From 9f3407eba05be257dea784b600fa41dfc54696f6 Mon Sep 17 00:00:00 2001 From: Sven Velt Date: Sat, 12 Apr 2025 14:47:40 +0200 Subject: [PATCH] No more playbook but role for create_inventory_lxc.yml --- create_inventory_lxc.yml | 279 +-------------------------------------- 1 file changed, 3 insertions(+), 276 deletions(-) diff --git a/create_inventory_lxc.yml b/create_inventory_lxc.yml index f04eca5..f2f864a 100644 --- a/create_inventory_lxc.yml +++ b/create_inventory_lxc.yml @@ -3,280 +3,7 @@ gather_facts: no - #serial: 1 - - vars: - # List(!) of SSH keys for authorized_keys. Set here or in group_vars/all.yml - #ssh_keys: [] - # - # root password, default: "root" - #root_password: root - # - # Normal user account (with sudo) - #service_username: service - #service_password: {{ service_username }} - #service_ssh_keys: {{ ssh_keys }} - - # architecture mapping from "uname -m" to package - architecture_mapping: - aarch64: arm64 - x86_64: amd64 - #ppc64le: ppc64el - #s390x: s390x - #armv7l: armhf - - # "*cmdline_" must be listed AFTER "^cmdline_"! - cmdline_python: - alpine: - - "apk add -U python3" - archlinux: - - "pacman -Sy" - - "pacman -S --noconfirm python" - centos: &cmdline_python_centos - - "yum clean all" - - "yum makecache" - - "yum install -y python3 || true" - almalinux: *cmdline_python_centos - fedora: *cmdline_python_centos - oracle: *cmdline_python_centos - rockylinux: *cmdline_python_centos - debian: &cmdline_python_debian - - "apt-get -y update" - - "apt-get install -y python3 python3-apt" - devuan: *cmdline_python_debian - mint: *cmdline_python_debian - ubuntu: *cmdline_python_debian - opensuse: - - "zypper --gpg-auto-import-keys --no-gpg-checks -n refresh" - - "zypper --gpg-auto-import-keys --no-gpg-checks -n install python3" - voidlinux: - - "xbps-install -Suy python3 libgcc" - - cmdline_python2: - debian: &cmdline_python2_debian - - "apt-get -y update" - - "apt-get install -y python python-apt" - ubuntu: *cmdline_python2_debian - - cmdline_fixes: - oracle: - 8: - - '[ ! -f /usr/bin/python3 ] && ln -s /usr/libexec/platform-python /usr/bin/python3 || true' - - ssh_package_name: - alpine: openssh - archlinux: openssh - opensuse: openssh - voidlinux: openssh - - ssh_config_filename: - opensuse-tumbleweed: /etc/ssh/sshd_config.d/permitrootlogin.conf - - ssh_service_name: - debian: ssh - devuan: ssh - mint: ssh - ubuntu: ssh - - user_shell: - alpine: /bin/ash - - - - tasks: - - - name: End for non-LXContainer - meta: end_host - when: inventory_hostname in groups.lxc_hosts - - - - name: Sanity checks - assert: - that: - - ssh_keys is defined and ssh_keys is iterable - - service_user is not defined or service_user|regex_search('^[a-z][a-z0-9-]+$') - - - - name: Check for no-validate parameter in download template - shell: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true" - changed_when: false - register: lxc_download_validate - delegate_to: "{{ ansible_host|default('localhost') }}" - - - - name: Get architecture - shell: "uname -m || true" - changed_when: false - register: lxc_host_arch_native - delegate_to: "{{ ansible_host|default('localhost') }}" - - - - name: Create LXContainer - lxc_container: - name: "{{ inventory_hostname }}" - state: started - template: download - template_options: "-a {{ architecture_mapping[lxc_host_arch_native.stdout] }} -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}" - config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}" - container_config: - - "lxc.group = {{ os_d }}" - - "lxc.group = {{ (cmdline_python[os_d][0]).split(' ')[0].split('-')[0] }}" - register: lxc_created - delegate_to: "{{ ansible_host|default('localhost') }}" - - - - pause: - seconds: 10 - when: lxc_created is changed - - - - name: Raw-Install Python3 - raw: "{{ item }}" - loop: "{{ cmdline_python[os_d] }}" - when: use_python2 != True - - - - name: Raw-Install Python2 - raw: "{{ item }}" - loop: "{{ cmdline_python2[os_d] }}" - when: use_python2 == True - - - - name: OS-dependent fixes - raw: "{{ item }}" - loop: "{{ cmdline_fixes[os_d][os_r]|default([]) }}" - - - - setup: - - - - name: Set root password - shell: "echo root:{{ root_password|default('root') }} | chpasswd -c SHA256" - - - - name: Add SSH keys - block: - - name: "1st try: authorized_key module" - authorized_key: - user: root - key: "{{ item }}" - loop: "{{ ssh_keys }}" - rescue: - - name: "2nd try: create ~/.ssh directory" - file: - path: /root/.ssh/ - state: directory - owner: root - group: root - mode: 0700 - - name: "2nd try: add key via lineinfile module" - lineinfile: - path: /root/.ssh/authorized_keys - line: "{{ item }}" - owner: root - group: root - mode: 0600 - create: yes - backup: yes - loop: "{{ ssh_keys }}" - - - - name: "[BLOCK] when 'service_username' is set" - when: service_username is defined - block: - - - name: 'Add normal user "{{ service_username }}"' - user: - name: "{{ service_username }}" - shell: "{{ user_shell[os_d]|default('/bin/bash') }}" - - - - name: 'Set password for user "{{ service_username }}"' - shell: "echo {{ service_username }}:{{ service_password|default(service_username) }} | chpasswd -c SHA256" - - - - name: Add SSH keys - block: - - name: "1st try: authorized_key module" - authorized_key: - user: "{{ service_username }}" - key: "{{ item }}" - loop: "{{ ssh_keys_service|default(ssh_keys) }}" - rescue: - - name: "2nd try: get homedir of user" - getent: - database: passwd - key: "{{ service_username }}" - split: ":" - - name: "2nd try: create ~/.ssh directory" - file: - path: "{{ getent_passwd[service_username][4] }}/.ssh/" - state: directory - owner: "{{ service_username }}" - group: "{{ service_username }}" - mode: 0700 - - name: "2nd try: add key via lineinfile module" - lineinfile: - path: "{{ getent_passwd[service_username][4] }}/.ssh/authorized_keys" - line: "{{ item }}" - owner: "{{ service_username }}" - group: "{{ service_username }}" - mode: 0600 - create: yes - backup: yes - loop: "{{ ssh_keys }}" - - - - - name: Install sudo - package: - name: sudo - - - - name: Add sudo line for service - lineinfile: - path: "/etc/sudoers.d/{{ service_username }}" - regexp: "^service" - line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL" - create: yes - backup: yes - - - - name: Install SSH - package: - name: "{{ ssh_package_name[os_d]|default('openssh-server') }}" - state: latest - - - - name: "Set «PermitRootLogin» to «yes»" - lineinfile: - dest: "{{ ssh_config_filename[os_d + '-' + os_r|string]|default('/etc/ssh/sshd_config') }}" - regexp: '^#? *PermitRootLogin' - line: "PermitRootLogin yes" - create: yes - backup: yes - notify: "Restart SSH" - - - - name: Enable SSH - service: - name: "{{ ssh_service_name[os_d]|default('sshd') }}" - enabled: yes - - - - name: Start SSH - service: - name: "{{ ssh_service_name[os_d]|default('sshd') }}" - state: started - ignore_errors: yes - - - - handlers: - - - name: Restart SSH - service: - name: "{{ ssh_service_name[os_d]|default('sshd') }}" - state: restarted - + roles: + - role: lxc_create + when: inventory_hostname not in list_of_lxc_hosts|default(groups.lxc_hosts)