ansible-role-baseline/tasks/main.yml at master · CentOS/ansible-role-baseline

408 lines (364 loc) · 9.24 KB
- name: Ensuring ansible can create local facts
  ansible.builtin.file:
    path: /etc/ansible/facts.d
    state: directory
- name: Creating folder to drop enabled repositories
  ansible.builtin.file:
    path: /etc/centos.repos.d
    state: directory
- name: Ensuring we have a place to store centos infra scripts
  ansible.builtin.file:
    path: /usr/libexec/centos
    state: directory
- name: Adding admin group
  ansible.builtin.group:
    name: admins
    state: present
- name: Adding admin user[s]
    name: "{{ item.login_name }}" 
    state: present 
    comment: "{{ item.full_name }}" 
    shell: /bin/bash
    append: yes
    groups: admins
  with_items: "{{ admins_list }}"
  when: admins_list is defined
  loop_control:
    label: "{{ item.login_name }}"
    - users
- name: Importing admin user[s] ssh pub keys
  authorized_key: 
    user: "{{ item.0.login_name }}" 
    key: "{{ item.1 }}"
  with_subelements:
   - "{{ admins_list }}"
   - ssh_pub_key
  when: admins_list is defined
  loop_control:
    label: "{{ item.0.login_name }}"
    - users
- name: Giving sudo access for admin users when needed
  template: 
    src: templates/sudofile.j2 
    dest: /etc/sudoers.d/{{ item.login_name }} 
    mode: 0440 
    owner: root 
    group: root
  with_items: "{{ admins_list }}"
  loop_control:
    label: "{{ item.login_name }}"
  when: admins_list is defined and item.sudo_right
    - users
- name: Modifying /etc/hosts if defined/needed (special case)
  ansible.builtin.blockinfile:
    path: /etc/hosts
    block: "{{ etc_hosts_block }}"
    - etc_hosts_block is defined
    - hosts
- name: Configuring dnf/yum proxy settings if needed
  ansible.builtin.lineinfile:
    path: /etc/yum.conf
    state: present
    regexp: '^proxy='
    line: proxy={{ dnf_proxy_url }}
    - dnf_use_proxy is defined
    - dnf_use_proxy
    dnf_proxy
- include_tasks: rhel.yml
  when: ansible_distribution == 'RedHat'
- name: Ensuring CRB is enabled on CentOS Stream hosts
    cmd: dnf repolist|grep -q crb || (dnf config-manager --set-enabled crb ; exit 2)
  register: crb
  changed_when: crb.rc == 2
  failed_when: crb.rc == 1
    - ansible_distribution == 'CentOS'
    - name: Adding CentOS Infra key
      copy: 
        src: files/RPM-GPG-KEY-CentOS-Infra 
        dest: /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-Infra
    - name: Configuring CentOS Infra admin repo
      template: 
        src: centos-admin.repo.j2 
        dest: /etc/yum.repos.d/centos-admin.repo
        mode: 0644
  when: centos_infra_repo  
- name: Creating selinux custom policy drop folder
    path: /etc/selinux/centos 
    state: directory 
    owner: root 
    group: root 
    mode: 0750
- name: Ensuring some default packages are installed
    name: "{{ packages_list }}" 
    state: installed
- name: Customizing motd
  template: 
    src: motd.j2 
    dest: /etc/motd 
    owner: root 
    group: root 
    mode: 0644
  when: customized_motd
- name: Ensuring some el snippet aren't shown on login
    state: absent
    path: "/etc/motd.d/{{ item }}"
    - cockpit
    - insights-client
- name: Displaying colored hostname in shell
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/sysconfig/{{ item }}"
    mode: 0755
    owner: root
    group: root
  with_items:
    - bash-prompt-default
    - bash-prompt-xterm
    - prompt
  when: customized_motd
- name: Ensuring tuned is installed
  ansible.builtin.yum:
    name: tuned
    state: installed
    - tuned
- name: Ensuring tuned is started
  ansible.builtin.service:
    name: tuned
    state: started
    enabled: True
    - tuned
- name: Ensuring correct tuned profile is configured
  ansible.builtin.template:
    src: tuned_active_profile.j2
    dest: /etc/tuned/active_profile
    mode: 0644
  register: tuned_setting_7
  when: ansible_distribution_major_version == "7" 
    - tuned
- name: Ensuring correct tuned profile is configured (el6 version)
  ansible.builtin.template:
    src: tuned_active_profile.j2
    dest: /etc/tune-profiles/active_profile
    mode: 0644
  register: tuned_setting_6
  when: ansible_distribution_major_version == "6"
    - tuned
- name: Reloading tuned profile if needed
  shell: "tuned-adm profile {{ tuned_profile }}"
  when: tuned_setting_6 is changed or tuned_setting_7 is changed
    - tuned
- ansible.builtin.import_role:
    name: iptables
    - iptables
- ansible.builtin.import_role:
    name: zabbix-agent
