mirror of
https://github.com/MatteZ02/infra.git
synced 2024-11-09 20:40:18 +00:00
Initial Commit
This commit is contained in:
commit
923312b782
4
.gitignore
vendored
Normal file
4
.gitignore
vendored
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
!/collections/.gitkeep
|
||||||
|
/collections
|
||||||
|
/vault
|
||||||
|
__pycache__
|
6
.vscode/settings.json
vendored
Normal file
6
.vscode/settings.json
vendored
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
{
|
||||||
|
"files.trimTrailingWhitespace": true,
|
||||||
|
"files.insertFinalNewline": true,
|
||||||
|
"files.trimFinalNewlines": true,
|
||||||
|
"editor.renderFinalNewline": false
|
||||||
|
}
|
21
LICENSE
Normal file
21
LICENSE
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2024 Warén Group
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
16
ansible.cfg
Normal file
16
ansible.cfg
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
[defaults]
|
||||||
|
inventory = inventories/mkj
|
||||||
|
hash_behaviour = merge
|
||||||
|
gathering = smart
|
||||||
|
transport = local
|
||||||
|
display_skipped_hosts = false
|
||||||
|
interpreter_python = auto_silent
|
||||||
|
localhost_warning = false
|
||||||
|
collections_path = collections
|
||||||
|
inject_facts_as_vars = false
|
||||||
|
force_handlers = true
|
||||||
|
action_warnings = false
|
||||||
|
inventory_unparsed_warning = false
|
||||||
|
|
||||||
|
[inventory]
|
||||||
|
host_pattern_mismatch = ignore
|
5
files/certbot/nginx.sh
Normal file
5
files/certbot/nginx.sh
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
echo -n "$CERTBOT_VALIDATION" > /root/nginx/html/.well-known/acme-challenge/$CERTBOT_TOKEN
|
||||||
|
mkdir -p /root/nginx/html/.well-known/acme-challenge
|
||||||
|
/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --vault-password-file ~/.ansible/vault.yml --private-key ~/.ssh/id_rsa tasks.yml -t nginx &> /dev/null
|
81
files/nginx/conf/000-default.conf
Normal file
81
files/nginx/conf/000-default.conf
Normal file
@ -0,0 +1,81 @@
|
|||||||
|
server {
|
||||||
|
|
||||||
|
listen 80 default_server;
|
||||||
|
listen [::]:80 default_server;
|
||||||
|
|
||||||
|
server_name _;
|
||||||
|
|
||||||
|
expires off;
|
||||||
|
etag off;
|
||||||
|
if_modified_since off;
|
||||||
|
|
||||||
|
gzip on;
|
||||||
|
gzip_min_length 1000;
|
||||||
|
gzip_proxied any;
|
||||||
|
gzip_types *;
|
||||||
|
gunzip on;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
index index.html index.htm;
|
||||||
|
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /.well-known/acme-challenge/ {
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
index index.html index.htm;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($request_method !~ ^(GET|HEAD|POST)$ )
|
||||||
|
{
|
||||||
|
return 405;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
|
||||||
|
listen 443 ssl default_server;
|
||||||
|
listen [::]:443 ssl default_server;
|
||||||
|
|
||||||
|
server_name _;
|
||||||
|
|
||||||
|
http2 on;
|
||||||
|
|
||||||
|
ssl_certificate /etc/nginx/certs/mkj/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/nginx/certs/mkj/privkey.pem;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-ARIA256-GCM-SHA384:DHE-RSA-ARIA256-GCM-SHA384:ECDHE-ARIA128-GCM-SHA256:DHE-RSA-ARIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM';
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
ssl_session_cache shared:SSL:20m;
|
||||||
|
ssl_session_timeout 180m;
