Detect architecture of host machine for LXC images

Tested for amd64/x86_64 and arm64/aarch64

.gitignore

@@ -1,5 +1,6 @@
 group_vars/all.yml
 hosts.*
+.cache
 
 # ---> Python
 # Byte-compiled / optimized / DLL files

.gitmodules

@@ -1,3 +1,12 @@
 [submodule ".submodules/ansible-lxc-ssh"]
 	path = .submodules/ansible-lxc-ssh
 	url = https://github.com/andreasscherbaum/ansible-lxc-ssh.git
+[submodule "roles.extern/deapparmor"]
+	path = roles.extern/deapparmor
+	url = https://git.velt.biz/Ansible/role.deapparmor.git
+[submodule "roles.extern/grub_add_cmdlineparameter"]
+	path = roles.extern/grub_add_cmdlineparameter
+	url = https://git.velt.biz/Ansible/role.grub_add_cmdlineparameter.git
+[submodule "roles.extern/prepare_lxc_host"]
+	path = roles.extern/prepare_lxc_host
+	url = https://git.velt.biz/Ansible/role.prepare_lxc_host.git

.submodules/ansible-lxc-ssh

@@ -1 +1 @@
-Subproject commit 731cbce856522cc5205c50e08b5e238b5266ef2c
+Subproject commit 87dd3cd37ad9b11cc780d3c87989b9944c193923

ansible.cfg

@@ -1,15 +1,17 @@
 [defaults]
 inventory = ./hosts
 
+roles_path = ./roles.extern
+
 connection_plugins = ./connection_plugins/
 
 interpreter_python = auto
 
 retry_files_enabled = True
-retry_files_save_path = ./Retry/
+retry_files_save_path = ./.cache/retry/
 
 fact_caching = yaml
-fact_caching_connection = ./.facts
+fact_caching_connection = ./.cache/facts
 gathering = smart
 
 host_key_checking = false

create_inventory_lxc.yml

@@ -17,6 +17,14 @@
     #service_password: {{ service_username }}
     #service_ssh_keys: {{ ssh_keys }}
 
+    # architecture mapping from "uname -m" to package
+    architecture_mapping:
+      aarch64: arm64
+      x86_64: amd64
+      #ppc64le: ppc64el
+      #s390x: s390x
+      #armv7l: armhf
+
     # "*cmdline_" must be listed AFTER "^cmdline_"!
     cmdline_python:
       alpine:
@@ -44,6 +52,12 @@
       voidlinux:
         - "xbps-install -Suy python3 libgcc"
 
+    cmdline_python2:
+      debian: &cmdline_python2_debian
+        - "apt-get -y update"
+        - "apt-get install -y python python-apt"
+      ubuntu: *cmdline_python2_debian
+
     cmdline_fixes:
       oracle:
         8:
@@ -76,6 +90,13 @@
       when: inventory_hostname in groups.lxc_hosts
 
 
+    - name: Sanity checks
+      assert:
+        that:
+          - ssh_keys is defined and ssh_keys is iterable
+          - service_user is not defined or service_user|regex_search('^[a-z][a-z0-9-]+$')
+
+
     - name: Check for no-validate parameter in download template
       shell: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true"
       changed_when: false
@@ -83,12 +104,19 @@
       delegate_to: "{{ ansible_host|default('localhost') }}"
 
 
+    - name: Get architecture
+      shell: "uname -m || true"
+      changed_when: false
+      register: lxc_host_arch_native
+      delegate_to: "{{ ansible_host|default('localhost') }}"
+
+
     - name: Create LXContainer
       lxc_container:
         name: "{{ inventory_hostname }}"
         state: started
         template: download
-        template_options: "-a amd64 -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
+        template_options: "-a {{ architecture_mapping[lxc_host_arch_native.stdout] }} -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
         config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}"
         container_config:
           - "lxc.group = {{ os_d }}"
@@ -102,9 +130,16 @@
       when: lxc_created is changed
 
