Compare commits
10 commits
Author | SHA1 | Date | |
---|---|---|---|
5a4f039fc0 | |||
c6cb78ce6f | |||
e286662efc | |||
63b265011d | |||
64d3c6b281 | |||
c2b48aef41 | |||
dbf35931c2 | |||
4d95c09591 | |||
adefc850bb | |||
6f0a8bec2c |
1
.gitignore
vendored
1
.gitignore
vendored
|
@ -1,5 +1,6 @@
|
||||||
group_vars/all.yml
|
group_vars/all.yml
|
||||||
hosts.*
|
hosts.*
|
||||||
|
.cache
|
||||||
|
|
||||||
# ---> Python
|
# ---> Python
|
||||||
# Byte-compiled / optimized / DLL files
|
# Byte-compiled / optimized / DLL files
|
||||||
|
|
9
.gitmodules
vendored
9
.gitmodules
vendored
|
@ -1,3 +1,12 @@
|
||||||
[submodule ".submodules/ansible-lxc-ssh"]
|
[submodule ".submodules/ansible-lxc-ssh"]
|
||||||
path = .submodules/ansible-lxc-ssh
|
path = .submodules/ansible-lxc-ssh
|
||||||
url = https://github.com/andreasscherbaum/ansible-lxc-ssh.git
|
url = https://github.com/andreasscherbaum/ansible-lxc-ssh.git
|
||||||
|
[submodule "roles.extern/deapparmor"]
|
||||||
|
path = roles.extern/deapparmor
|
||||||
|
url = https://git.velt.biz/Ansible/role.deapparmor.git
|
||||||
|
[submodule "roles.extern/grub_add_cmdlineparameter"]
|
||||||
|
path = roles.extern/grub_add_cmdlineparameter
|
||||||
|
url = https://git.velt.biz/Ansible/role.grub_add_cmdlineparameter.git
|
||||||
|
[submodule "roles.extern/prepare_lxc_host"]
|
||||||
|
path = roles.extern/prepare_lxc_host
|
||||||
|
url = https://git.velt.biz/Ansible/role.prepare_lxc_host.git
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
Subproject commit 731cbce856522cc5205c50e08b5e238b5266ef2c
|
Subproject commit 87dd3cd37ad9b11cc780d3c87989b9944c193923
|
|
@ -1,15 +1,17 @@
|
||||||
[defaults]
|
[defaults]
|
||||||
inventory = ./hosts
|
inventory = ./hosts
|
||||||
|
|
||||||
|
roles_path = ./roles.extern
|
||||||
|
|
||||||
connection_plugins = ./connection_plugins/
|
connection_plugins = ./connection_plugins/
|
||||||
|
|
||||||
interpreter_python = auto
|
interpreter_python = auto
|
||||||
|
|
||||||
retry_files_enabled = True
|
retry_files_enabled = True
|
||||||
retry_files_save_path = ./Retry/
|
retry_files_save_path = ./.cache/retry/
|
||||||
|
|
||||||
fact_caching = yaml
|
fact_caching = yaml
|
||||||
fact_caching_connection = ./.facts
|
fact_caching_connection = ./.cache/facts
|
||||||
gathering = smart
|
gathering = smart
|
||||||
|
|
||||||
host_key_checking = false
|
host_key_checking = false
|
||||||
|
|
|
@ -17,6 +17,14 @@
|
||||||
#service_password: {{ service_username }}
|
#service_password: {{ service_username }}
|
||||||
#service_ssh_keys: {{ ssh_keys }}
|
#service_ssh_keys: {{ ssh_keys }}
|
||||||
|
|
||||||
|
# architecture mapping from "uname -m" to package
|
||||||
|
architecture_mapping:
|
||||||
|
aarch64: arm64
|
||||||
|
x86_64: amd64
|
||||||
|
#ppc64le: ppc64el
|
||||||
|
#s390x: s390x
|
||||||
|
#armv7l: armhf
|
||||||
|
|
||||||
# "*cmdline_" must be listed AFTER "^cmdline_"!
|
# "*cmdline_" must be listed AFTER "^cmdline_"!
|
||||||
cmdline_python:
|
cmdline_python:
|
||||||
alpine:
|
alpine:
|
||||||
|
@ -44,6 +52,12 @@
|
||||||
voidlinux:
|
voidlinux:
|
||||||
- "xbps-install -Suy python3 libgcc"
|
- "xbps-install -Suy python3 libgcc"
|
||||||
|
|
||||||
|
cmdline_python2:
|
||||||
|
debian: &cmdline_python2_debian
|
||||||
|
- "apt-get -y update"
|
||||||
|
- "apt-get install -y python python-apt"
|
||||||
|
ubuntu: *cmdline_python2_debian
|
||||||
|
|
||||||
cmdline_fixes:
|
cmdline_fixes:
|
||||||
oracle:
|
oracle:
|
||||||
8:
|
8:
|
||||||
|
@ -76,6 +90,13 @@
|
||||||
when: inventory_hostname in groups.lxc_hosts
|
when: inventory_hostname in groups.lxc_hosts
|
||||||
|
|
||||||
|
|
||||||
|
- name: Sanity checks
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- ssh_keys is defined and ssh_keys is iterable
|
||||||
|
- service_user is not defined or service_user|regex_search('^[a-z][a-z0-9-]+$')
|
||||||
|
|
||||||
|
|
||||||
- name: Check for no-validate parameter in download template
|
- name: Check for no-validate parameter in download template
|
||||||
shell: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true"
|
shell: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true"
|
||||||
changed_when: false
|
changed_when: false
|
||||||
|
@ -83,12 +104,19 @@
|
||||||
delegate_to: "{{ ansible_host|default('localhost') }}"
|
delegate_to: "{{ ansible_host|default('localhost') }}"
|
||||||
|
|
||||||
|
|
||||||
|
- name: Get architecture
|
||||||
|
shell: "uname -m || true"
|
||||||
|
changed_when: false
|
||||||
|
register: lxc_host_arch_native
|
||||||
|
delegate_to: "{{ ansible_host|default('localhost') }}"
|
||||||
|
|
||||||
|
|
||||||
- name: Create LXContainer
|
- name: Create LXContainer
|
||||||
lxc_container:
|
lxc_container:
|
||||||
name: "{{ inventory_hostname }}"
|
name: "{{ inventory_hostname }}"
|
||||||
state: started
|
state: started
|
||||||
template: download
|
template: download
|
||||||
template_options: "-a amd64 -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
|
template_options: "-a {{ architecture_mapping[lxc_host_arch_native.stdout] }} -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
|
||||||
config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}"
|
config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}"
|
||||||
container_config:
|
container_config:
|
||||||
- "lxc.group = {{ os_d }}"
|
- "lxc.group = {{ os_d }}"
|
||||||
|
@ -102,9 +130,16 @@
|
||||||
when: lxc_created is changed
|
when: lxc_created is changed
|
||||||
|
|
||||||
|
|
||||||
- name: Raw-Install Python
|
- name: Raw-Install Python3
|
||||||
raw: "{{ item }}"
|
raw: "{{ item }}"
|
||||||
loop: "{{ cmdline_python[os_d] }}"
|
loop: "{{ cmdline_python[os_d] }}"
|
||||||
|
when: use_python2 != True
|
||||||
|
|
||||||
|
|
||||||
|
- name: Raw-Install Python2
|
||||||
|
raw: "{{ item }}"
|
||||||
|
loop: "{{ cmdline_python2[os_d] }}"
|
||||||
|
when: use_python2 == True
|
||||||
|
|
||||||
|
|
||||||
- name: OS-dependent fixes
|
- name: OS-dependent fixes
|
||||||
|
@ -120,10 +155,30 @@
|
||||||
|
|
||||||
|
|
||||||
- name: Add SSH keys
|
- name: Add SSH keys
|
||||||
authorized_key:
|
block:
|
||||||
user: root
|
- name: "1st try: authorized_key module"
|
||||||
key: "{{ item }}"
|
authorized_key:
|
||||||
loop: "{{ ssh_keys }}"
|
user: root
|
||||||
|
key: "{{ item }}"
|
||||||
|
loop: "{{ ssh_keys }}"
|
||||||
|
rescue:
|
||||||
|
- name: "2nd try: create ~/.ssh directory"
|
||||||
|
file:
|
||||||
|
path: /root/.ssh/
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0700