|
||||||
|
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
ssl_trusted_certificate /etc/nginx/certs/mkj/chain.pem;
|
||||||
|
|
||||||
|
expires off;
|
||||||
|
etag off;
|
||||||
|
if_modified_since off;
|
||||||
|
|
||||||
|
gzip on;
|
||||||
|
gzip_min_length 1000;
|
||||||
|
gzip_proxied any;
|
||||||
|
gzip_types *;
|
||||||
|
gunzip on;
|
||||||
|
|
||||||
|
client_max_body_size 256M;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:8080/;
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE)$ )
|
||||||
|
{
|
||||||
|
return 405;
|
||||||
|
}
|
||||||
|
}
|
31
files/nginx/config.conf
Normal file
31
files/nginx/config.conf
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
user nginx;
|
||||||
|
worker_processes 1;
|
||||||
|
|
||||||
|
error_log /var/log/nginx/error.log error;
|
||||||
|
pid /var/run/nginx.pid;
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
log_format main '[$time_local] $host - $remote_addr - $remote_user "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||||
|
|
||||||
|
access_log /var/log/nginx/access.log main;
|
||||||
|
|
||||||
|
server_tokens off;
|
||||||
|
|
||||||
|
sendfile off;
|
||||||
|
#tcp_nopush on;
|
||||||
|
|
||||||
|
keepalive_timeout 65;
|
||||||
|
|
||||||
|
resolver 1.1.1.1;
|
||||||
|
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
}
|
50
install.sh
Normal file
50
install.sh
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ ! "$BASH_VERSION" ] ; then
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "
|
||||||
|
==============================
|
||||||
|
|
||||||
|
MKJ - Infra
|
||||||
|
Install Script
|
||||||
|
|
||||||
|
------------------------------
|
||||||
|
"
|
||||||
|
|
||||||
|
stop () {
|
||||||
|
|
||||||
|
echo "
|
||||||
|
==============================
|
||||||
|
"
|
||||||
|
|
||||||
|
exit 1
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
mkdir -p ~/.ssh &> /dev/null
|
||||||
|
|
||||||
|
apt-get install -y python3-pip python3-venv jq git curl &> /dev/null
|
||||||
|
python3 -m venv /opt/ansible &> /dev/null
|
||||||
|
/opt/ansible/bin/pip3 install ansible hvac netaddr jmespath pexpect &> /dev/null
|
||||||
|
|
||||||
|
/opt/ansible/bin/ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
|
||||||
|
|
||||||
|
mkdir -p ~/.ansible &> /dev/null
|
||||||
|
|
||||||
|
if [[ ! -f ~/.ansible/vault.yml ]]
|
||||||
|
then
|
||||||
|
echo -n "Vault Password: "
|
||||||
|
read PASSWORD
|
||||||
|
echo "$PASSWORD" > ~/.ansible/vault.yml
|
||||||
|
fi
|
||||||
|
|
||||||
|
ssh-keyscan github.com 1> ~/.ssh/known_hosts 2> /dev/null
|
||||||
|
|
||||||
|
/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-ansible --vault-password-file ~/.ansible/vault.yml --private-key ~/.ssh/id_rsa tasks.yml -t installer
|
||||||
|
|
||||||
|
|
||||||
|
echo "
|
||||||
|
==============================
|
||||||
|
"
|
14
inventories/mkj/host_vars/mkj
Normal file
14
inventories/mkj/host_vars/mkj
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
34366533383537636563363238346530306364323437633062363834363738613462666632653730
|
||||||
|
3231376531356466333161643535353433633834633765300a343462663562663065326131663765
|
||||||
|
33356238666332326130643662386265666665303566643330326466353334366635626232386465
|
||||||
|
3937366161663038340a386134616234653635313339663031366137343362663262616166376262
|
||||||
|
36666461326634376262613362393139623230326238363736643133656537303332393234616566
|
||||||
