From ec0a0774a749cc53d63a232093017aeb8c220418 Mon Sep 17 00:00:00 2001 From: git Date: Tue, 30 Jan 2024 09:58:55 +0100 Subject: [PATCH] Fix of fail2ban, create_zfs_dataset (not done yet), bashrc, inventory rework --- inventory | 19 +++ .../templates/jail.local.j2 | 1 + roles/create_zfs_dataset/.travis.yml | 29 +++++ roles/create_zfs_dataset/README.md | 38 ++++++ roles/create_zfs_dataset/defaults/main.yml | 5 + roles/create_zfs_dataset/handlers/main.yml | 2 + roles/create_zfs_dataset/meta/main.yml | 52 ++++++++ roles/create_zfs_dataset/tasks/main.yml | 9 ++ roles/create_zfs_dataset/tests/inventory | 2 + roles/create_zfs_dataset/tests/test.yml | 5 + roles/create_zfs_dataset/vars/main.yml | 2 + roles/linux_config_init/handlers/main.yml | 5 +- roles/linux_config_init/tasks/bashrc_copy.yml | 17 +++ roles/linux_config_init/tasks/main.yml | 3 +- .../linux_config_init/tasks/set_perma_ip.yml | 3 +- roles/linux_config_init/templates/bashrc | 113 ++++++++++++++++++ .../templates/etc_network_interface | 15 +-- .../tasks/administration.yml | 1 + zeus.yml | 49 ++++++-- 19 files changed, 344 insertions(+), 26 deletions(-) create mode 100644 inventory create mode 100644 roles/create_zfs_dataset/.travis.yml create mode 100644 roles/create_zfs_dataset/README.md create mode 100644 roles/create_zfs_dataset/defaults/main.yml create mode 100644 roles/create_zfs_dataset/handlers/main.yml create mode 100644 roles/create_zfs_dataset/meta/main.yml create mode 100644 roles/create_zfs_dataset/tasks/main.yml create mode 100644 roles/create_zfs_dataset/tests/inventory create mode 100644 roles/create_zfs_dataset/tests/test.yml create mode 100644 roles/create_zfs_dataset/vars/main.yml create mode 100644 roles/linux_config_init/tasks/bashrc_copy.yml create mode 100644 roles/linux_config_init/templates/bashrc diff --git a/inventory b/inventory new file mode 100644 index 0000000..276b6d3 --- /dev/null +++ b/inventory @@ -0,0 +1,19 @@ +[Desktop] +mintotaur ansible_host=192.168.89.151 + + +[Inside] +zeus-local +herodes-local +pi-local + +[Outside] +zeus-public +herodes-public +pi-public + +[Vmbox] + + +[all:vars] +ansible_connection=ssh diff --git a/roles/ansible-role-security/templates/jail.local.j2 b/roles/ansible-role-security/templates/jail.local.j2 index de9b947..90ce1c0 100644 --- a/roles/ansible-role-security/templates/jail.local.j2 +++ b/roles/ansible-role-security/templates/jail.local.j2 @@ -2,3 +2,4 @@ enabled = true port = {{ security_ssh_port }} filter = sshd +backend = systemd diff --git a/roles/create_zfs_dataset/.travis.yml b/roles/create_zfs_dataset/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/roles/create_zfs_dataset/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/roles/create_zfs_dataset/README.md b/roles/create_zfs_dataset/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/create_zfs_dataset/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/create_zfs_dataset/defaults/main.yml b/roles/create_zfs_dataset/defaults/main.yml new file mode 100644 index 0000000..4ff853d --- /dev/null +++ b/roles/create_zfs_dataset/defaults/main.yml @@ -0,0 +1,5 @@ +--- +# defaults file for create_zfs_dataset +zfs_dataset_size: 10M +zfs_dataset_mountpoint: "{{ zfs_pool_name }}/{{ zfs_dataset_name }}" + diff --git a/roles/create_zfs_dataset/handlers/main.yml b/roles/create_zfs_dataset/handlers/main.yml new file mode 100644 index 0000000..2dc50ec --- /dev/null +++ b/roles/create_zfs_dataset/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for create_zfs_dataset diff --git a/roles/create_zfs_dataset/meta/main.yml b/roles/create_zfs_dataset/meta/main.yml new file mode 100644 index 0000000..c572acc --- /dev/null +++ b/roles/create_zfs_dataset/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/create_zfs_dataset/tasks/main.yml b/roles/create_zfs_dataset/tasks/main.yml new file mode 100644 index 0000000..fd0df97 --- /dev/null +++ b/roles/create_zfs_dataset/tasks/main.yml @@ -0,0 +1,9 @@ +--- +# tasks file for create_zfs_dataset +- name: Create zfs dataset + community.general.zfs: + name: "{{ zfs_pool_name }}/{{ zfs_dataset_name }}" + state: present + extra_zfs_properties: + quota: {{ zfs_dataset_size }} + mountpoint: {{ zfs_dataset_mountpoint }} \ No newline at end of file diff --git