tasks/bootstrap.yml

   1 ---
   2 - block:
   3   - name: Remove apt-config-file derived from preseeding
   4     ansible.builtin.file:
   5       path: /etc/apt/apt.conf
   6       state: absent
   7     when: ("baremetal" in group_names)
   8   - name: Create apt-proxy config file
   9     ansible.builtin.template:
  10       src: apt-proxy_01proxy.j2
  11       dest: /etc/apt/apt.conf.d/01proxy
  12     when: ("DMZ" not in group_names)
  13   - name: Remove apt-config-file only for aptproxy
  14     ansible.builtin.file:
  15       path: /etc/apt/apt.conf.d/01proxy
  16       state: absent
  17     when: ("aptproxy" in inventory_hostname)
  18   - name: Copy apt-unattended-upgrades config file
  19     ansible.builtin.copy:
  20       src: apt-unattended-upgrades_10periodic
  21       dest: /etc/apt/apt.conf.d/10periodic
  22   - name: Update and upgrade apt packages
  23     ansible.builtin.apt:
  24       update_cache: true
  25       upgrade: true
  26       autoremove: true
  27   - name: Install core-packages
  28     ansible.builtin.apt:
  29       pkg:
  30         - sudo
  31         - gnupg
  32         - htop
  33         - ncdu
  34         - vim
  35         - tmux
  36         - gnupg2
  37         - nethogs
  38         - iftop
  39         - rsync
  40         - ripgrep
  41   - name: Install core-packages for bare-metal-server
  42     ansible.builtin.apt:
  43       pkg:
  44         - inxi
  45     when: ("baremetal" in group_names)
  46   - name: Install core-packages for server in DMZ
  47     ansible.builtin.apt:
  48       pkg:
  49         - fail2ban
  50     when: ("DMZ" in group_names)
  51   - name: Add ansible user to server
  52     ansible.builtin.user:
  53       name: ansible
  54       shell: /bin/bash
  55   - name: Allow "ansible"-user to have passwordless sudo
  56     ansible.builtin.copy:
  57       src: sudo_ansible
  58       dest: /etc/sudoers.d/ansible
  59       owner: root
  60       group: root
  61       mode: "0440"
  62   - name: Add installbox-ansible-user _public_ ssh-key to the servers authorized_keys file
  63     ansible.posix.authorized_key:
  64       user: ansible
  65       state: present
  66       manage_dir: true
  67       key: "{{ lookup('file', '/home/ansible/.ssh/id_ed25519.pub') }}"
  68   remote_user: root