|
31646338313832663462656638313833336135663336316634616332636663386230306665623337
|
||||||
|
30666131393732356337613530393238633733653162313631323766643563366134326265376163
|
||||||
|
37666564656664323035343132336564343861643030396266616538353165376230393636663134
|
||||||
|
62313063336538636464396134666134336662633534376435656363633632623964343338663866
|
||||||
|
35623832633033363532303831366530363834393363333333623832616461323464393761333664
|
||||||
|
34386262343338306164353539363230613562633231386436653134333235336638646334643332
|
||||||
|
31663430333230663363316437336332303633633263336437313761396164656564666539393264
|
||||||
|
3632
|
7
inventories/mkj/hosts
Normal file
7
inventories/mkj/hosts
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
all:
|
||||||
|
hosts:
|
||||||
|
mkj:
|
||||||
|
vars:
|
||||||
|
ansible_connection: local
|
||||||
|
ansible_python_interpreter: "{{ansible_playbook_python}}"
|
57
protect.sh
Executable file
57
protect.sh
Executable file
@ -0,0 +1,57 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
underline=`tput smul`
|
||||||
|
nounderline=`tput rmul`
|
||||||
|
bold=$(tput bold)
|
||||||
|
normal=$(tput sgr0)
|
||||||
|
|
||||||
|
echo "${bold}MKJ / Infra / Protect${normal}"
|
||||||
|
action=$1
|
||||||
|
|
||||||
|
encrypt() {
|
||||||
|
echo "${underline}Encrypting...${nounderline}"
|
||||||
|
execute "ansible-vault encrypt --vault-id default@vault/mkj"
|
||||||
|
}
|
||||||
|
|
||||||
|
decrypt() {
|
||||||
|
echo "${underline}Decrypting...${nounderline}"
|
||||||
|
execute "ansible-vault decrypt --vault-id default@vault/mkj"
|
||||||
|
}
|
||||||
|
|
||||||
|
list() {
|
||||||
|
echo "${underline}Listing...${nounderline}"
|
||||||
|
i=0
|
||||||
|
for file in inventories/*/group_vars/* inventories/*/host_vars/*;
|
||||||
|
do
|
||||||
|
i=$((i + 1))
|
||||||
|
echo $i")"$file
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
execute() {
|
||||||
|
for file in inventories/*/group_vars/* inventories/*/host_vars/*;
|
||||||
|
do
|
||||||
|
i=$((i + 1))
|
||||||
|
echo $i")"$file
|
||||||
|
$1 $file
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
case $action in
|
||||||
|
encrypt)
|
||||||
|
encrypt
|
||||||
|
;;
|
||||||
|
decrypt)
|
||||||
|
decrypt
|
||||||
|
;;
|
||||||
|
list)
|
||||||
|
list
|
||||||
|
;;
|
||||||
|
help)
|
||||||
|
echo "encrypt, decrypt, list"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "..."
|
||||||
|
;;
|
||||||
|
esac
|
3
requirements.yml
Normal file
3
requirements.yml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
collections:
|
||||||
|
- containers.podman
|
25
tasks.yml
Normal file
25
tasks.yml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
- name: "Tasks"
|
||||||
|
hosts: all
|
||||||
|
module_defaults:
|
||||||
|
ansible.builtin.gather_facts:
|
||||||
|
gather_timeout: 10
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: "Installer"
|
||||||
|
import_tasks: tasks/installer.yml
|
||||||
|
tags:
|
||||||
|
- installer
|
||||||
|
- never
|
||||||
|
|
||||||
|
- name: "Maintenance"
|
||||||
|
import_tasks: tasks/maintenance.yml
|
||||||
|
tags:
|
||||||
|
- maintenance
|
||||||
|
- never
|
||||||
|
|
||||||
|
- name: "Deployer"
|
||||||
|
import_tasks: tasks/deployer.yml
|
||||||
|
tags:
|
||||||
|
- deployer
|
||||||
|
- never
|
152
tasks/deployer.yml
Normal file
152
tasks/deployer.yml
Normal file
@ -0,0 +1,152 @@
|
|||||||
|
---
|
||||||
|
- name: "Deployer - Certbot - Renew Certificates"
