erste Runde mit einer Ansible-Rolle

diff --git a/defaults/main.yml b/defaults/main.yml
new file mode 100644 (file)
index 0000000..a6f3ffe
--- /dev/null
+++ b/defaults/main.yml
@@ -0,0 +1,7 @@
+---
+fsit_cmgt_hallo: Hallo
+fsit_cmgt_aptproxy:
+fsit_cmgt_inventory:
+fsit_cmgt_benutzername:
+fsit_cmgt_kommentar:
+fsit_cmgt_is_sudoer: false 

diff --git a/files/apt-unattended-upgrades_10periodic b/files/apt-unattended-upgrades_10periodic
new file mode 100644 (file)
index 0000000..3144819
--- /dev/null
+++ b/files/apt-unattended-upgrades_10periodic
@@ -0,0 +1,4 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";

diff --git a/files/apt-unattended-upgrades_50unattended-upgrades b/files/apt-unattended-upgrades_50unattended-upgrades
new file mode 100644 (file)
index 0000000..0f2195b
--- /dev/null
+++ b/files/apt-unattended-upgrades_50unattended-upgrades
@@ -0,0 +1,132 @@
+// Automatically upgrade packages from these (origin:archive) pairs
+//
+// Note that in Ubuntu security updates may pull in new dependencies
+// from non-security sources (e.g. chromium). By allowing the release
+// pocket these get automatically pulled in.
+Unattended-Upgrade::Allowed-Origins {
+       "${distro_id}:${distro_codename}";
+       "${distro_id}:${distro_codename}-security";
+       // Extended Security Maintenance; doesn't necessarily exist for
+       // every release and this system may not have it installed, but if
+       // available, the policy for updates is such that unattended-upgrades
+       // should also install from here by default.
+       "${distro_id}ESMApps:${distro_codename}-apps-security";
+       "${distro_id}ESM:${distro_codename}-infra-security";
+       "${distro_id}:${distro_codename}-updates";
+       "LP-PPA-mozillateam:${distro_codename}";
+//     "${distro_id}:${distro_codename}-proposed";
+//     "${distro_id}:${distro_codename}-backports";
+};
+
+// Python regular expressions, matching packages to exclude from upgrading
+Unattended-Upgrade::Package-Blacklist {
+    // The following matches all packages starting with linux-
+//  "linux-";
+
+    // Use $ to explicitely define the end of a package name. Without
+    // the $, "libc6" would match all of them.
+//  "libc6$";
+//  "libc6-dev$";
+//  "libc6-i686$";
+
+    // Special characters need escaping
+//  "libstdc\+\+6$";
+
+    // The following matches packages like xen-system-amd64, xen-utils-4.1,
+    // xenstore-utils and libxenstore3.0
+//  "(lib)?xen(store)?";
+
+    // For more information about Python regular expressions, see
+    // https://docs.python.org/3/howto/regex.html
+};
+
+// This option controls whether the development release of Ubuntu will be
+// upgraded automatically. Valid values are "true", "false", and "auto".
+Unattended-Upgrade::DevRelease "auto";
+
+// This option allows you to control if on a unclean dpkg exit
+// unattended-upgrades will automatically run 
+//   dpkg --force-confold --configure -a
+// The default is true, to ensure updates keep getting installed
+//Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+
+// Split the upgrade into the smallest possible chunks so that
+// they can be interrupted with SIGTERM. This makes the upgrade
+// a bit slower but it has the benefit that shutdown while a upgrade
+// is running is possible (with a small delay)
+//Unattended-Upgrade::MinimalSteps "true";
+
+// Install all updates when the machine is shutting down
+// instead of doing it in the background while the machine is running.
+// This will (obviously) make shutdown slower.
+// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s.
+// This allows more time for unattended-upgrades to shut down gracefully
+// or even install a few packages in InstallOnShutdown mode, but is still a
+// big step back from the 30 minutes allowed for InstallOnShutdown previously.
+// Users enabling InstallOnShutdown mode are advised to increase
+// InhibitDelayMaxSec even further, possibly to 30 minutes.
+//Unattended-Upgrade::InstallOnShutdown "false";
+
+// Send email to this address for problems or packages upgrades
+// If empty or unset then no email is sent, make sure that you
+// have a working mail setup on your system. A package that provides
+// 'mailx' must be installed. E.g. "user@example.com"
+//Unattended-Upgrade::Mail "";
+
+// Set this value to one of:
+//    "always", "only-on-error" or "on-change"
+// If this is not set, then any legacy MailOnlyOnError (boolean) value
+// is used to chose between "only-on-error" and "on-change"
+//Unattended-Upgrade::MailReport "on-change";
+
+// Remove unused automatically installed kernel-related packages
+// (kernel images, kernel headers and kernel version locked tools).
+//Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+
+// Do automatic removal of newly unused dependencies after the upgrade
+//Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+
+// Do automatic removal of unused packages after the upgrade
+// (equivalent to apt-get autoremove)
+//Unattended-Upgrade::Remove-Unused-Dependencies "false";
+
+// Automatically reboot *WITHOUT CONFIRMATION* if
+//  the file /var/run/reboot-required is found after the upgrade
+//Unattended-Upgrade::Automatic-Reboot "false";
+
+// Automatically reboot even if there are users currently logged in
+// when Unattended-Upgrade::Automatic-Reboot is set to true
+//Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
+
+// If automatic reboot is enabled and needed, reboot at the specific
+// time instead of immediately
+//  Default: "now"
+//Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+
+// Use apt bandwidth limit feature, this example limits the download
+// speed to 70kb/sec
+//Acquire::http::Dl-Limit "70";
+
+// Enable logging to syslog. Default is False
+// Unattended-Upgrade::SyslogEnable "false";
+
+// Specify syslog facility. Default is daemon
+// Unattended-Upgrade::SyslogFacility "daemon";
+
+// Download and install upgrades only on AC power
+// (i.e. skip or gracefully stop updates on battery)
+// Unattended-Upgrade::OnlyOnACPower "true";
+
+// Download and install upgrades only on non-metered connection
+// (i.e. skip or gracefully stop updates on a metered connection)
+// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
+
+// Verbose logging
+// Unattended-Upgrade::Verbose "false";
+
+// Print debugging information both in unattended-upgrades and
+// in unattended-upgrade-shutdown
+// Unattended-Upgrade::Debug "false";
+
+// Allow package downgrade if Pin-Priority exceeds 1000
+// Unattended-Upgrade::Allow-downgrade "false";

