring-daemon diff --git a/roles/edulive/files/gnome-edu/config/hooks/live/0600-wireshark.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/live/0600-wireshark.hook.chroot new file mode 100755 index 0000000..13ce126 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/live/0600-wireshark.hook.chroot @@ -0,0 +1,5 @@ +#!/bin/sh +set -e + +## allow everybody to run wireshark: +chmod 0755 /usr/bin/dumpcap diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0020-create-mtab-symlink.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0020-create-mtab-symlink.hook.chroot new file mode 120000 index 0000000..58123fc --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0020-create-mtab-symlink.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0020-create-mtab-symlink.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0030-enable-cryptsetup.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0030-enable-cryptsetup.hook.chroot new file mode 120000 index 0000000..c5ab625 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0030-enable-cryptsetup.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0030-enable-cryptsetup.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0040-create-locales-files.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0040-create-locales-files.hook.chroot new file mode 120000 index 0000000..036e7e0 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0040-create-locales-files.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0040-create-locales-files.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0100-remove-adjtime-configuration.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0100-remove-adjtime-configuration.hook.chroot new file mode 120000 index 0000000..b0ccdb6 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0100-remove-adjtime-configuration.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0100-remove-adjtime-configuration.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0110-remove-backup-files.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0110-remove-backup-files.hook.chroot new file mode 120000 index 0000000..8b68c5c --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0110-remove-backup-files.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0110-remove-backup-files.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0120-remove-dbus-machine-id.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0120-remove-dbus-machine-id.hook.chroot new file mode 120000 index 0000000..4d55b27 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0120-remove-dbus-machine-id.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0120-remove-dbus-machine-id.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0130-remove-gnome-icon-cache.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0130-remove-gnome-icon-cache.hook.chroot new file mode 120000 index 0000000..54f6a9b --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0130-remove-gnome-icon-cache.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0130-remove-gnome-icon-cache.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0140-remove-log-files.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0140-remove-log-files.hook.chroot new file mode 120000 index 0000000..2b99cec --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0140-remove-log-files.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0140-remove-log-files.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0150-remove-mdadm-configuration.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0150-remove-mdadm-configuration.hook.chroot new file mode 120000 index 0000000..0c3cd2f --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0150-remove-mdadm-configuration.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0150-remove-mdadm-configuration.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0160-remove-openssh-server-host-keys.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0160-remove-openssh-server-host-keys.hook.chroot new file mode 120000 index 0000000..e57b8d2 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0160-remove-openssh-server-host-keys.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0160-remove-openssh-server-host-keys.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0170-remove-python-py.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0170-remove-python-py.hook.chroot new file mode 120000 index 0000000..858a942 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0170-remove-python-py.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0170-remove-python-py.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0180-remove-systemd-machine-id.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0180-remove-systemd-machine-id.hook.chroot new file mode 120000 index 0000000..6cecf66 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0180-remove-systemd-machine-id.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0180-remove-systemd-machine-id.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0190-remove-temporary-files.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0190-remove-temporary-files.hook.chroot new file mode 120000 index 0000000..ada76d9 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0190-remove-temporary-files.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0190-remove-temporary-files.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0195-remove-ssl-cert-snakeoil.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0195-remove-ssl-cert-snakeoil.hook.chroot new file mode 120000 index 0000000..9fc0723 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0195-remove-ssl-cert-snakeoil.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0195-remove-ssl-cert-snakeoil.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0200-remove-udev-persistent-cd-rules.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0200-remove-udev-persistent-cd-rules.hook.chroot new file mode 120000 index 0000000..f893dcc --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0200-remove-udev-persistent-cd-rules.