aboutsummaryrefslogtreecommitdiffstats
path: root/roles/space_server/tasks
diff options
context:
space:
mode:
Diffstat (limited to 'roles/space_server/tasks')
-rw-r--r--roles/space_server/tasks/ansible.yml30
-rw-r--r--roles/space_server/tasks/bird.yml68
-rw-r--r--roles/space_server/tasks/blackhole.yml32
-rw-r--r--roles/space_server/tasks/dhcpd.yml31
-rw-r--r--roles/space_server/tasks/gettys.yml25
-rw-r--r--roles/space_server/tasks/kernel.yml42
-rw-r--r--roles/space_server/tasks/main.yml41
-rw-r--r--roles/space_server/tasks/named.yml52
-rw-r--r--roles/space_server/tasks/networkd.yml48
-rw-r--r--roles/space_server/tasks/nftables.yml34
-rw-r--r--roles/space_server/tasks/radius.yml105
-rw-r--r--roles/space_server/tasks/radvd.yml40
-rw-r--r--roles/space_server/tasks/resolved.yml34
-rw-r--r--roles/space_server/tasks/sshd.yml32
-rw-r--r--roles/space_server/tasks/sudo.yml16
-rw-r--r--roles/space_server/tasks/timesyncd.yml15
16 files changed, 645 insertions, 0 deletions
diff --git a/roles/space_server/tasks/ansible.yml b/roles/space_server/tasks/ansible.yml
new file mode 100644
index 0000000..5dc74e2
--- /dev/null
+++ b/roles/space_server/tasks/ansible.yml
@@ -0,0 +1,30 @@
+---
+- name: Create /etc/ansible/hosts
+ copy:
+ src: ansible/hosts
+ dest: '/etc/ansible/hosts'
+
+- name: Configure ansible
+ ini_file:
+ path: /etc/ansible/ansible.cfg
+ section: '{{ item.section }}'
+ option: '{{ item.option }}'
+ value: '{{ item.value }}'
+ with_items:
+ - section: defaults
+ option: 'gathering'
+ value: 'smart'
+ - section: defaults
+ option: 'fact_caching'
+ value: 'jsonfile'
+ - section: defaults
+ option: 'fact_caching_connection'
+ value: '/tmp/ansible'
+ - section: defaults
+ option: 'fact_caching_timeout'
+ value: '600'
+ - section: defaults
+ option: 'error_on_missing_handler'
+ value: 'True'
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/bird.yml b/roles/space_server/tasks/bird.yml
new file mode 100644
index 0000000..17f0a99
--- /dev/null
+++ b/roles/space_server/tasks/bird.yml
@@ -0,0 +1,68 @@
+---
+- name: Install bird and bird6 packages
+ dnf:
+ name: '{{ item }}'
+ state: latest
+ with_items:
+ - bird
+ - bird6
+ notify:
+ - restart bird
+ tags:
+ - packages
+
+- name: Make sure /etc/bird exists
+ file:
+ dest: '/etc/bird'
+ state: directory
+ mode: 0755
+- name: Create bird configuration
+ copy:
+ src: '{{ item }}'
+ dest: '/etc/bird/'
+ with_fileglob:
+ - 'bird/*'
+ notify:
+ - restart bird
+
+- name: Create bird.conf and bird6.conf symlinks
+ file:
+ path: '/etc/{{ item }}.conf'
+ state: link
+ src: 'bird/{{ item }}.conf'
+ force: yes
+ with_items:
+ - bird
+ - bird6
+
+# bird6 wants the link to have a link-local address
+# when starting, so wait for it
+- name: Create bird6 service drop-in directory
+ file:
+ dest: '/etc/systemd/system/bird6.service.d'
+ state: directory
+- name: Start bird6 after networks are configured
+ copy:
+ src: wait-online.conf
+ dest: '/etc/systemd/system/bird6.service.d/wait-online.conf'
+
+- name: Enable bird and bird6
+ systemd:
+ name: '{{ item }}.service'
+ enabled: yes
+ masked: no
+ state: started
+ with_items:
+ - bird
+ - bird6
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: 'systemctl enable {{ item }}.service'
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/{{ item }}.service'
+ with_items:
+ - bird
+ - bird6