a/roles/create_zfs_dataset/tests/inventory b/roles/create_zfs_dataset/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/roles/create_zfs_dataset/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/roles/create_zfs_dataset/tests/test.yml b/roles/create_zfs_dataset/tests/test.yml new file mode 100644 index 0000000..b4850b1 --- /dev/null +++ b/roles/create_zfs_dataset/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - create_zfs_dataset diff --git a/roles/create_zfs_dataset/vars/main.yml b/roles/create_zfs_dataset/vars/main.yml new file mode 100644 index 0000000..8b91343 --- /dev/null +++ b/roles/create_zfs_dataset/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for create_zfs_dataset diff --git a/roles/linux_config_init/handlers/main.yml b/roles/linux_config_init/handlers/main.yml index 210b17c..bbf1c09 100644 --- a/roles/linux_config_init/handlers/main.yml +++ b/roles/linux_config_init/handlers/main.yml @@ -1,2 +1,5 @@ --- -# handlers file for linux_config_tinker +- name: networking restart + service: + name: networking + state: restarted \ No newline at end of file diff --git a/roles/linux_config_init/tasks/bashrc_copy.yml b/roles/linux_config_init/tasks/bashrc_copy.yml new file mode 100644 index 0000000..85fa0af --- /dev/null +++ b/roles/linux_config_init/tasks/bashrc_copy.yml @@ -0,0 +1,17 @@ +--- +- name: Copy /root/.bashrc + template: + src: ../templates/bashrc + dest: /root/.bashrc + owner: root + group: root + mode: '0644' + + +- name: Copy /home/{{ user }}/.bashrc + template: + src: ../templates/bashrc + dest: /home/{{ user }}/.bashrc + owner: "{{ user }}" + group: "{{ user }}" + mode: '0644' \ No newline at end of file diff --git a/roles/linux_config_init/tasks/main.yml b/roles/linux_config_init/tasks/main.yml index 2587c88..70a4b5e 100644 --- a/roles/linux_config_init/tasks/main.yml +++ b/roles/linux_config_init/tasks/main.yml @@ -7,7 +7,8 @@ - hostname_set.yml - git.yml - create_user.yml - # - script_import.yml + - set_perma_ip.yml + - bashrc_copy.yml #- name: Set Pernament IP # ansible.builtin.include_tasks: set_perma_ip.yml diff --git a/roles/linux_config_init/tasks/set_perma_ip.yml b/roles/linux_config_init/tasks/set_perma_ip.yml index 359a71e..6e513f8 100644 --- a/roles/linux_config_init/tasks/set_perma_ip.yml +++ b/roles/linux_config_init/tasks/set_perma_ip.yml @@ -5,4 +5,5 @@ dest: /etc/network/interfaces owner: root group: root - mode: '0644' \ No newline at end of file + mode: '0644' + notify: networking restart \ No newline at end of file diff --git a/roles/linux_config_init/templates/bashrc b/roles/linux_config_init/templates/bashrc new file mode 100644 index 0000000..708aafa --- /dev/null +++ b/roles/linux_config_init/templates/bashrc @@ -0,0 +1,113 @@ +# ~/.bashrc: executed by bash(1) for non-login shells. +# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc) +# for examples + +# If not running interactively, don't do anything +case $- in + *i*) ;; + *) return;; +esac + +# don't put duplicate lines or lines starting with space in the history. +# See bash(1) for more options +HISTCONTROL=ignoreboth + +# append to the history file, don't overwrite it +shopt -s histappend + +# for setting history length see HISTSIZE and HISTFILESIZE in bash(1) +HISTSIZE=1000 +HISTFILESIZE=2000 + +# check the window size after each command and, if necessary, +# update the values of LINES and COLUMNS. +shopt -s checkwinsize + +# If set, the pattern "**" used in a pathname expansion context will +# match all files and zero or more directories and subdirectories. +#shopt -s globstar + +# make less more friendly for non-text input files, see lesspipe(1) +#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)" + +# set variable identifying the chroot you work in (used in the prompt below) +if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then + debian_chroot=$(cat /etc/debian_chroot) +fi + +# set a fancy prompt (non-color, unless we know we "want" color) +case "$TERM" in + xterm-color|*-256color) color_prompt=yes;; +esac + +# uncomment for a colored prompt, if the terminal has the capability; turned +# off by default to not distract the user: the focus in a terminal window +# should be on the output of commands, not on the prompt +#force_color_prompt=yes + +if [ -n "$force_color_prompt" ]; then + if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then + # We have color support; assume it's compliant with Ecma-48 + # (ISO/IEC-6429). (Lack of such support is extremely rare, and such + # a case would tend to support setf rather than setaf.) + color_prompt=yes + else + color_prompt= + fi +fi + +if [ "$color_prompt" = yes ]; then + PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ ' +else + PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ ' +fi +unset color_prompt force_color_prompt + +# If this is an xterm set the title to user@host:dir +case "$TERM" in +xterm*|rxvt*) + PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1" + ;; +*) + ;; +esac + +# enable color support of ls and also add handy aliases +if [ -x /usr/bin/dircolors ]; then + test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)" + alias ls='ls --color=auto' + #alias dir='dir --color=auto' + #alias vdir='vdir --color=auto' + + alias grep='grep --color=auto' + alias fgrep='fgrep --color=auto' + alias egrep='egrep --color=auto' +fi + +# colored GCC warnings and errors +#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01' + +# some more ls aliases +alias ll='ls -lah' +alias la='ls -A' +alias l='ls -CF' + +# Alias definitions. +# You may want to put all your additions into a separate file like +# ~/.bash_aliases, instead of adding them here directly. +# See /usr/share/doc/bash-doc/examples in the bash-doc package. + +if [ -f ~/.bash_aliases ]; then + . ~/.bash_aliases +fi + +# enable programmable completion features (you don't need to enable +# this, if it's already enabled in /etc/bash.bashrc and /etc/profile +# sources /etc/bash.bashrc). +if ! shopt -oq posix; then + if [ -f /usr/share/bash-completion/bash_completion ]; then + . /usr/share/bash-completion/bash_completion + elif [ -f /etc/bash_completion ]; then + . /etc/bash_completion + fi +fi \ No newline at end of file diff --git a/roles/linux_config_init/templates/etc_network_interface b/roles/linux_config_init/templates/etc_network_interface index 7768b6f..c8fad8a 100644 --- a/roles/linux_config_init/templates/etc_network_interface +++ b/roles/linux_config_init/templates/etc_network_interface @@ -1,15 +1,10 @@ auto lo iface lo inet loopback -iface {{ in_face }} inet manual - ethernet-wol g -auto vmbr0 -iface vmbr0 inet static - address {{ ip }}/24 - gateway 192.168.5.1 - bridge-ports {{ in_face }} - bridge-stp off - bridge-fd 0 +auto {{ in_face }} +iface {{ in_face }} inet static +address {{ ip }}/24 +gateway 192.168.5.1 -source /etc/network/interfaces.d/* \ No newline at end of file +source /etc/network/interfaces.d/* diff --git a/roles/tools_for_command_line/tasks/administration.yml b/roles/tools_for_command_line/tasks/administration.yml index 422a84d..3f7079d 100644 --- a/roles/tools_for_command_line/tasks/administration.yml +++ b/roles/tools_for_command_line/tasks/administration.yml @@ -17,6 +17,7 @@ - powertop - rsync - iotop + - screen state: present - name: Wireguard deb diff --git a/zeus.yml b/zeus.yml index 977bd49..e3ea681 100644 --- a/zeus.yml +++ b/zeus.yml @@ -1,17 +1,40 @@ -- name: Init for zeus +#- name: Init for zeus +# hosts: zeus +# become: true +# vars: +# user: warezjoe +# uid: 1000 +# user_ssh_key_url: https://github.com/MatousVondrejka.keys +# host: zeus +# set_ip: true # false +# in_face: ens18 +# ip: 192.168.5.7 +# +# roles: +# - role: linux_config_init +# # - role: tools_for_command_line +# # - role: ansible-role-security +# # - role: zfs-install +# # - role: nfs-config + + +- name: Zfs dataset + NFS - Tata hosts: zeus become: true vars: - user: warezjoe - uid: 1000 - user_ssh_key_url: https://github.com/MatousVondrejka.keys - host: zeus - set_ip: true # false - in_face: ens18 - ip: 192.168.5.7 + user: tata + group: nogroup + uid: 1001 + zfs_pool_name: bigpool + zfs_dataset_name: tata + #zfs_dataset_mountpoint: /bigpool/tata + zfs_dataset_size: 1T + samba-mountpoint: /bigpool/tata + samba-user: tata + samba-range: 192.168.5.0/24 + roles: - - role: linux_config_init - - role: tools_for_command_line - - role: ansible-role-security - - role: zfs-install - - role: nfs-share + - role: create_zfs_dataset + # - role: create_user + # - role: samba_user +