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0200-remove-udev-persistent-cd-rules.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0300-remove-udev-persistent-net-rules.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0300-remove-udev-persistent-net-rules.hook.chroot new file mode 120000 index 0000000..a6ee33d --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0300-remove-udev-persistent-net-rules.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0300-remove-udev-persistent-net-rules.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0400-update-apt-file-cache.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0400-update-apt-file-cache.hook.chroot new file mode 120000 index 0000000..380fdcf --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0400-update-apt-file-cache.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0400-update-apt-file-cache.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0410-update-apt-xapian-index.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0410-update-apt-xapian-index.hook.chroot new file mode 120000 index 0000000..dd7150e --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0410-update-apt-xapian-index.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0410-update-apt-xapian-index.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0420-update-glx-alternative.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0420-update-glx-alternative.hook.chroot new file mode 120000 index 0000000..4da25f8 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0420-update-glx-alternative.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0420-update-glx-alternative.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0430-update-mlocate-database.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0430-update-mlocate-database.hook.chroot new file mode 120000 index 0000000..13b49d7 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0430-update-mlocate-database.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0430-update-mlocate-database.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0440-update-nvidia-alternative.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0440-update-nvidia-alternative.hook.chroot new file mode 120000 index 0000000..0a65196 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0440-update-nvidia-alternative.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0440-update-nvidia-alternative.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/hooks/normal/0500-reproducible-glibc.hook.chroot b/roles/edulive/files/gnome-edu/config/hooks/normal/0500-reproducible-glibc.hook.chroot new file mode 120000 index 0000000..9d4f095 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/hooks/normal/0500-reproducible-glibc.hook.chroot @@ -0,0 +1 @@ +/usr/share/live/build/hooks/normal/0500-reproducible-glibc.hook.chroot \ No newline at end of file diff --git a/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/gdm.d/00-login-screen b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/gdm.d/00-login-screen new file mode 100644 index 0000000..23408bc --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/gdm.d/00-login-screen @@ -0,0 +1,8 @@ +[org/gnome/login-screen] +disable-user-list=true +logo='/usr/share/desktop-base/debian-logos/logo-text-64.png' + +[org/gnome/settings-daemon/plugins/power] +power-button-action='interactive' +sleep-inactive-ac-timeout=600 +sleep-inactive-ac-type='interactive' diff --git a/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/local.d/defaults b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/local.d/defaults new file mode 100644 index 0000000..ffde793 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/db/local.d/defaults @@ -0,0 +1,34 @@ +[org/gnome/shell] +enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com', 'dash-to-dock@micxgx.gmail.com'] + +[org/gnome/desktop/input-sources] +sources=[('xkb', 'de'), ('xkb', 'us')] + +[org/gnome/desktop/wm/preferences] +button-layout='appmenu:minimize,maximize,close' + +[org/gnome/desktop/peripherals/touchpad] +natural-scroll=false +edge-scrolling-enabled=true +tap-to-click=true + +[org/gnome/nautilus/preferences] +default-folder-viewer='list-view' + +[org/gnome/nautilus/list-view] +use-tree-view=true + +[org/gnome/settings-daemon/plugins/power] +power-button-action='interactive' +sleep-inactive-battery-timeout=600 +sleep-inactive-battery-type='hibernate' +sleep-inactive-ac-timeout=6000 +sleep-inactive-ac-type='nothing' + +[org/gnome/desktop/screensaver] +lock-enabled=false + +[org/gnome/desktop/interface] +clock-show-date=true +clock-show-seconds=true +clock-show-weekday=true diff --git a/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/gdm b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/gdm new file mode 100644 index 0000000..c165d75 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/gdm @@ -0,0 +1,3 @@ +user-db:user +system-db:gdm +file-db:/usr/share/gdm/greeter.dconf-defaults diff --git a/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/user b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/user new file mode 100644 index 0000000..aca0641 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/dconf/profile/user @@ -0,0 +1,2 @@ +user-db:user +system-db:local diff --git a/roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/netboot.xml b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/netboot.xml new file mode 100644 index 0000000..6a993f9 --- /dev/null +++ b/roles/edulive/files/gnome-edu/config/includes.chroot/etc/libvirt/qemu/netboot.xml @@ -0,0 +1,151 @@ + + + + netboot + 60ea84db-de6c-493c-8e3f-8e9a99ee19c2 + + + + + + 2097152 + 2097152 + 2 + + hvm + /usr/share/OVMF/OVMF_CODE.fd + /var/lib/libvirt/qemu/nvram/netboot_VARS.fd + + + + + + + + + + + + + + + + destroy + restart + destroy + + + + + + /usr/bin/qemu-system-x86_64 + +
+ + +
+ + + +
+ + + + +
+ + + + +
+ + + + +
+ + + + +
+ + + + +
+ + + + +
+ + + + + +
+ + + + + +
+ + + + + +
+ + + + + + + + + + + +
+ + + +
+ + +
+ + + + + + + + +
+ +