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/blackhole.yml b/roles/space_server/tasks/blackhole.yml
new file mode 100644
index 0000000..b62a7ca
--- /dev/null
+++ b/roles/space_server/tasks/blackhole.yml
@@ -0,0 +1,32 @@
+---
+- name: Create /etc/systemd/scripts
+ file:
+ dest: /etc/systemd/scripts
+ state: directory
+- name: Install blackhole script
+ copy:
+ src: blackhole/blackhole.sh
+ dest: '/etc/systemd/scripts/blackhole.sh'
+ mode: 0755
+ notify:
+ - restart blackhole
+
+- name: Install blackhole service
+ copy:
+ src: blackhole/blackhole.service
+ dest: '/etc/systemd/system/blackhole.service'
+
+- name: Enable blackhole service
+ systemd:
+ name: blackhole.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable blackhole.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/blackhole.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/dhcpd.yml b/roles/space_server/tasks/dhcpd.yml
new file mode 100644
index 0000000..c72fa75
--- /dev/null
+++ b/roles/space_server/tasks/dhcpd.yml
@@ -0,0 +1,31 @@
+---
+- name: Install dhcpd package
+ dnf:
+ name: dhcp-server
+ state: latest
+ notify:
+ - restart dhcpd
+ tags:
+ - packages
+
+- name: Configure dhcpd
+ copy:
+ src: dhcpd/dhcpd.conf
+ dest: '/etc/dhcp/dhcpd.conf'
+ notify:
+ - restart dhcpd
+
+- name: Enable dhcpd service
+ systemd:
+ name: dhcpd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable dhcpd.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/dhcpd.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/gettys.yml b/roles/space_server/tasks/gettys.yml
new file mode 100644
index 0000000..bdf293a
--- /dev/null
+++ b/roles/space_server/tasks/gettys.yml
@@ -0,0 +1,25 @@
+---
+- name: Disable getty@tty1
+ systemd:
+ name: getty@tty1.service
+ enabled: no
+ state: stopped
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl disable getty@tty1.service
+ args:
+ removes: '/etc/systemd/system/getty.target.wants/getty@tty1.service'
+ when: "'container' in ansible_env"
+
+- name: Enable serial-getty@ttyS0
+ systemd:
+ name: serial-getty@ttyS0.service
+ enabled: yes
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable serial-getty@ttyS0.service
+ args:
+ creates: '/etc/systemd/system/getty.target.wants/serial-getty@ttyS0.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/kernel.yml b/roles/space_server/tasks/kernel.yml
new file mode 100644
index 0000000..02e115c
--- /dev/null
+++ b/roles/space_server/tasks/kernel.yml
@@ -0,0 +1,42 @@
+---
+- name: Make sure /etc/kernel exists
+ file:
+ path: '/etc/kernel'
+ state: directory
+ mode: 0755
+- name: Make sure /etc/kernel/install.d exists
+ file:
+ path: '/etc/kernel/install.d'
+ state: directory
+ mode: 0755
+
+- name: Mask grubby
+ file:
+ path: '/etc/kernel/install.d/20-grubby.install'
+ state: link
+ src: '/dev/null'
+
+- name: Create syslinux loader entry
+ copy:
+ src: kernel/90-loaderentry.install
+ dest: '/etc/kernel/install.d/90-loaderentry.install'
+ mode: 0755
+- name: Create syslinux menu
+ copy:
+ src: kernel/95-syslinux-menu.install
+ dest: '/etc/kernel/install.d/95-syslinux-menu.install'
+ mode: 0755
+
+- name: Set kernel command line
+ template:
+ src: cmdline.j2
+ dest: '/etc/kernel/cmdline'
+
+- name: Install kernel
+ dnf:
+ name: kernel
+ state: latest
+ tags:
+ - packages
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml
new file mode 100644
index 0000000..98a0764
--- /dev/null
+++ b/roles/space_server/tasks/main.yml