|
||||||
|
command: "certbot renew"
|
||||||
|
register: task
|
||||||
|
changed_when: task.stdout.find("No renewals were attempted.") == -1
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
- tls
|
||||||
|
|
||||||
|
- name: "Deployer - Certbot - Copy Certificates"
|
||||||
|
copy:
|
||||||
|
src: "/etc/letsencrypt/live/mkj/"
|
||||||
|
dest: "/root/certs/mkj/"
|
||||||
|
follow: true
|
||||||
|
register: task
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
- tls
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Pull Image"
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: docker.io/mariadb
|
||||||
|
tag: latest
|
||||||
|
force: on
|
||||||
|
register: deployerTask101
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Run Container"
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: mariadb
|
||||||
|
image: docker.io/mariadb:latest
|
||||||
|
state: started
|
||||||
|
restart: on
|
||||||
|
network: host
|
||||||
|
volumes:
|
||||||
|
- "/root/mariadb:/var/lib/mysql"
|
||||||
|
restart_policy: always
|
||||||
|
env:
|
||||||
|
MYSQL_ROOT_PASSWORD: "{{ secrets.mariadb.root.password }}"
|
||||||
|
register: deployerTask102
|
||||||
|
when:
|
||||||
|
- (deployerTask101 is defined and deployerTask101.changed) or deployerTask101 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Wait"
|
||||||
|
wait_for:
|
||||||
|
host: "127.0.0.1"
|
||||||
|
port: "3306"
|
||||||
|
delay: 10
|
||||||
|
when:
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Upgrade"
|
||||||
|
containers.podman.podman_container_exec:
|
||||||
|
name: mariadb
|
||||||
|
command: "mariadb-upgrade --host=127.0.0.1 --user=root --password={{ secrets.mariadb.root.password }}"
|
||||||
|
register: task
|
||||||
|
ignore_errors: yes
|
||||||
|
changed_when:
|
||||||
|
- task.stdout is defined
|
||||||
|
- task.stdout.find("This installation of MariaDB is already upgraded") == -1
|
||||||
|
when:
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Create Users"
|
||||||
|
mysql_user:
|
||||||
|
login_host: "127.0.0.1"
|
||||||
|
login_user: root
|
||||||
|
login_password: "{{ secrets.mariadb.root.password }}"
|
||||||
|
name: "mkj"
|
||||||
|
host: "%"
|
||||||
|
password: "{{ secrets.mariadb.mkj.password }}"
|
||||||
|
priv: "mkj.*:ALL"
|
||||||
|
vars:
|
||||||
|
ansible_python_interpreter: "/opt/ansible/bin/python3"
|
||||||
|
when:
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Create Database"
|
||||||
|
mysql_db:
|
||||||
|
login_host: "127.0.0.1"
|
||||||
|
login_user: "mkj"
|
||||||
|
login_password: "{{ secrets.mariadb.mkj.password }}"
|
||||||
|
name: "mkj"
|
||||||
|
vars:
|
||||||
|
ansible_python_interpreter: "/opt/ansible/bin/python3"
|
||||||
|
when:
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - Nginx - Configure - Create Folder"
|
||||||
|
file:
|
||||||
|
path: "/root/nginx/"
|
||||||
|
state: directory
|
||||||
|
tags:
|
||||||
|
- nginx
|
||||||
|
|
||||||
|
- name: "Deployer - Nginx - Configure - Create Subfolders"
|
||||||
|
file:
|
||||||
|
dest: '/root/nginx/{{ item.path }}'
|
||||||
|
state: directory
|
||||||
|
with_filetree: './files/nginx/'
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.path }}"
|
||||||
|
when:
|
||||||
|
- item.state == 'directory'
|
||||||
|
tags:
|
||||||
|
- nginx
|
||||||
|
|
||||||
|
- name: "Deployer - Nginx - Configure - Generating & Transferring Files"
|
||||||
|
template:
|
||||||
|
src: '{{ item.src }}'