 
-    - name: Raw-Install Python
+    - name: Raw-Install Python3
       raw: "{{ item }}"
       loop: "{{ cmdline_python[os_d] }}"
+      when: use_python2 != True
+
+
+    - name: Raw-Install Python2
+      raw: "{{ item }}"
+      loop: "{{ cmdline_python2[os_d] }}"
+      when: use_python2 == True
 
 
     - name: OS-dependent fixes
@@ -120,10 +155,30 @@
 
 
     - name: Add SSH keys
+      block:
+        - name: "1st try: authorized_key module"
           authorized_key:
             user: root
             key: "{{ item }}"
           loop: "{{ ssh_keys }}"
+      rescue:
+        - name: "2nd try: create ~/.ssh directory"
+          file:
+            path: /root/.ssh/
+            state: directory
+            owner: root
+            group: root
+            mode: 0700
+        - name: "2nd try: add key via lineinfile module"
+          lineinfile:
+            path: /root/.ssh/authorized_keys
+            line: "{{ item }}"
+            owner: root
+            group: root
+            mode: 0600
+            create: yes
+            backup: yes
+          loop: "{{ ssh_keys }}"
 
 
     - name: "[BLOCK] when 'service_username' is set"
@@ -141,10 +196,36 @@
 
 
         - name: Add SSH keys
+          block:
+            - name: "1st try: authorized_key module"
               authorized_key:
                 user: "{{ service_username }}"
                 key: "{{ item }}"
               loop: "{{ ssh_keys_service|default(ssh_keys) }}"
+          rescue:
+            - name: "2nd try: get homedir of user"
+              getent:
+                database: passwd
+                key: "{{ service_username }}"
+                split: ":"
+            - name: "2nd try: create ~/.ssh directory"
+              file:
+                path: "{{ getent_passwd[service_username][4] }}/.ssh/"
+                state: directory
+                owner: "{{ service_username }}"
+                group: "{{ service_username }}"
+                mode: 0700
+            - name: "2nd try: add key via lineinfile module"
+              lineinfile:
+                path: "{{ getent_passwd[service_username][4] }}/.ssh/authorized_keys"
+                line: "{{ item }}"
+                owner: "{{ service_username }}"
+                group: "{{ service_username }}"
+                mode: 0600
+                create: yes
+                backup: yes
+              loop: "{{ ssh_keys }}"
+
 
 
         - name: Install sudo
@@ -154,9 +235,10 @@
 
         - name: Add sudo line for service
           lineinfile:
-            path: /etc/sudoers
+            path: "/etc/sudoers.d/{{ service_username }}"
             regexp: "^service"
             line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL"
+            create: yes
             backup: yes
 
 

prepare_lxc_host.yml

@@ -0,0 +1,45 @@
+---
+- hosts: all
+
+  gather_facts: no
+
+
+  pre_tasks:
+    - name: 'Output configured connection plugin via "ansible_connection" variable'
+      debug:
+        var: ansible_connection
+      tags:
+        - never
+        - debug
+
+    - name: End for non-LXContainer
+      meta: end_host
+      when: "'lxc' in ansible_connection|default('')"
+      tags:
+        - always
+
+    - name: Manually gather facts (for LXC hosts only)
+      ansible.builtin.gather_facts:
+      tags:
+        - always
+
+
+  roles:
+    - role: deapparmor
+      deapparmor_reboot: True
+      tags:
+        - always
+
+    - role: grub_add_cmdlineparameter
+      grub_add_cmdlineparameter:
+        systemd.unified_cgroup_hierarchy: 0
+        cgroup_enable: memory
+        swapaccount: 1
+        vsyscall: emulate
+      tags:
+        - always
+
+    - role: prepare_lxc_host
+      tags:
+        - always
+