@@ -0,0 +1,41 @@
+---
+- name: fstab
+ template:
+ src: fstab.j2
+ dest: /etc/fstab
+ tags:
+ - fstab
+
+- import_tasks: ansible.yml
+ tags: ansible
+- import_tasks: sudo.yml
+ tags: sudo
+- import_tasks: kernel.yml
+ tags: kernel
+- import_tasks: gettys.yml
+ tags: gettys
+- import_tasks: timesyncd.yml
+ tags: timesyncd
+- import_tasks: resolved.yml
+ tags: resolved
+- import_tasks: networkd.yml
+ tags: networkd
+- import_tasks: nftables.yml
+ tags: nftables
+- import_tasks: blackhole.yml
+ tags: blackhole
+- import_tasks: sshd.yml
+ tags: sshd
+- import_tasks: bird.yml
+ tags: bird
+- import_tasks: dhcpd.yml
+ tags: dhcpd
+- import_tasks: radvd.yml
+ tags: radvd
+- import_tasks: radius.yml
+ tags: radius
+ when: radius_passwords is defined
+- import_tasks: named.yml
+ tags: named
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/named.yml b/roles/space_server/tasks/named.yml
new file mode 100644
index 0000000..d295058
--- /dev/null
+++ b/roles/space_server/tasks/named.yml
@@ -0,0 +1,52 @@
+---
+- name: Install bind package
+ dnf:
+ name: bind
+ state: latest
+ notify:
+ - restart named
+ tags:
+ - packages
+
+- name: Configure named
+ copy:
+ src: named/named.conf
+ dest: '/etc/named.conf'
+ mode: 0640
+ notify:
+ - restart named
+- name: Create s zone
+ copy:
+ src: named/s.zone
+ dest: '/etc/named/s.zone'
+ notify:
+ - restart named
+
+- name: Create service drop-in directory
+ file:
+ dest: '/etc/systemd/system/named.service.d'
+ state: directory
+- name: Start named after networks are configured
+ copy:
+ src: wait-online.conf
+ dest: '/etc/systemd/system/named.service.d/wait-online.conf'
+
+- name: Enable named service
+ systemd:
+ name: named.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable named.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/named.service'
+ when: "'container' in ansible_env"
+
+- name: Use our own resolver
+ copy:
+ dest: /etc/resolv.conf
+ content: "nameserver 127.0.0.1\nnameserver ::1\n"
+
+# vim: set ts=2 sw=2 et ft=yaml:
diff --git a/roles/space_server/tasks/networkd.yml b/roles/space_server/tasks/networkd.yml
new file mode 100644
index 0000000..ef97844
--- /dev/null
+++ b/roles/space_server/tasks/networkd.yml
@@ -0,0 +1,48 @@
+---
+- name: Make sure directory exists
+ file:
+ dest: '/etc/systemd/network'
+ state: directory
+- name: Get current network config
+ shell: 'ls -1 /etc/systemd/network/'
+ check_mode: no
+ register: network_files_all
+- name: Configure network
+ copy:
+ src: '{{ item }}'
+ dest: '/etc/systemd/network/'
+ with_fileglob:
+ - 'networkd/network/*'
+ register: network_files
+ notify:
+ - restart networkd
+- name: Clean up old files
+ file:
+ path: '/etc/systemd/network/{{ item }}'
+ state: absent
+ with_items: '{{ network_files_all.stdout_lines }}'
+ when: "item not in network_files.results|map(attribute='path')|map('basename')"
+ notify:
+ - restart networkd
+
+# Unfortunately a drop-in file doesn't seem to work,
+# so overwrite the whole service file :/
+- name: Don't wait for lan and mgt interfaces to come online
+ copy:
+ src: networkd/systemd-networkd-wait-online.service
+ dest: '/etc/systemd/system/systemd-networkd-wait-online.service'
+
+- name: Enable systemd-networkd
+ systemd:
