No more playbook but role for create_inventory_lxc.yml
This commit is contained in:
Sven Velt
parent
4cbb99b6e1
commit
9f3407eba0
|
|
@ -3,280 +3,7 @@
|
|||
|
||||
gather_facts: no
|
||||
|
||||
#serial: 1
|
||||
|
||||
vars:
|
||||
# List(!) of SSH keys for authorized_keys. Set here or in group_vars/all.yml
|
||||
#ssh_keys: []
|
||||
#
|
||||
# root password, default: "root"
|
||||
#root_password: root
|
||||
#
|
||||
# Normal user account (with sudo)
|
||||
#service_username: service
|
||||
#service_password: {{ service_username }}
|
||||
#service_ssh_keys: {{ ssh_keys }}
|
||||
|
||||
# architecture mapping from "uname -m" to package
|
||||
architecture_mapping:
|
||||
aarch64: arm64
|
||||
x86_64: amd64
|
||||
#ppc64le: ppc64el
|
||||
#s390x: s390x
|
||||
#armv7l: armhf
|
||||
|
||||
# "*cmdline_" must be listed AFTER "^cmdline_"!
|
||||
cmdline_python:
|
||||
alpine:
|
||||
- "apk add -U python3"
|
||||
archlinux:
|
||||
- "pacman -Sy"
|
||||
- "pacman -S --noconfirm python"
|
||||
centos: &cmdline_python_centos
|
||||
- "yum clean all"
|
||||
- "yum makecache"
|
||||
- "yum install -y python3 || true"
|
||||
almalinux: *cmdline_python_centos
|
||||
fedora: *cmdline_python_centos
|
||||
oracle: *cmdline_python_centos
|
||||
rockylinux: *cmdline_python_centos
|
||||
debian: &cmdline_python_debian
|
||||
- "apt-get -y update"
|
||||
- "apt-get install -y python3 python3-apt"
|
||||
devuan: *cmdline_python_debian
|
||||
mint: *cmdline_python_debian
|
||||
ubuntu: *cmdline_python_debian
|
||||
opensuse:
|
||||
- "zypper --gpg-auto-import-keys --no-gpg-checks -n refresh"
|
||||
- "zypper --gpg-auto-import-keys --no-gpg-checks -n install python3"
|
||||
voidlinux:
|
||||
- "xbps-install -Suy python3 libgcc"
|
||||
|
||||
cmdline_python2:
|
||||
debian: &cmdline_python2_debian
|
||||
- "apt-get -y update"
|
||||
- "apt-get install -y python python-apt"
|
||||
ubuntu: *cmdline_python2_debian
|
||||
|
||||
cmdline_fixes:
|
||||
oracle:
|
||||
8:
|
||||
- '[ ! -f /usr/bin/python3 ] && ln -s /usr/libexec/platform-python /usr/bin/python3 || true'
|
||||
|
||||
ssh_package_name:
|
||||
alpine: openssh
|
||||
archlinux: openssh
|
||||
opensuse: openssh
|
||||
voidlinux: openssh
|
||||
|
||||
ssh_config_filename:
|
||||
opensuse-tumbleweed: /etc/ssh/sshd_config.d/permitrootlogin.conf
|
||||
|
||||
ssh_service_name:
|
||||
debian: ssh
|
||||
devuan: ssh
|
||||
mint: ssh
|
||||
ubuntu: ssh
|
||||
|
||||
user_shell:
|
||||
alpine: /bin/ash
|
||||
|
||||
|
||||
|
||||
tasks:
|
||||
|
||||
- name: End for non-LXContainer
|
||||
meta: end_host
|
||||
when: inventory_hostname in groups.lxc_hosts
|
||||
|
||||
|
||||
- name: Sanity checks
|
||||
assert:
|
||||
that:
|
||||
- ssh_keys is defined and ssh_keys is iterable
|
||||
- service_user is not defined or service_user|regex_search('^[a-z][a-z0-9-]+$')
|
||||
|
||||
|
||||
- name: Check for no-validate parameter in download template
|
||||
shell: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true"
|
||||
changed_when: false
|
||||
register: lxc_download_validate
|
||||
delegate_to: "{{ ansible_host|default('localhost') }}"
|
||||
|
||||
|
||||
- name: Get architecture
|
||||
shell: "uname -m || true"
|
||||
changed_when: false
|
||||
register: lxc_host_arch_native
|
||||
delegate_to: "{{ ansible_host|default('localhost') }}"
|
||||
|
||||
|
||||
- name: Create LXContainer
|
||||
lxc_container:
|
||||
name: "{{ inventory_hostname }}"
|
||||
state: started
|
||||
template: download
|
||||
template_options: "-a {{ architecture_mapping[lxc_host_arch_native.stdout] }} -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
|
||||
config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}"
|
||||
container_config:
|
||||
- "lxc.group = {{ os_d }}"
|
||||
- "lxc.group = {{ (cmdline_python[os_d][0]).split(' ')[0].split('-')[0] }}"
|
||||
register: lxc_created
|
||||
delegate_to: "{{ ansible_host|default('localhost') }}"
|
||||
|
||||
|
||||
- pause:
|
||||
seconds: 10
|
||||
when: lxc_created is changed
|
||||
|
||||
|
||||
- name: Raw-Install Python3
|
||||
raw: "{{ item }}"