prepare_lxc_hosts.yml

@@ -1,137 +0,0 @@
----
-- hosts:
-  - lxc_hosts
-
-  tasks:
-    - assert:
-        that:
-          - ansible_pkg_mgr == "apt"
-        fail_msg: "Sorry, Debian-like hosts only!"
-
-
-    - name: Just to be sure python3-apt is installed
-      command: apt install -y python3-apt
-      args:
-        creates: /usr/lib/python3/dist-packages/apt
-
-
-    - name: Install packages
-      package:
-        name: "{{ packages }}"
-        state: latest
-      vars:
-        packages:
-          - bridge-utils
-          - dnsmasq
-          - iptables
-          - lxc
-          - python3-lxc
-
-
-    - name: Copy config files
-      copy:
-        src: "{{ item }}"
-        dest: "/{{ item }}"
-        owner: root
-        group: root
-        mode: 0644
-      loop:
-        - etc/dnsmasq.d/br-lxc
-        - etc/lxc/ansible.conf
-        - etc/network/interfaces.d/br-lxc
-      notify:
-        - Restart dnsmasq
-
-
-
-    - name: Fix evil Debian default /etc/network/interfaces
-      lineinfile:
-        dest: /etc/network/interfaces
-        regexp: 'source.*interfaces.d'
-        line: 'source-directory /etc/network/interfaces.d'
-        backup: yes
-
-
-    - name: dnsmasq should use /etc/resolv.conf
-      lineinfile:
-        path: /etc/default/dnsmasq
-        line: 'IGNORE_RESOLVCONF=yes'
-        regexp: '^\s*#*\s*IGNORE_RESOLVCONF=yes'
-        backup: yes
-      notify:
-        - Restart dnsmasq
-
-
-    - name: IPv4-Forwarding
-      sysctl:
-        name: net.ipv4.ip_forward
-        value: '1'
-        sysctl_file: /etc/sysctl.d/lxc.conf
-        sysctl_set: yes
-        state: present
-        reload: yes
-
-
-    - name: Raise inotify limit
-      sysctl:
-        name: fs.inotify.max_user_instances
-        value: '1024'
-        sysctl_file: 30-lxc-inotify.conf
-        sysctl_set: yes
-        state: present
-        reload: yes
-
-
-    - name: Enable CAP_SYS_TIME in Container
-      lineinfile:
-        dest: /usr/share/lxc/config/common.conf
-        backrefs: yes
-        regexp: '(^\s*[^#].*)sys_time ?(.*)$'
-        line: '\1\2'
-        backup: yes
-
-
-    - name: lxc-net with systemd
-      block:
-        - name: Stop lxc-net service
-          systemd:
-            name: lxc-net
-            state: stopped
-
-        - name: Disable lxc-net service
-          systemd:
-            name: lxc-net
-            enabled: no
-
-        - name: Mask lxc-net service
-          systemd:
-            name: lxc-net
-            masked: yes
-      when: ansible_service_mgr == "systemd"
-
-
-    - name: lxc-net without systemd
-      block:
-        - name: Disable lxc-net
-          service:
-            name: lxc-net
-            enabled: no
-            state: stopped
-          ignore_errors: yes
-      when: ansible_service_mgr != "systemd"
-
-
-    - name: Bring up br-lxc
-      command: ifup br-lxc
-      args:
-        creates: /sys/devices/virtual/net/br-lxc
-
-
-
-  handlers:
-    - name: Restart dnsmasq
-      service:
-        name: dnsmasq
-        state: restarted
-      ignore_errors: yes
-

roles.extern/deapparmor

@@ -0,0 +1 @@
+Subproject commit 9cf7fcaa026c3771b7740915d6151f18fdb7fc15

roles.extern/grub_add_cmdlineparameter

@@ -0,0 +1 @@
+Subproject commit d401c517fd71d2f828ee7c4757357dbd090e6dd1

roles.extern/prepare_lxc_host

@@ -0,0 +1 @@
+Subproject commit dd1a20fa2e6cb483bb2f1429dd093bf078eb0df2