+ name: systemd-networkd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable systemd-networkd.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/systemd-networkd.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/nftables.yml b/roles/space_server/tasks/nftables.yml
new file mode 100644
index 0000000..a7fb588
--- /dev/null
+++ b/roles/space_server/tasks/nftables.yml
@@ -0,0 +1,34 @@
+---
+- name: Install our nftables service
+ copy:
+ src: nftables/nftables.service
+ dest: '/etc/systemd/system/nftables.service'
+
+- name: Install nftables package
+ dnf:
+ name: nftables
+ state: latest
+ tags:
+ - packages
+
+- name: Configure nftables
+ copy:
+ src: nftables/nftables.conf
+ dest: '/etc/sysconfig/nftables.conf'
+ notify:
+ - reload nftables
+
+- name: Enable nftables service
+ systemd:
+ name: nftables.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable nftables.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/nftables.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/radius.yml b/roles/space_server/tasks/radius.yml
new file mode 100644
index 0000000..3226d2e
--- /dev/null
+++ b/roles/space_server/tasks/radius.yml
@@ -0,0 +1,105 @@
+---
+- name: Install our freeradius-assha package
+ dnf:
+ name: '{{ item }}'
+ state: latest
+ with_fileglob:
+ - 'radius/freeradius-assha-*.fc{{ ansible_distribution_major_version }}.*.rpm'
+ notify:
+ - restart radiusd
+ tags:
+ - packages
+
+- name: Make sure curl and diffutils are installed
+ dnf:
+ name: '{{ item }}'
+ state: latest
+ with_items:
+ - curl
+ - diffutils
+ tags:
+ - packages
+
+- name: Disable default site
+ file:
+ path: '/etc/raddb/sites-enabled/default'
+ state: absent
+ notify:
+ - restart radiusd
+- name: Configure radiusd
+ copy:
+ src: 'radius/{{ item }}'
+ dest: '/etc/raddb/{{ item }}'
+ owner: root
+ group: radiusd
+ mode: 0640
+ with_items:
+ - radiusd.conf
+ - mods-available/eap
+ - sites-available/labitat
+ notify:
+ - restart radiusd
+- name: Configure radius clients
+ template:
+ src: 'radius/clients.conf.j2'
+ dest: '/etc/raddb/clients.conf'
+ owner: root
+ group: radiusd
+ mode: 0640
+ notify:
+ - restart radiusd
+- name: Enable labitat site
+ file:
+ path: '/etc/raddb/sites-enabled/labitat'
+ state: link
+ src: '../sites-available/labitat'
+ owner: root
+ group: radiusd
+ force: yes
+ notify:
+ - restart radiusd
+
+- name: Create getusers script
+ template:
+ src: 'radius/getusers.sh.j2'
+ dest: '/etc/raddb/getusers.sh'
+ owner: root
+ group: radiusd
+ mode: 0750
+- name: Create getusers service and timer
+ copy:
+ src: 'radius/{{ item }}'
+ dest: '/etc/systemd/system/{{ item }}'
+ with_items:
+ - getusers.service
+ - getusers.timer
+ notify:
+ - restart getusers
+
+- name: Enable getusers timer
+ systemd:
+ name: getusers.timer
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable getusers.timer
+ args:
+ creates: '/etc/systemd/system/timers.target.wants/getusers.timer'
+ when: "'container' in ansible_env"
+
+- name: Enable radiusd service
+ systemd:
+ name: radiusd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable radiusd.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/radiusd.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/radvd.yml b/roles/space_server/tasks/radvd.yml
new file mode 100644
index 0000000..3c25c5c
--- /dev/null
+++ b/roles/space_server/tasks/radvd.yml
@@ -0,0 +1,40 @@
+---
+- name: Install radvd package
+ dnf:
+ name: radvd
+ state: latest
+ notify:
+ - restart radvd
+ tags:
+ - packages
+
+- name: Configure radvd