|
||||
loop: "{{ cmdline_python[os_d] }}"
|
||||
when: use_python2 != True
|
||||
|
||||
|
||||
- name: Raw-Install Python2
|
||||
raw: "{{ item }}"
|
||||
loop: "{{ cmdline_python2[os_d] }}"
|
||||
when: use_python2 == True
|
||||
|
||||
|
||||
- name: OS-dependent fixes
|
||||
raw: "{{ item }}"
|
||||
loop: "{{ cmdline_fixes[os_d][os_r]|default([]) }}"
|
||||
|
||||
|
||||
- setup:
|
||||
|
||||
|
||||
- name: Set root password
|
||||
shell: "echo root:{{ root_password|default('root') }} | chpasswd -c SHA256"
|
||||
|
||||
|
||||
- name: Add SSH keys
|
||||
block:
|
||||
- name: "1st try: authorized_key module"
|
||||
authorized_key:
|
||||
user: root
|
||||
key: "{{ item }}"
|
||||
loop: "{{ ssh_keys }}"
|
||||
rescue:
|
||||
- name: "2nd try: create ~/.ssh directory"
|
||||
file:
|
||||
path: /root/.ssh/
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0700
|
||||
- name: "2nd try: add key via lineinfile module"
|
||||
lineinfile:
|
||||
path: /root/.ssh/authorized_keys
|
||||
line: "{{ item }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0600
|
||||
create: yes
|
||||
backup: yes
|
||||
loop: "{{ ssh_keys }}"
|
||||
|
||||
|
||||
- name: "[BLOCK] when 'service_username' is set"
|
||||
when: service_username is defined
|
||||
block:
|
||||
|
||||
- name: 'Add normal user "{{ service_username }}"'
|
||||
user:
|
||||
name: "{{ service_username }}"
|
||||
shell: "{{ user_shell[os_d]|default('/bin/bash') }}"
|
||||
|
||||
|
||||
- name: 'Set password for user "{{ service_username }}"'
|
||||
shell: "echo {{ service_username }}:{{ service_password|default(service_username) }} | chpasswd -c SHA256"
|
||||
|
||||
|
||||
- name: Add SSH keys
|
||||
block:
|
||||
- name: "1st try: authorized_key module"
|
||||
authorized_key:
|
||||
user: "{{ service_username }}"
|
||||
key: "{{ item }}"
|
||||
loop: "{{ ssh_keys_service|default(ssh_keys) }}"
|
||||
rescue:
|
||||
- name: "2nd try: get homedir of user"
|
||||
getent:
|
||||
database: passwd
|
||||
key: "{{ service_username }}"
|
||||
split: ":"
|
||||
- name: "2nd try: create ~/.ssh directory"
|
||||
file:
|
||||
path: "{{ getent_passwd[service_username][4] }}/.ssh/"
|
||||
state: directory
|
||||
owner: "{{ service_username }}"
|
||||
group: "{{ service_username }}"
|
||||
mode: 0700
|
||||
- name: "2nd try: add key via lineinfile module"
|
||||
lineinfile:
|
||||
path: "{{ getent_passwd[service_username][4] }}/.ssh/authorized_keys"
|
||||
line: "{{ item }}"
|
||||
owner: "{{ service_username }}"
|
||||
group: "{{ service_username }}"
|
||||
mode: 0600
|
||||
create: yes
|
||||
backup: yes
|
||||
loop: "{{ ssh_keys }}"
|
||||
|
||||
|
||||
|
||||
- name: Install sudo
|
||||
package:
|
||||
name: sudo
|
||||
|
||||
|
||||
- name: Add sudo line for service
|
||||
lineinfile:
|
||||
path: "/etc/sudoers.d/{{ service_username }}"
|
||||
regexp: "^service"
|
||||
line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL"
|
||||
create: yes
|
||||
backup: yes
|
||||
|
||||
|
||||
- name: Install SSH
|
||||
package:
|
||||
name: "{{ ssh_package_name[os_d]|default('openssh-server') }}"
|
||||
state: latest
|
||||
|
||||
|
||||
- name: "Set «PermitRootLogin» to «yes»"
|
||||
lineinfile:
|
||||
dest: "{{ ssh_config_filename[os_d + '-' + os_r|string]|default('/etc/ssh/sshd_config') }}"
|
||||
regexp: '^#? *PermitRootLogin'
|
||||
line: "PermitRootLogin yes"
|
||||
create: yes
|
||||
backup: yes
|
||||
notify: "Restart SSH"
|
||||
|
||||
|
||||
- name: Enable SSH
|
||||
service:
|
||||
name: "{{ ssh_service_name[os_d]|default('sshd') }}"
|
||||
enabled: yes
|
||||
|
||||
|
||||
- name: Start SSH
|
||||
service:
|
||||
name: "{{ ssh_service_name[os_d]|default('sshd') }}"
|
||||
state: started
|
||||
ignore_errors: yes
|
||||
|
||||
|
||||
|
||||
handlers:
|
||||
|
||||
- name: Restart SSH
|
||||
service:
|
||||
name: "{{ ssh_service_name[os_d]|default('sshd') }}"
|
||||
state: restarted
|
||||
|
||||
roles:
|
||||
- role: lxc_create
|
||||
when: inventory_hostname not in list_of_lxc_hosts|default(groups.lxc_hosts)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue