Update submodules

Tested for amd64/x86_64 and arm64/aarch64

.gitignore

@@ -1,5 +1,6 @@
 group_vars/all.yml
 hosts.*
+.cache
 
 # ---> Python
 # Byte-compiled / optimized / DLL files

.gitmodules

@@ -1,3 +1,12 @@
 [submodule ".submodules/ansible-lxc-ssh"]
 	path = .submodules/ansible-lxc-ssh
 	url = https://github.com/andreasscherbaum/ansible-lxc-ssh.git
+[submodule "roles.extern/deapparmor"]
+	path = roles.extern/deapparmor
+	url = https://git.velt.biz/Ansible/role.deapparmor.git
+[submodule "roles.extern/grub_add_cmdlineparameter"]
+	path = roles.extern/grub_add_cmdlineparameter
+	url = https://git.velt.biz/Ansible/role.grub_add_cmdlineparameter.git
+[submodule "roles.extern/prepare_lxc_host"]
+	path = roles.extern/prepare_lxc_host
+	url = https://git.velt.biz/Ansible/role.prepare_lxc_host.git

.submodules/ansible-lxc-ssh

@@ -1 +1 @@
-Subproject commit 731cbce856522cc5205c50e08b5e238b5266ef2c
+Subproject commit 421cf205401a9de71c00264d5c8f22e74c16dca8

ansible.cfg

@@ -1,15 +1,17 @@
 [defaults]
 inventory = ./hosts
 
+roles_path = ./roles.extern
+
 connection_plugins = ./connection_plugins/
 
 interpreter_python = auto
 
 retry_files_enabled = True
-retry_files_save_path = ./Retry/
+retry_files_save_path = ./.cache/retry/
 
 fact_caching = yaml
-fact_caching_connection = ./.facts
+fact_caching_connection = ./.cache/facts
 gathering = smart
 
 host_key_checking = false

create_inventory_lxc.yml

@@ -3,198 +3,7 @@
 
   gather_facts: no
 
-  #serial: 1
-
-  vars:
-    # List(!) of SSH keys for authorized_keys. Set here or in group_vars/all.yml
-    #ssh_keys: []
-    #
-    # root password, default: "root"
-    #root_password: root
-    #
-    # Normal user account (with sudo)
-    #service_username: service
-    #service_password: {{ service_username }}
-    #service_ssh_keys: {{ ssh_keys }}
-
-    # "*cmdline_" must be listed AFTER "^cmdline_"!
-    cmdline_python:
-      alpine:
-        - "apk add -U python3"
-      archlinux:
-        - "pacman -Sy"
-        - "pacman -S --noconfirm python"
-      centos: &cmdline_python_centos
-        - "yum clean all"
-        - "yum makecache"
-        - "yum install -y python3 || true"
-      almalinux: *cmdline_python_centos
-      fedora: *cmdline_python_centos
-      oracle: *cmdline_python_centos
-      rockylinux: *cmdline_python_centos
-      debian: &cmdline_python_debian
-        - "apt-get -y update"
-        - "apt-get install -y python3 python3-apt"
-      devuan: *cmdline_python_debian
-      mint: *cmdline_python_debian
-      ubuntu: *cmdline_python_debian
-      opensuse:
-        - "zypper --gpg-auto-import-keys --no-gpg-checks -n refresh"
-        - "zypper --gpg-auto-import-keys --no-gpg-checks -n install python3"
-      voidlinux:
-        - "xbps-install -Suy python3 libgcc"
-
-    cmdline_fixes:
-      oracle:
-        8:
-          - '[ ! -f /usr/bin/python3 ] && ln -s /usr/libexec/platform-python /usr/bin/python3 || true'
-
-    ssh_package_name:
-      alpine: openssh
-      archlinux: openssh
-      opensuse: openssh
-      voidlinux: openssh
-
-    ssh_config_filename:
-      opensuse-tumbleweed: /etc/ssh/sshd_config.d/permitrootlogin.conf
-
-    ssh_service_name:
-      debian: ssh
-      devuan: ssh
-      mint: ssh
-      ubuntu: ssh
-
-    user_shell:
-      alpine: /bin/ash
-
-
-
-  tasks:
-
-    - name: End for non-LXContainer
-      meta: end_host
-      when: inventory_hostname in groups.lxc_hosts
-
-
-    - name: Check for no-validate parameter in download template
-      shell: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true"
-      changed_when: false
-      register: lxc_download_validate
-      delegate_to: "{{ ansible_host|default('localhost') }}"
-
-
-    - name: Create LXContainer
-      lxc_container:
-        name: "{{ inventory_hostname }}"
-        state: started
-        template: download
-        template_options: "-a amd64 -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
-        config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}"
-        container_config:
-          - "lxc.group = {{ os_d }}"
-          - "lxc.group = {{ (cmdline_python[os_d][0]).split(' ')[0].split('-')[0] }}"
-      register: lxc_created
-      delegate_to: "{{ ansible_host|default('localhost') }}"
-
-
-    - pause:
-        seconds: 10
-      when: lxc_created is changed
-
-
-    - name: Raw-Install Python
-      raw: "{{ item }}"
-      loop: "{{ cmdline_python[os_d] }}"
-
-
-    - name: OS-dependent fixes
-      raw: "{{ item }}"
-      loop: "{{ cmdline_fixes[os_d][os_r]|default([]) }}"
-
-
-    - setup:
-
-
-    - name: Set root password
-      shell: "echo root:{{ root_password|default('root') }} | chpasswd -c SHA256"
-
-
-    - name: Add SSH keys
-      authorized_key:
-        user: root
-        key: "{{ item }}"
-      loop: "{{ ssh_keys }}"
-
-
-    - name: "[BLOCK] when 'service_username' is set"
-      when: service_username is defined
-      block:
-
-        - name: 'Add normal user "{{ service_username }}"'
-          user:
-            name: "{{ service_username }}"
-            shell: "{{ user_shell[os_d]|default('/bin/bash') }}"
-
-
-        - name: 'Set password for user "{{ service_username }}"'
-          shell: "echo {{ service_username }}:{{ service_password|default(service_username) }} | chpasswd -c SHA256"
-
-
-        - name: Add SSH keys
-          authorized_key:
-            user: "{{ service_username }}"
-            key: "{{ item }}"
-          loop: "{{ ssh_keys_service|default(ssh_keys) }}"
-
-
-        - name: Install sudo
-          package:
-            name: sudo
-
-
-        - name: Add sudo line for service
-          lineinfile:
-            path: /etc/sudoers
-            regexp: "^service"
-            line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL"
-            backup: yes
-
-
-    - name: Install SSH
-      package:
-        name: "{{ ssh_package_name[os_d]|default('openssh-server') }}"
-        state: latest
-
-
-    - name: "Set «PermitRootLogin» to «yes»"
-      lineinfile:
-        dest: "{{ ssh_config_filename[os_d + '-' + os_r|string]|default('/etc/ssh/sshd_config') }}"
-        regexp: '^#? *PermitRootLogin'
-        line: "PermitRootLogin yes"
-        create: yes
-        backup: yes
-      notify: "Restart SSH"
-
-
-    - name: Enable SSH
-      service:
-        name: "{{ ssh_service_name[os_d]|default('sshd') }}"
-        enabled: yes
-
-
-    - name: Start SSH
-      service:
-        name: "{{ ssh_service_name[os_d]|default('sshd') }}"
-        state: started
-      ignore_errors: yes
-
-
-
-  handlers:
-
-    - name: Restart SSH
-      service:
-        name: "{{ ssh_service_name[os_d]|default('sshd') }}"
-        state: restarted
-
+  roles:
+    - role: lxc_create
+      when: inventory_hostname not in list_of_lxc_hosts|default(groups.lxc_hosts)
 

prepare_lxc_host.yml

@@ -0,0 +1,45 @@
+---
+- hosts: all
+
+  gather_facts: no
+
+
+  pre_tasks:
+    - name: 'Output configured connection plugin via "ansible_connection" variable'
+      debug:
+        var: ansible_connection
+      tags:
+        - never
+        - debug
+
+    - name: End for LXContainer
+      meta: end_host
+      when: "'lxc' in ansible_connection|default('')"
+      tags:
+        - always
+
+    - name: Manually gather facts (for LXC hosts only)
+      ansible.builtin.gather_facts:
+      tags:
+        - always
+
+
+  roles:
+    - role: deapparmor
+      deapparmor_reboot: True
+      tags:
+        - always
+
+    - role: grub_add_cmdlineparameter
+      grub_add_cmdlineparameter:
+        systemd.unified_cgroup_hierarchy: 0
+        cgroup_enable: memory
+        swapaccount: 1
+        vsyscall: emulate
+      tags:
+        - always
+
+    - role: prepare_lxc_host
+      tags:
+        - always
+

prepare_lxc_hosts.yml

@@ -1,137 +0,0 @@
----
-- hosts:
-  - lxc_hosts
-
-  tasks:
-    - assert:
-        that:
-          - ansible_pkg_mgr == "apt"
-        fail_msg: "Sorry, Debian-like hosts only!"
-
-
-    - name: Just to be sure python3-apt is installed
-      command: apt install -y python3-apt
-      args:
-        creates: /usr/lib/python3/dist-packages/apt
-
-
-    - name: Install packages
-      package:
-        name: "{{ packages }}"
-        state: latest
-      vars:
-        packages:
-          - bridge-utils
-          - dnsmasq
-          - iptables
-          - lxc
-          - python3-lxc
-
-
-    - name: Copy config files
-      copy:
-        src: "{{ item }}"
-        dest: "/{{ item }}"
-        owner: root
-        group: root
-        mode: 0644
-      loop:
-        - etc/dnsmasq.d/br-lxc
-        - etc/lxc/ansible.conf
-        - etc/network/interfaces.d/br-lxc
-      notify:
-        - Restart dnsmasq
-
-
-
-    - name: Fix evil Debian default /etc/network/interfaces
-      lineinfile:
-        dest: /etc/network/interfaces
-        regexp: 'source.*interfaces.d'
-        line: 'source-directory /etc/network/interfaces.d'
-        backup: yes
-
-
-    - name: dnsmasq should use /etc/resolv.conf
-      lineinfile:
-        path: /etc/default/dnsmasq
-        line: 'IGNORE_RESOLVCONF=yes'
-        regexp: '^\s*#*\s*IGNORE_RESOLVCONF=yes'
-        backup: yes
-      notify:
-        - Restart dnsmasq
-
-
-    - name: IPv4-Forwarding
-      sysctl:
-        name: net.ipv4.ip_forward
-        value: '1'
-        sysctl_file: /etc/sysctl.d/lxc.conf
-        sysctl_set: yes
-        state: present
-        reload: yes
-
-
-    - name: Raise inotify limit
-      sysctl:
-        name: fs.inotify.max_user_instances
-        value: '1024'
-        sysctl_file: 30-lxc-inotify.conf
-        sysctl_set: yes
-        state: present
-        reload: yes
-
-
-    - name: Enable CAP_SYS_TIME in Container
-      lineinfile:
-        dest: /usr/share/lxc/config/common.conf
-        backrefs: yes
-        regexp: '(^\s*[^#].*)sys_time ?(.*)$'
-        line: '\1\2'
-        backup: yes
-
-
-    - name: lxc-net with systemd
-      block:
-        - name: Stop lxc-net service
-          systemd:
-            name: lxc-net
-            state: stopped
-
-        - name: Disable lxc-net service
-          systemd:
-            name: lxc-net
-            enabled: no
-
-        - name: Mask lxc-net service
-          systemd:
-            name: lxc-net
-            masked: yes
-      when: ansible_service_mgr == "systemd"
-
-
-    - name: lxc-net without systemd
-      block:
-        - name: Disable lxc-net
-          service:
-            name: lxc-net
-            enabled: no
-            state: stopped
-          ignore_errors: yes
-      when: ansible_service_mgr != "systemd"
-
-
-    - name: Bring up br-lxc
-      command: ifup br-lxc
-      args:
-        creates: /sys/devices/virtual/net/br-lxc
-
-
-
-  handlers:
-    - name: Restart dnsmasq
-      service:
-        name: dnsmasq
-        state: restarted
-      ignore_errors: yes
-

roles.extern/deapparmor

@@ -0,0 +1 @@
+Subproject commit 9cf7fcaa026c3771b7740915d6151f18fdb7fc15

roles.extern/grub_add_cmdlineparameter

@@ -0,0 +1 @@
+Subproject commit d401c517fd71d2f828ee7c4757357dbd090e6dd1

roles.extern/prepare_lxc_host

@@ -0,0 +1 @@
+Subproject commit c572903e89b56ddb2fb3051e0651f2c26e436ac6