|
||||||
|
dest: '/root/nginx/{{ item.path }}'
|
||||||
|
with_filetree: './files/nginx/'
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.path }}"
|
||||||
|
when:
|
||||||
|
- item.state == 'file'
|
||||||
|
tags:
|
||||||
|
- nginx
|
||||||
|
|
||||||
|
- name: "Deployer - Nginx - Pull Image"
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: docker.io/nginx
|
||||||
|
tag: latest
|
||||||
|
force: on
|
||||||
|
register: deployerTask3
|
||||||
|
|
||||||
|
- name: "Deployer - Nginx - Run Container"
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: nginx
|
||||||
|
image: docker.io/nginx
|
||||||
|
state: started
|
||||||
|
recreate: on
|
||||||
|
network: host
|
||||||
|
volumes:
|
||||||
|
- "/root/nginx/html:/usr/share/nginx/html:ro"
|
||||||
|
- "/root/nginx/config.conf:/etc/nginx/nginx.conf:ro"
|
||||||
|
- "/root/nginx/conf/:/etc/nginx/conf.d/:ro"
|
||||||
|
- "/root/certs/:/etc/nginx/certs/:ro"
|
||||||
|
restart_policy: always
|
||||||
|
when:
|
||||||
|
- (deployerTask3 is defined and deployerTask3.changed) or deployerTask3 is undefined
|
||||||
|
tags:
|
||||||
|
- nginx
|
184
tasks/installer.yml
Normal file
184
tasks/installer.yml
Normal file
@ -0,0 +1,184 @@
|
|||||||
|
---
|
||||||
|
- name: "Installer - Ansible - Python Library"
|
||||||
|
pip:
|
||||||
|
name: ansible
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Installer - Ansible - Create Symbolic Links"
|
||||||
|
ansible.builtin.file:
|
||||||
|
src: /opt/ansible/bin/{{ binary }}
|
||||||
|
dest: /usr/bin/{{ binary }}
|
||||||
|
state: link
|
||||||
|
vars:
|
||||||
|
binaries:
|
||||||
|
- ansible
|
||||||
|
- ansible-community
|
||||||
|
- ansible-config
|
||||||
|
- ansible-connection
|
||||||
|
- ansible-console
|
||||||
|
- ansible-doc
|
||||||
|
- ansible-galaxy
|
||||||
|
- ansible-inventory
|
||||||
|
- ansible-playbook
|
||||||
|
- ansible-pull
|
||||||
|
- ansible-test
|
||||||
|
- ansible-vault
|
||||||
|
loop: "{{ binaries }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ binary }}"
|
||||||
|
loop_var: "binary"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Installer - Ansible - Dependencies / Python Library : hvac"
|
||||||
|
pip:
|
||||||
|
name: hvac
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Installer - Ansible - Dependencies / Python Library : netaddr"
|
||||||
|
pip:
|
||||||
|
name: netaddr
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Installer - Ansible - Dependencies / Python Library : jmespath"
|
||||||
|
pip:
|
||||||
|
name: jmespath
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Installer - Ansible - Dependencies / Python Library : pexpect"
|
||||||
|
pip:
|
||||||
|
name: pexpect
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Installer - Podman"
|
||||||
|
apt:
|
||||||
|
name: podman
|
||||||
|
state: latest
|
||||||
|
tags:
|
||||||
|
- podman
|
||||||
|
|
||||||
|
- name: "Installer : Podman : Configure - Subordinate Ids : Users : root"
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/subuid
|
||||||
|
regexp: "^root"
|
||||||
|
line: "root:100000:65536"
|
||||||
|
|
||||||
|
- name: "Installer : Podman : Configure - Subordinate Ids : Groups : root"
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/subgid
|
||||||
|
regexp: "^root"
|
||||||
|
line: "root:100000:65536"
|
||||||
|
|
||||||
|
- name: "Installer - Certbot - Python Library"
|
||||||
|
pip:
|
||||||
|
name: certbot