diff --git a/files/gdm-ansible b/files/gdm-ansible
new file mode 100644 (file)
index 0000000..6c8964e
--- /dev/null
+++ b/files/gdm-ansible
@@ -0,0 +1,8 @@
+[User]
+Session=
+XSession=
+Icon=/home/ansible/.face
+SystemAccount=true
+
+[InputSource0]
+xkb=de

diff --git a/handlers/main.yml b/handlers/main.yml
new file mode 100644 (file)
index 0000000..4070444
--- /dev/null
+++ b/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: start fusioninventory-client
+  ansible.builtin.service:
+    name: fusioninventory-agent.service
+    state: restarted

diff --git a/tasks/add_user.yml b/tasks/add_user.yml
new file mode 100644 (file)
index 0000000..2b2d9d2
--- /dev/null
+++ b/tasks/add_user.yml
@@ -0,0 +1,17 @@
+---
+- name: Lege Benutzer an "{{ fsit_cmgt_kommentar }}"
+  user:
+    name: "{{ fsit_cmgt_benutzername }}"
+    comment: "{{ fsit_cmgt_kommentar }}"
+    update_password: on_create
+    password: "{{ initialpw|password_hash('sha512') }}"
+    generate_ssh_key: yes
+    ssh_key_type: ed25519
+    shell: /bin/bash
+  when: fsit_cmgt_benutzername != ""
+- name: add user to sudoers
+  user:
+    name: "{{ fsit_cmgt_benutzername }}"
+    groups: sudo
+    append: yes
+  when: fsit_cmgt_is_sudoer

diff --git a/tasks/bootstrap.yml b/tasks/bootstrap.yml
new file mode 100644 (file)
index 0000000..71fca35
--- /dev/null
+++ b/tasks/bootstrap.yml
@@ -0,0 +1,39 @@
+---
+- name: change ansible-user password
+  user:
+    name: ansible
+    update_password: always
+    password: "{{ ansibleuser|password_hash('sha512') }}"
+- name: hide system-account
+  ansible.builtin.copy:
+    src: gdm-ansible
+    dest: /var/lib/AccountsService/users/ansible
+    #- name: stop automatic remote printer installation
+    #ansible.builtin.systemd:
+    #name: cups-browsed
+    #state: stopped
+    #- name: disable automatic remote printer installation
+    #ansible.builtin.systemd:
+    #name: cups-browsed
+    #enabled: no
+- name: remove apt-config-file derived from preseeding
+  ansible.builtin.file:
+    path: /etc/apt/apt.conf
+    state: absent
+- name: copy new apt-proxy config file to apt.conf.d-dir
+  ansible.builtin.template:
+    src: apt-proxy_01proxy.j2
+    dest: /etc/apt/apt.conf.d/01proxy
+  when: fsit_cmgt_aptproxy != ""
+- name: Update and upgrade apt packages
+  apt:
+    update_cache: yes
+    upgrade: yes
+- name: install core-packages
+  apt:
+    pkg:
+    - htop
+    - glances
+    - inxi
+    - bmon
+...

diff --git a/tasks/inventory.yml b/tasks/inventory.yml
new file mode 100644 (file)
index 0000000..6a4dad0
--- /dev/null
+++ b/tasks/inventory.yml
@@ -0,0 +1,10 @@
+---
+- name: Install packages
+  apt:
+    pkg:
+      - fusioninventory-agent
+- name: Copy fusioninventory-agent cfg-file
+  ansible.builtin.template:
+    src: fusioninventory_01server.cfg.j2
+    dest: /etc/fusioninventory/conf.d/01server.cfg
+  notify: start fusioninventory-client

diff --git a/tasks/main.yml b/tasks/main.yml
new file mode 100644 (file)
index 0000000..9bd0882
--- /dev/null
+++ b/tasks/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Debug
+  ansible.builtin.debug:
+    msg: "was auch immer {{ fsit_cmgt_hallo }} "
+- name: Include bootstrap
+  ansible.builtin.include_tasks: bootstrap.yml
+- name: Include add_user
+  ansible.builtin.include_tasks: add_user.yml
+- name: Include inventory (last task)
+  ansible.builtin.include_tasks: inventory.yml

diff --git a/templates/apt-proxy_01proxy.j2 b/templates/apt-proxy_01proxy.j2
new file mode 100644 (file)
index 0000000..d645c48
--- /dev/null
+++ b/templates/apt-proxy_01proxy.j2
@@ -0,0 +1,2 @@
+Acquire::http { Proxy "http://{{ fsit_cmgt_aptproxy }}:3142"; };
+Acquire::https { Proxy "https://"; };

diff --git a/templates/fusioninventory_01server.cfg.j2 b/templates/fusioninventory_01server.cfg.j2
new file mode 100644 (file)
index 0000000..6a85739
--- /dev/null
+++ b/templates/fusioninventory_01server.cfg.j2
@@ -0,0 +1 @@
+server = http://{{ fsit_cmgt_inventory }}/plugins/fusioninventory/front/plugin_fusioninventory.communication.php