|
||||||
|
- name: "2nd try: add key via lineinfile module"
|
||||||
|
lineinfile:
|
||||||
|
path: /root/.ssh/authorized_keys
|
||||||
|
line: "{{ item }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0600
|
||||||
|
create: yes
|
||||||
|
backup: yes
|
||||||
|
loop: "{{ ssh_keys }}"
|
||||||
|
|
||||||
|
|
||||||
- name: "[BLOCK] when 'service_username' is set"
|
- name: "[BLOCK] when 'service_username' is set"
|
||||||
|
@ -141,10 +196,36 @@
|
||||||
|
|
||||||
|
|
||||||
- name: Add SSH keys
|
- name: Add SSH keys
|
||||||
authorized_key:
|
block:
|
||||||
user: "{{ service_username }}"
|
- name: "1st try: authorized_key module"
|
||||||
key: "{{ item }}"
|
authorized_key:
|
||||||
loop: "{{ ssh_keys_service|default(ssh_keys) }}"
|
user: "{{ service_username }}"
|
||||||
|
key: "{{ item }}"
|
||||||
|
loop: "{{ ssh_keys_service|default(ssh_keys) }}"
|
||||||
|
rescue:
|
||||||
|
- name: "2nd try: get homedir of user"
|
||||||
|
getent:
|
||||||
|
database: passwd
|
||||||
|
key: "{{ service_username }}"
|
||||||
|
split: ":"
|
||||||
|
- name: "2nd try: create ~/.ssh directory"
|
||||||
|
file:
|
||||||
|
path: "{{ getent_passwd[service_username][4] }}/.ssh/"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ service_username }}"
|
||||||
|
group: "{{ service_username }}"
|
||||||
|
mode: 0700
|
||||||
|
- name: "2nd try: add key via lineinfile module"
|
||||||
|
lineinfile:
|
||||||
|
path: "{{ getent_passwd[service_username][4] }}/.ssh/authorized_keys"
|
||||||
|
line: "{{ item }}"
|
||||||
|
owner: "{{ service_username }}"
|
||||||
|
group: "{{ service_username }}"
|
||||||
|
mode: 0600
|
||||||
|
create: yes
|
||||||
|
backup: yes
|
||||||
|
loop: "{{ ssh_keys }}"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- name: Install sudo
|
- name: Install sudo
|
||||||
|
@ -154,9 +235,10 @@
|
||||||
|
|
||||||
- name: Add sudo line for service
|
- name: Add sudo line for service
|
||||||
lineinfile:
|
lineinfile:
|
||||||
path: /etc/sudoers
|
path: "/etc/sudoers.d/{{ service_username }}"
|
||||||
regexp: "^service"
|
regexp: "^service"
|
||||||
line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL"
|
line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL"
|
||||||
|
create: yes
|
||||||
backup: yes
|
backup: yes
|
||||||
|
|
||||||
|
|
||||||
|
|
45
prepare_lxc_host.yml
Normal file
45
prepare_lxc_host.yml
Normal file
|
@ -0,0 +1,45 @@
|
||||||
|
---
|
||||||
|
- hosts: all
|
||||||
|
|
||||||
|
gather_facts: no
|
||||||
|
|
||||||
|
|
||||||
|
pre_tasks:
|
||||||
|
- name: 'Output configured connection plugin via "ansible_connection" variable'
|
||||||
|
debug:
|
||||||
|
var: ansible_connection
|
||||||
|
tags:
|
||||||
|
- never
|
||||||
|
- debug
|
||||||
|
|
||||||
|
- name: End for non-LXContainer
|
||||||
|
meta: end_host
|
||||||
|
when: "'lxc' in ansible_connection|default('')"
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
|
||||||
|
- name: Manually gather facts (for LXC hosts only)
|
||||||
|
ansible.builtin.gather_facts:
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- role: deapparmor
|
||||||
|
deapparmor_reboot: True
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
|
||||||
|
- role: grub_add_cmdlineparameter
|
||||||
|
grub_add_cmdlineparameter:
|
||||||
|
systemd.unified_cgroup_hierarchy: 0
|
||||||
|
cgroup_enable: memory
|
||||||
|
swapaccount: 1
|
||||||
|
vsyscall: emulate
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
|
||||||
|
- role: prepare_lxc_host
|
||||||
|
tags:
|
||||||
|
- always
|
||||||
|
|
|
@ -1,137 +0,0 @@
|
||||||
---
|
|
||||||
- hosts:
|
|
||||||
- lxc_hosts
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- assert:
|
|
||||||
that:
|
|
||||||
- ansible_pkg_mgr == "apt"
|
|
||||||
fail_msg: "Sorry, Debian-like hosts only!"
|
|
||||||
|
|
||||||
|
|
||||||
- name: Just to be sure python3-apt is installed
|
|
||||||
command: apt install -y python3-apt
|
|
||||||
args:
|
|
||||||
creates: /usr/lib/python3/dist-packages/apt
|
|
||||||
|
|
||||||
|
|
||||||
- name: Install packages
|
|
||||||
package:
|
|
||||||
name: "{{ packages }}"
|
|
||||||
state: latest
|
|
||||||
vars:
|
|
||||||
packages:
|
|
||||||
- bridge-utils
|
|
||||||
- dnsmasq
|
|
||||||
- iptables
|
|
||||||
- lxc
|
|
||||||
- python3-lxc
|
|
||||||
|
|
||||||
|
|
||||||
- name: Copy config files
|
|
||||||
copy:
|
|
||||||
src: "{{ item }}"
|
|
||||||
dest: "/{{ item }}"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
loop:
|
|
||||||
- etc/dnsmasq.d/br-lxc
|
|
||||||
- etc/lxc/ansible.conf
|
|
||||||
- etc/network/interfaces.d/br-lxc
|
|
||||||
notify:
|
|
||||||
- Restart dnsmasq
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- name: Fix evil Debian default /etc/network/interfaces
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/network/interfaces
|
|
||||||
regexp: 'source.*interfaces.d'
|
|
||||||
line: 'source-directory /etc/network/interfaces.d'
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
|
|
||||||
- name: dnsmasq should use /etc/resolv.conf
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/default/dnsmasq
|
|
||||||
line: 'IGNORE_RESOLVCONF=yes'
|
|
||||||
regexp: '^\s*#*\s*IGNORE_RESOLVCONF=yes'
|
|
||||||
backup: yes
|
|
||||||
notify:
|
|
||||||
- Restart dnsmasq
|
|
||||||
|
|
||||||
|
|
||||||
- name: IPv4-Forwarding
|
|
||||||
sysctl:
|
|
||||||
name: net.ipv4.ip_forward
|
|
||||||
value: '1'
|
|
||||||
sysctl_file: /etc/sysctl.d/lxc.conf
|
|
||||||
sysctl_set: yes
|
|
||||||
state: present
|
|
||||||
reload: yes
|
|
||||||
|
|
||||||
|
|
||||||
- name: Raise inotify limit
|
|
||||||
sysctl:
|
|
||||||
name: fs.inotify.max_user_instances
|
|
||||||
value: '1024'
|
|
||||||
sysctl_file: 30-lxc-inotify.conf
|
|
||||||
sysctl_set: yes
|
|
||||||
state: present
|
|
||||||
reload: yes
|
|
||||||
|
|
||||||
|
|
||||||
- name: Enable CAP_SYS_TIME in Container
|
|
||||||
lineinfile:
|
|
||||||
dest: /usr/share/lxc/config/common.conf
|
|
||||||
backrefs: yes
|
|
||||||
regexp: '(^\s*[^#].*)sys_time ?(.*)$'
|
|
||||||
line: '\1\2'
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
|
|
||||||
- name: lxc-net with systemd
|
|
||||||
block:
|
|
||||||
- name: Stop lxc-net service
|
|
||||||
systemd:
|
|
||||||
name: lxc-net
|
|
||||||
state: stopped
|
|
||||||
|
|
||||||
- name: Disable lxc-net service
|
|
||||||
systemd:
|
|
||||||
name: lxc-net
|
|
||||||
enabled: no
|
|
||||||
|
|
||||||
- name: Mask lxc-net service
|
|
||||||
systemd:
|
|
||||||
name: lxc-net
|
|
||||||
masked: yes
|
|
||||||
when: ansible_service_mgr == "systemd"
|
|
||||||
|
|
||||||
|
|
||||||
- name: lxc-net without systemd
|
|
||||||
block:
|
|
||||||
- name: Disable lxc-net
|
|
||||||
service:
|
|
||||||
name: lxc-net
|
|
||||||
enabled: no
|
|
||||||
state: stopped
|
|
||||||
ignore_errors: yes
|
|
||||||
when: ansible_service_mgr != "systemd"
|
|
||||||
|
|
||||||
|
|
||||||
- name: Bring up br-lxc
|
|
||||||
command: ifup br-lxc
|
|
||||||
args:
|
|
||||||
creates: /sys/devices/virtual/net/br-lxc
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart dnsmasq
|
|
||||||
service:
|
|
||||||
name: dnsmasq
|
|
||||||
state: restarted
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
1
roles.extern/deapparmor
Submodule
1
roles.extern/deapparmor
Submodule
|
@ -0,0 +1 @@
|
||||||
|
Subproject commit 9cf7fcaa026c3771b7740915d6151f18fdb7fc15
|
1
roles.extern/grub_add_cmdlineparameter
Submodule
1
roles.extern/grub_add_cmdlineparameter
Submodule
|
@ -0,0 +1 @@
|
||||||
|
Subproject commit d401c517fd71d2f828ee7c4757357dbd090e6dd1
|
1
roles.extern/prepare_lxc_host
Submodule
1
roles.extern/prepare_lxc_host
Submodule
|
@ -0,0 +1 @@
|
||||||
|
Subproject commit dd1a20fa2e6cb483bb2f1429dd093bf078eb0df2
|
Loading…
Reference in a new issue