+ copy:
+ src: radvd/radvd.conf
+ dest: '/etc/radvd.conf'
+ notify:
+ - restart radvd
+
+- name: Create service drop-in directory
+ file:
+ dest: '/etc/systemd/system/radvd.service.d'
+ state: directory
+- name: Start radvd after networks are configured
+ copy:
+ src: wait-online.conf
+ dest: '/etc/systemd/system/radvd.service.d/wait-online.conf'
+
+- name: Enable radvd service
+ systemd:
+ name: radvd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable radvd.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/radvd.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/resolved.yml b/roles/space_server/tasks/resolved.yml
new file mode 100644
index 0000000..d95d1d1
--- /dev/null
+++ b/roles/space_server/tasks/resolved.yml
@@ -0,0 +1,34 @@
+---
+#- name: Enable systemd-resolved
+# systemd:
+# name: systemd-resolved.service
+# enabled: yes
+# masked: no
+# state: started
+# when: "'container' not in ansible_env"
+#- name: '- when in nspawn'
+# command: systemctl enable systemd-resolved.service
+# args:
+# creates: '/etc/systemd/system/multi-user.target.wants/systemd-resolved.service'
+# when: "'container' in ansible_env"
+#
+#- name: Use systemd-resolved
+# lineinfile:
+# path: /etc/nsswitch.conf
+# regexp: '^hosts:'
+# line: 'hosts: files resolve [!UNAVAIL=return] dns myhostname'
+
+- name: Disable systemd-resolved
+ systemd:
+ name: systemd-resolved.service
+ enabled: no
+ masked: no
+ state: stopped
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl disable systemd-resolved.service
+ args:
+ removes: '/etc/systemd/system/multi-user.target.wants/systemd-resolved.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/sshd.yml b/roles/space_server/tasks/sshd.yml
new file mode 100644
index 0000000..8eaa8fc
--- /dev/null
+++ b/roles/space_server/tasks/sshd.yml
@@ -0,0 +1,32 @@
+---
+- name: Install sshd package
+ dnf:
+ name: openssh-server
+ state: latest
+ notify:
+ - restart sshd
+ tags:
+ - packages
+
+- name: Configure sshd
+ lineinfile:
+ path: '/etc/ssh/sshd_config'
+ regexp: '^PasswordAuthentication'
+ line: 'PasswordAuthentication no'
+ notify:
+ - restart sshd
+
+- name: Enable sshd service
+ systemd:
+ name: sshd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable sshd.service
+ args:
+ creates: '/etc/systemd/system/multi-user.target.wants/sshd.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/sudo.yml b/roles/space_server/tasks/sudo.yml
new file mode 100644
index 0000000..b8497c3
--- /dev/null
+++ b/roles/space_server/tasks/sudo.yml
@@ -0,0 +1,16 @@
+---
+- name: Install sudo package
+ dnf:
+ name: sudo
+ state: latest
+ tags:
+ - packages
+
+- name: Install sudoers file
+ copy:
+ src: sudo/sudoers
+ dest: '/etc/sudoers'
+ mode: 0440
+ validate: visudo -cf %s
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/timesyncd.yml b/roles/space_server/tasks/timesyncd.yml
new file mode 100644
index 0000000..cf964e3
--- /dev/null
+++ b/roles/space_server/tasks/timesyncd.yml
@@ -0,0 +1,15 @@
+---
+- name: Enable systemd-timesyncd
+ systemd:
+ name: systemd-timesyncd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: "'container' not in ansible_env"
+- name: '- when in nspawn'
+ command: systemctl enable systemd-timesyncd.service
+ args:
+ creates: '/etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service'
+ when: "'container' in ansible_env"
+
+# vim: set ts=2 sw=2 et: