---
# tasks file for common
- name: Account management tasks
block:
- name: Ensure group "admin" exists
ansible.builtin.group:
name: admin
gid: 4141
state: present
- name: Accounts configuration
ansible.builtin.user:
name: "{{
item.name }}"
uid: "{{ item.uid }}"
state: present
group: "{{ item.group }}"
loop: "{{ accounts }}"
- name: Set up multiple authorized keys
ansible.builtin.authorized_key:
user: "{{ item.user }}"
key: "{{ item.key }}"
manage_dir: true
loop: "{{ keys }}"
- name: Add sudoers for ansible and hola
ansible.builtin.lineinfile:
path: /etc/sudoers.d/systems
line: "{{
item.name }} ALL=(ALL) NOPASSWD:ALL"
create: true
loop: "{{ accounts }}"
when: item.admin | bool
- name: Change root password
ansible.builtin.user:
name: root
password: "{{ root_password }}"
state: present
- name: Change hola password
ansible.builtin.user:
name: hola
password: "{{ user_password }}"
state: present
- name: Install the packages when os is rhel
ansible.builtin.dnf:
name: "{{
item.name }}"
state: "{{ item.state }}"
loop: "{{ packages_rhel }}"
when: ansible_os_family == "RedHat"
- name: Install the packages when os is debian
ansible.builtin.apt:
name: "{{
item.name }}"
state: "{{ item.state }}"
loop: "{{ packages_debian }}"
when: ansible_os_family == "Debian" or ansible_os_family == "Ubuntu"
become: true
ignore_errors: false
remote_user: root
vars:
ansible_ssh_private_key_file: "~/ansi/key"
- name: Generate facts
block:
- name: Create directory for ansible custom facts
ansible.builtin.file:
state: directory
recurse: true
path: /etc/ansible/facts.d
- name: Chcek if exsit custom facts
ansible.builtin.stat:
path: /etc/ansible/facts.d/static.fact
register: host_facts_stat
- name: Install custom fact
ansible.builtin.copy:
src: static.fact
dest: /etc/ansible/facts.d
when: not host_facts_stat.stat.exists
- name: End the play after first time to create custom facts
meta: end_play
when: not host_facts_stat.stat.exists
become: true
ignore_errors: false
remote_user: root
vars:
ansible_ssh_private_key_file: "~/ansi/key"
- name: Load custom facts
ansible.builtin.setup:
filter: ansible_local
- name: System configuration tasks
block:
- name: Re-read facts after adding custom fact
ansible.builtin.setup:
filter: ansible_local
# Upgrade packages
# - name: Upgrade all packages for rhel
# ansible.builtin.dnf:
# name: "*"
# state: latest
# when: ansible_os_family == "RedHat"
# - name: Upgrade all packages for debian
# ansible.builtin.apt:
# name: "*"
# state: latest
# when: ansible_os_family == "Debian" or ansible_os_family == "Ubuntu"
- name: Set hostname
ansible.builtin.hostname:
name: "{{ ansible_local['static']['general']['hostname'] }}"
when: ansible_local['static']['general']['hostname'] is defined and ansible_local['static']['general']['hostname'] != ""
- name: Configure eth0 ip address
ansible.builtin.template:
src: nmconnection_eth0.j2
dest: /etc/NetworkManager/system-connections/eth0.nmconnection
owner: root
group: root
mode: 0700
register: nmconnection_eth0_result
- name: Reload eth0 configuration
command: |
nmcli connection reload
nmcli connection up eth0
when: nmconnection_eth0_result.changed
- name: Disable cloud-init network
ansible.builtin.lineinfile:
path: /etc/cloud/cloud.cfg
regexp: '^ renderers'
insertafter: '^ network:'
line: " config: disabled"
when: nmconnection_eth0_result.changed
- name: Configure eth1 ip address
ansible.builtin.template:
src: nmconnection_eth1.j2
dest: /etc/NetworkManager/system-connections/eth1.nmconnection
owner: root
group: root
mode: 0700
when: ansible_local['static']['general']['ipaddr_eth1'] is defined and ansible_local['static']['general']['ipaddr_eth1'] != ""
register: nmconnection_eth1_result
- name: Reload eth1 configuration
command: |
nmcli connection reload
nmcli connection up eth1
when: nmconnection_eth1_result.changed
# - name: Display all variables/facts known for a host
# debug:
# var: hostvars[inventory_hostname]
# tags: debug_info
- name: Install the packages when os is rhel
ansible.builtin.dnf:
name: "{{
item.name }}"
state: "{{ item.state }}"
loop: "{{ packages_rhel }}"
when: ansible_os_family == "RedHat"
- name: Install the packages when os is debian
ansible.builtin.apt:
name: "{{
item.name }}"
state: "{{ item.state }}"
loop: "{{ packages_debian }}"
when: ansible_os_family == "Debian" or ansible_os_family == "Ubuntu"
- name: Enable atop is enabled and started
ansible.builtin.systemd_service:
name: atop
enabled: true
state: started
- name: Disable SELinux persist
ansible.builtin.selinux:
state: permissive
policy: targeted
- name: Set SELinux in permissive mode at runtime
command: setenforce 0
- name: kernel parameters
ansible.builtin.sysctl:
name: "{{
item.name }}"
value: "{{ item.value }}"
loop: "{{ kernel_parameters }}"
- name: Update grubby
command: grubby --update-kernel=ALL --args="net.ifnames=0 biosdevname=0 crashkernel=256M intel_idle.max_cstate=0 processor.max_cstate=1 idle=poll console=tty1 ipv6.disable=1 pci=nommconf pcie_aspm=off mitigations=off"
when: ansible_os_family == "RedHat"
- name: Ensure bash profile history lines number is unlimited
ansible.builtin.lineinfile:
path: /etc/profile
regexp: '^HISTSIZE '
insertafter: '^#HISTSIZE '
line: HISTSIZE=-1
- name: Ensure bash profile history file size is unlimited
ansible.builtin.lineinfile:
path: /etc/profile
regexp: '^HISTFILESIZE '
insertafter: '^#HISTFILESIZE '
line: HISTFILESIZE=-1
become: true
ignore_errors: true