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Installer - Certbot - Create Symbolic Links"
|
||||||
|
ansible.builtin.file:
|
||||||
|
src: /opt/ansible/bin/{{ binary }}
|
||||||
|
dest: /usr/bin/{{ binary }}
|
||||||
|
state: link
|
||||||
|
vars:
|
||||||
|
binaries:
|
||||||
|
- certbot
|
||||||
|
loop: "{{ binaries }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ binary }}"
|
||||||
|
loop_var: "binary"
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Installer - Certbot - Auth Hook"
|
||||||
|
copy:
|
||||||
|
src: "../files/certbot/nginx.sh"
|
||||||
|
dest: "/etc/letsencrypt/renewal-hooks/pre/nginx.sh"
|
||||||
|
mode: '700'
|
||||||
|
force: true
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Installer - Certbot - Create Certificates"
|
||||||
|
command: "certbot certonly --cert-name {{ cert.name }} --manual --preferred-challenges http-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/renewal-hooks/pre/nginx.sh --debug-challenges --preferred-chain='ISRG Root X1' --key-type rsa -d {{ cert.domains | join(' -d ') }}"
|
||||||
|
register: task
|
||||||
|
changed_when: task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
|
||||||
|
vars:
|
||||||
|
cert:
|
||||||
|
name: mkj
|
||||||
|
email: "{{ config.certbot.email }}"
|
||||||
|
domains:
|
||||||
|
- "{{ ansible_facts.fqdn }}"
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Installer - MariaDB - Dependencies / Python Library : pymysql"
|
||||||
|
pip:
|
||||||
|
name: pymysql
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Installer - MariaDB - Dependencies / Package : mariadb-client"
|
||||||
|
apt:
|
||||||
|
name: "mariadb-client"
|
||||||
|
state: latest
|
||||||
|
when:
|
||||||
|
- ansible_facts.distribution == "Debian" or ansible_facts.distribution == "Ubuntu" or ansible_facts.distribution == "Linux Mint"
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Installer - Schedule - Setup"
|
||||||
|
cron:
|
||||||
|
name: PATH
|
||||||
|
env: yes
|
||||||
|
value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||||
|
|
||||||
|
- name: "Installer - Schedule - Maintenance"
|
||||||
|
cron:
|
||||||
|
name: Maintenance
|
||||||
|
hour: "*/3"
|
||||||
|
minute: "0"
|
||||||
|
job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --vault-password-file ~/.ansible/vault.yml --private-key ~/.ssh/id_rsa tasks.yml -t maintenance"
|
||||||
|
tags:
|
||||||
|
- cron
|
||||||
|
|
||||||
|
- name: "Installer - Schedule - Deployer"
|
||||||
|
cron:
|
||||||
|
name: Deployer
|
||||||
|
minute: "*/5"
|
||||||
|
job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --vault-password-file ~/.ansible/vault.yml --private-key ~/.ssh/id_rsa tasks.yml -t deployer"
|
||||||
|
tags:
|
||||||
|
- cron
|
37
tasks/maintenance.yml
Normal file
37
tasks/maintenance.yml
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
---
|
||||||
|
- name: "Maintenance - OS Update"
|
||||||
|
apt:
|
||||||
|
upgrade: dist
|
||||||
|
update_cache: yes
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : hvac"
|
||||||
|
pip:
|
||||||
|
name: hvac
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : netaddr"
|
||||||
|
pip:
|
||||||
|
name: netaddr
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : jmespath"
|
||||||
|
pip:
|
||||||
|
name: jmespath
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : pexpect"
|
||||||
|
pip:
|
||||||
|
name: pexpect
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
Loading…
Reference in New Issue
Block a user