  when: zabbix_monitoring   
    - monitoring
- ansible.builtin.import_role:
    name: sshd
    - users
- name: Adding additional users
    name: "{{ item.login_name }}"
    state: present 
    comment: "{{ item.full_name }}" 
    shell: "{{ item.shell | default('/bin/bash') }}"
  with_items: "{{ local_users_list }}"
  loop_control:
    label: "{{ item.login_name }}"
  when: local_users_list is defined
    - users
- name: Importing local users ssh pub keys
  authorized_key: 
    user: "{{ item.0.login_name }}"
    key: "{{ item.1 }}"
  with_subelements: 
    - "{{ local_users_list }}"
    - ssh_pub_key
  loop_control:
    label: "{{ item.0.login_name }}"
  when: local_users_list is defined
    - users
- name: Giving sudo access when needed 
  template:  
    src: templates/sudofile.j2 
    dest: "/etc/sudoers.d/{{ item.login_name }}" 
    mode: 0440 
    owner: root 
    group: root
  with_items: "{{ local_users_list }}"
    - local_users_list is defined
    - item.sudo_right 
  loop_control:
    label: "{{ item.login_name }}"
    - users
- name: Removing expired accounts
  ansible.builtin.user:
    name: "{{ item }}"
    state: absent
    remove: False
  with_items: "{{ local_expired_users }}"  
    - users
    - cleanup
- name: UTC everywhere
  community.general.timezone:
    name: UTC
- include_tasks: chrony.yml
    - chrony
- include_tasks: os_updates.yml
    - updates
- name: Importing TLS CA that we want to trust (if any)
    src: "{{ pkistore }}/{{ item }}"
    dest: "/etc/pki/ca-trust/source/anchors"
  notify: update_ca_trust
  with_items: "{{ pki_trusted_ca_list }}"
- name: Distributing specific files not coming from roles/templates
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: "{{ item.owner }}"
    mode: "{{ item.mode }}"
  with_items: "{{ baseline_distributed_files }}"
  loop_control:
    label: "{{ item.dest }}"
    - distributed_files
- name: Enabling specific selinux booleans / per host level
  ansible.posix.seboolean:
    name: "{{ item }}"
    state: yes
    persistent: yes
  with_items: "{{ local_selinux_booleans }}"  
    - selinux
- name: Enabling specific host/group cron jobs
  ansible.builtin.cron:
    name: "{{ item.name }}"
    job: "{{ item.job }}"
    user: "{{ item.user|default('root') }}"
    hour: "{{ item.hour|default('*') }}"
    day: "{{ item.day|default('*') }}"
    minute: "{{ item.minute|default('*') }}"
  with_items: "{{ local_cron_entries }}"
  loop_control:
    label: "{{ item.name }}"
- name: Updating crypto-policy if needed
  ansible.builtin.shell:
    cmd: "update-crypto-policies --show |grep -q {{ baseline_crypto_policy }} || (update-crypto-policies --set {{ baseline_crypto_policy }} >/dev/null 2>&1 ; echo changed)"
  register: crypto_policy
  changed_when: '"changed" in crypto_policy.stdout'
    - baseline_crypto_policy is defined
    - ansible_distribution_major_version | int > 7
    - crypto_policy
- name: Configuring NFS mount default options
  ansible.builtin.lineinfile:
    path: /etc/nfsmount.conf
    state: present
    line: Sec=sys 
    - name: Ensuring addtional volume[s] is/are defined
      ansible.posix.mount:
        src: "{{ item.src }}"
        path: "{{ item.dest }}"
        fstype: nfs
        state: present
        opts: "{{ item.opts | default('defaults') }}"
      register: mountpoints
      with_items: "{{ nfs_mountpoints }}"
      loop_control:
        label: "{{ item.dest }}"
      tags:
        - nfs
    - name: Ensuring addtional volume[s] is/are mounted
      ansible.posix.mount:
        src: "{{ item.item.src }}"
        path: "{{ item.item.dest }}"
        fstype: nfs
        state: mounted
        opts: "{{ item.opts | default('defaults') }}"
      with_items: "{{ mountpoints.results }}"
      when: item.changed
      loop_control:
        label: "{{ item.item.dest }}"
      tags:
        - nfs    
- name: Kernel/sysctl parameters
  ansible.posix.sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
    sysctl_set: yes
    reload: yes
  with_items: "{{ sysctl_settings }}"
    - sysctl
- name: Extra directories
    path: "{{ item.path }}"
    state: directory
    setype: "{{ item.secontext | default('_default') }}"
    owner: "{{ item.owner | default('root') }}"
    group: "{{ item.group | default('root') }}"
  with_items: "{{ directories_list }}"
  loop_control:
    label: "{{ item.path }}"
    - directories
- include_tasks: rssh-users.yml
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

FilesExpand file tree

main.yml

Latest commit

History

main.yml

File metadata and controls
